Strong customer authentication is a requirement under PSD2 in the EU that customers prove who they are with at least two independent factors from different categories, something they know, something they have and something they are, before accessing accounts online or making many electronic payments; the UK has similar rules. It proves the customer is present and consenting.
Why does strong customer authentication matter once AI agents act?
Because its whole purpose is to prove a person is acting, and an agent is not that person. If an agent holds a customer's password and receives their one-time codes, every authentication succeeds and proves nothing. The control is defeated without anyone noticing.
So agents acting for customers need a different pattern. The agent prepares the action; the customer authenticates it, on their own device, seeing what they are approving. For remote payments, the authentication is tied to the specific amount and payee, so approving one payment cannot be reused for another. How this works when an agent starts the payment is covered in PSD2 strong customer authentication when an AI agent initiates a payment.
How does it work in practice?
The three categories of factor are:
- Knowledge: something only the customer knows, such as a PIN or password.
- Possession: something only they hold, such as a registered phone or card reader.
- Inherence: something they are, such as a fingerprint or face.
Two must be used, from different categories, and the compromise of one must not reveal the other. The rules allow exemptions in some cases, such as some low-value payments or payees the customer has marked as trusted, applied according to the rules and the bank's own risk analysis.
What does that look like in an example?
An expense management firm's agent prepares a payment of 2,500 from a client company's business account to a supplier. The bank requires authentication. The agent sends the request to the finance director's banking app, which shows the payee, the amount and the reference. She approves it with her face on her registered phone. The agent never sees or stores any of her factors. If she had not approved, the payment would have stayed pending and the agent would have reported it as held, waiting for her. Whether an agent may ever complete the step itself is answered in can an AI agent complete strong customer authentication for a customer?
How is it different from KYC identity checks?
KYC verifies who a customer is when the relationship starts and as it continues: documents, data checks, screening. Strong customer authentication verifies that the person acting now is that same customer, at each login or payment. KYC answers "who is this customer?" Authentication answers "is the customer here?" An agent can help with the first, gathering and comparing evidence. It cannot stand in for the second.
Neither says anything about whether the customer should be lent money; that is a separate judgement, discussed in can an AI agent score a customer's creditworthiness?
Which related terms should you know?
- Exemption: a case where the rules allow a payment without full authentication.
- Dynamic linking: tying the authentication to a specific amount and payee.
The limits on agents across banking are in AI agents in banking.
Questions people ask
Can an agent store a customer's one-time codes?
No. Codes, passwords and biometric data are the customer's factors. An agent that holds them breaks the purpose of authentication and creates a target for attack.
Does every payment need strong customer authentication?
No. Exemptions exist under the rules for some payments, and banks apply them based on their risk analysis. An agent should never try to steer a payment into an exemption to avoid asking the customer.