CCD2 readiness
Find out whether the additional risk-check authentication for Pay Later transactions affects your integration.
What is changing
As part of CCD2, the revised EU Consumer Credit Directive, Unzer is introducing an additional risk-check authentication step during checkout for Buy Now Pay Later transactions.
Depending on Unzer’s risk assessment of a given transaction, some customers are asked to complete an extra verification step before their order is confirmed. Unzer’s risk engine picks one or more methods per transaction:
- SMS one-time code
- Bank account owner verification through open banking
- ID document verification through WebID
- Regular income check through open banking
This affects Unzer Invoice, Unzer Installment, and Unzer Direct Debit.
Your integration effort is the same for every method
All four verification methods are built and hosted by Unzer, including the customer-facing screens and the identity, bank, and document checks. Your shop never builds method-specific UI or logic. Your integration needs to support the redirect flow once the transaction is in the PENDING state. Which method the customer sees behind that URL does not change what you build.
Not every transaction is affected, but your integration still needs to be ready
Unzer’s risk engine decides case by case which transactions need the extra step, and most will not. You cannot predict which ones will, and you cannot turn it off selectively on your side. If your integration is not updated, the first checkout the risk engine selects will fail. That is why readiness matters even if you expect this to affect only a small share of your orders.
Check what you need to do
The readiness check asks a few questions about your integration and tells you what to change, how to test it, and how to go live.
FAQ
Which payment methods does this affect?
Unzer Invoice, Unzer Installment, and Unzer Direct Debit. Card and PayPal already use comparable strong-authentication flows.
Does every transaction get an extra verification step?
No. Unzer’s risk engine decides case by case, and most transactions will not need it. Since you cannot predict or control which ones will, your integration needs to handle it regardless of how often it happens.
Why is Unzer introducing this?
Beyond the CCD2 requirement, the additional verification gives Unzer’s risk engine more data to work with. That means some customers can be approved who previously could not, which improves acceptance rates independently of the regulatory deadline.
What happens if my integration is not ready?
Without the additional verification available, the risk engine may not have enough data to make a positive decision, so it may decline transactions it would otherwise approve. This mainly affects higher-risk transactions such as large baskets or luxury goods.
Need help
Not sure which integration type applies to you? Check with your development team. If you still cannot tell, or you run into other issues, contact support@unzer.com.