---
title: "Credit Card Security Guidelines"
description: "Learn about the Credit Card Security Guidelines 5.0 in Japan."
url: "https://docs.adyen.com/industries/markets/japan/credit-card-security-guidelines-compliance-guide"
source_url: "https://docs.adyen.com/industries/markets/japan/credit-card-security-guidelines-compliance-guide.md"
canonical: "https://docs.adyen.com/industries/markets/japan/credit-card-security-guidelines-compliance-guide"
last_modified: "2023-02-21T16:58:00+01:00"
language: "en"
---

# Credit Card Security Guidelines

Learn about the Credit Card Security Guidelines 5.0 in Japan.

[View source](/industries/markets/japan/credit-card-security-guidelines-compliance-guide.md)

The Credit Transaction Security Council of Japan announced that all online credit card payments in Japan will require [Strong Customer Authentication](/get-started-with-adyen/adyen-glossary/#strong-customer-authentication-sca) (SCA) for credit cards processed over Japan acquiring connections, effective **April 01, 2025**. This means that all transactions that fall under the scope of the regulation must be authenticated with 3D Secure.

The information we provide in this guide can help you prepare for complying with regulations in Japan. However, the information here should not be taken as legal advice. This guide supplements the following sources:

* Regulatory guidance provided by official domestic authorities.
* Card scheme regulations.
* EMVCo specifications for the 3D Secure 2 protocol.

## Credit Card Security Guidelines 5.0

The guidelines have implications for [online](#online-payments) and [in-person](#in-person) payments.

### Online payments

All merchants that process online credit card payments in Japan must implement [3D Secure 2 authentication for regulation compliance](/online-payments/3d-secure-for-regulation-compliance/) in their online payments flow, according to the [Credit Card Security Guidelines 5.0](https://www.j-credit.or.jp/security/document/index.html#EMV3DS)(Japanese).

The regulation aims to reduce card fraud in digital transactions and prevent fraudulent use of credit card information, and applies to payments with credit cards issued in and outside of Japan. According to the guidelines, all online credit card payments require 3D Secure 2 authentication, except [out-of-scope](#out-of-scope) transactions.

### In-person payments

If you have an in-person payments integration, the following will apply:

* You can no longer [bypass PIN entry](/point-of-sale/add-data/tender-options/#tender-options-saletoacquirerdata).
* [Obtaining a signature](/point-of-sale/shopper-engagement/shopper-input/signature/) will no longer be a valid cardholder verification method.

[In-person payments](/point-of-sale/) integrations with Adyen remain compliant, and you do not need to take any action.

## In-scope transactions

All online credit card payments that do not meet the [out-of-scope](#out-of-scope) criteria are in-scope and require 3D Secure 2 authentication.

If you [implement 3D Secure 2 with Adyen](#implement-3ds-with-adyen), our Authentication Engine is enabled by default and handles compliance for you. We determine the transactions that fall under the scope of the regulation and trigger 3D Secure 2 for in-scope transactions.

If you process [recurring payments](/online-payments/tokenization#recurring-payment-types), some transactions are in-scope. Whether a transaction is in-scope depends on the recurring payment type and moment:

### Tab: One-off payments

One-off transactions where a shopper can either store their payment details or pay in your website or app at a later time using their saved details.

|                  | SCA required?                                                                                                         | `recurringProcessingModel` | `shopperInteraction` |
| ---------------- | --------------------------------------------------------------------------------------------------------------------- | -------------------------- | -------------------- |
| Initial payment  | ![-white\_check\_mark-](/user/data/smileys/emoji/white_check_mark.png "-white_check_mark-") [See exemptions](#engine) | **CardOnFile**             | **Ecommerce**        |
| Later payment(s) | [Only in some cases](#engine)                                                                                         | **CardOnFile**             | **ContAuth**         |

[]()

### Risk-based authentication

Adyen can exempt **CardOnFile** transactions from strong customer authentication (SCA) based on our risk assessment powered by machine learning. Our Authentication Engine helps decide when 3D Secure 2 is required and when it is optional.

SCA is not required for the following transactions:

* Any initial [zero-auth transaction](/get-started-with-adyen/adyen-glossary/#zero-value-auth) (**Ecommerce**, **CardOnFile**) that Adyen has classified as low risk.
* Any later payment (**ContAuth**, **CardOnFile**) that uses a token that was previously authenticated, that Adyen has classified as low risk, and you tokenize cards with Adyen.
* The transaction uses a token that was created before 1 April 2025. These transactions are considered out of scope of the regulation.

For these transactions, Adyen will use your [preference for 3D Secure 2](#implement-3ds-with-adyen) to determine whether to request SCA.

SCA is required for one-off transactions with a value higher than zero, payments with tokens that were not previously authenticated, and high-risk transactions.

### Tab: Subscriptions

A recurring transaction made at regular intervals for a product or a service.

|                  | SCA required?                                                                               | `recurringProcessingModel` | `shopperInteraction` |
| ---------------- | ------------------------------------------------------------------------------------------- | -------------------------- | -------------------- |
| Initial payment  | ![-white\_check\_mark-](/user/data/smileys/emoji/white_check_mark.png "-white_check_mark-") | **Subscription**           | **Ecommerce**        |
| Later payment(s) | Only required when the shopper agreement's terms change.                                    | **Subscription**           | **ContAuth**         |

### Tab: Automatic top-ups and other non-fixed schedule contracts

Contracts that occur on a non-fixed schedule using stored card details. This includes automatic top-ups when the cardholder's balance drops below a certain amount.

|                  | SCA required?                                                                               | `recurringProcessingModel` | `shopperInteraction` |
| ---------------- | ------------------------------------------------------------------------------------------- | -------------------------- | -------------------- |
| Initial payment  | ![-white\_check\_mark-](/user/data/smileys/emoji/white_check_mark.png "-white_check_mark-") | **UnscheduledCardOnFile**  | **Ecommerce**        |
| Later payment(s) | Only required when the shopper agreement's terms change.                                    | **UnscheduledCardOnFile**  | **ContAuth**         |

## Out-of-scope transactions

The following types of transactions are out-of-scope:

* Transactions made with prepaid and debit cards.
* Transactions initiated from devices that do not support 3D Secure, such as game consoles or smart speakers.
* [MOTO](/get-started-with-adyen/adyen-glossary/#mail-ordertelephone-order-moto) transactions.
* A recurring payment that happens under the same shopper agreement with the same card, such as a [subscription payment](/online-payments/tokenization/#recurring-payment-types).
* Transactions that occur in separate environments for business to business or internal employee purchases.
* All transactions where the shopper uses [Google Pay](/payment-methods/google-pay) or [Apple Pay](/payment-methods/apple-pay) to complete the payment.

When you [implement 3D Secure 2 with Adyen](#implement-3ds-with-adyen), we will not trigger 3D Secure for out-of-scope transactions.

## Implement 3D Secure 2 with Adyen

To comply with the regulation, we recommend that you [implement 3D Secure 2 authentication with Adyen](/online-payments/3d-secure/). We determine whether the payment requires 3D Secure authentication, and ensure that you stay compliant by always applying 3D Secure if the transaction falls under the scope of the regulation.

If you do not implement 3D Secure 2 with Adyen, it is your responsibility to ensure that all online credit card payments that you request to process with Adyen are authenticated with 3D Secure 2. [Send the third-party authentication data](/online-payments/3d-secure/other-3ds-flows/authorize-mpidata/#make-a-payment-with-third-party-authentication-data) in your payment request to Adyen.

Use one of the following compliant integrations:

| Integration type                                                | Description                                                                                                                                                                |
| --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Drop-in/Components](https://github.com/Adyen/#online-payments) | Pre-built UI elements available for Web, Android, iOS, React Native, and Flutter.                                                                                          |
| Hosted Checkout                                                 | Quick-to-integrate Adyen-hosted webpage solution.                                                                                                                          |
| Plugins                                                         | Adyen payments plugins for Adobe Commerce (formerly Magento 2), Salesforce Commerce Cloud, Shopware 5 and 6, Prestashop, SAP Commerce (Hybris), and Oracle Commerce Cloud. |

After you have set up one of the compliant 3D Secure 2 solutions, you can:

* **Let Adyen handle compliance by default**: Adyen applies 3D Secure 2 when the transaction falls under the scope of the regulation. To mitigate any effects on conversion, we will not trigger 3D Secure for [out-of-scope](#out-of-scope) transactions. To make sure Adyen can handle the 3D Secure routing for you, make sure that:

  * Your [default Dynamic 3D Secure rule](/risk-management/dynamic-3d-secure/#default-rules) is set to **Prefer Not**.

  * You do not override the platform logic and block 3D Secure in your API requests by including:

    * Checkout API v69 or later: [authenticationData.attemptAuthentication](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-authenticationData-attemptAuthentication):**never**
    * Checkout API v68 or earlier: [executeThreeD](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-additionalData-AdditionalData3DSecure-executeThreeD): **false**

* **Configure rules using Dynamic 3D Secure**: Define additional conditions for transactions that you want to apply 3D Secure authentication on. For more information, refer to [Dynamic 3D Secure](/risk-management/dynamic-3d-secure/).

* **Submit your preference for each transaction in your API request**: Specify in each payment request whether you want to perform 3D Secure authentication on this transaction, by including:

  * `authenticationData.attemptAuthentication`: Set to **always** if you want to perform 3D Secure authentication on this transaction, **never** if not. We do not recommend setting it to **never**.

  We recommend to submit preference in API requests only if you have extensive knowledge of the Credit Card Security Guidelines and the 3D Secure protocol, because this overrides our default 3D Secure 2 handling logic and may result in non-compliance and harm overall performance in regulated markets.
