Perform full SCA at mandate setup (the initial CIT): authenticate the cardholder using 3DS2 with the recurring mandate framing; obtain CAVV and ECI and store the network transaction ID returned in the authorization response.
For all subsequent recurring MITs, flag the transaction as merchant-initiated with the appropriate recurring indicator and reference the original network transaction ID from mandate enrollment — subsequent MITs do not require SCA.
If an issuer returns authentication_required on a subsequent MIT (indicating the issuer requires fresh SCA), this is a step-up request; flag the transaction for cardholder re-engagement rather than retrying as MIT.
When the cardholder next accesses your application (next CIT session), initiate a new 3DS2 authentication in the context of the existing mandate: use the mandate's stored credential framework indicators and re-authenticate to satisfy the issuer's step-up requirement.
After successful step-up authentication, update your stored mandate record with the new network transaction ID and CAVV from the fresh authentication; resume subsequent MITs using this updated reference.
Log all step-up events and resulting authentications for compliance audit trails under PSD2 record-keeping obligations.
Known gotchas
PSD2 does not require re-SCA on every recurring MIT after the initial mandate setup — issuers that demand SCA on every recurring payment are non-compliant, but you still must handle these declines gracefully.
Step-up authentication for recurring mandates must be framed as a mandate re-authentication, not a new enrollment, or the stored credential chain breaks and interchange qualifications may change.
90-day SCA re-authentication rules under PSD2 apply to account access (open banking) not to recurring card payments authorized under a mandate; confusing the two leads to unnecessary re-authentication prompts.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp