CCD2 readiness
Find out whether the additional risk-check authentication for Pay Later transactions affects your integration.
What is changing
As part of CCD2, the revised EU Consumer Credit Directive, Unzer is introducing an additional risk-check authentication step during checkout for Buy Now Pay Later transactions.
Depending on Unzer’s risk assessment of a given transaction, some customers are asked to complete an extra verification step before their order is confirmed. Unzer’s risk engine picks one or more methods per transaction:
- SMS one-time code
- Bank account owner verification through open banking
- ID document verification through WebID
- Regular income check through open banking
This affects Unzer Invoice, Unzer Installment, and Unzer Direct Debit.
Your integration effort is the same for every method
All four verification methods are built and hosted by Unzer, including the customer-facing screens and the identity, bank, and document checks. Your shop never builds method-specific UI or logic. Your integration needs to support the redirect flow once the transaction is in the PENDING state. Which method the customer sees behind that URL does not change what you build.
Not every transaction is affected, but your integration still needs to be ready
Unzer’s risk engine decides case by case which transactions need the extra step, and most will not. You cannot predict which ones will, and you cannot turn it off selectively on your side. If your integration is not updated, the first checkout the risk engine selects will fail. That is why readiness matters even if you expect this to affect only a small share of your orders.
Check what you need to do
The readiness check asks a few questions about your integration and tells you what to change, how to test it, and how to go live.
What to do: Unzer server-side-only integration and UI Components (PAPI)
If you integrate directly against the PAPI, server-side only with no redirect in use today, you need to add support for a redirect step. This works the same way as the flow you most likely already have in place for 3-D Secure on cards.
The integration guide for each affected payment method describes the request and response changes step by step:
- Direct Debit Secured, server-side-only integration
- Unzer Installment, server-side-only integration
- Unzer Invoice, server-side-only integration
What to do: Payolution API, PayOn Wrapper and PSP integrations
If you integrate via the Payolution API or the PayOn Wrapper, over either the XML or the POST interface, check the updated Payolution API documentation.
Legacy Payolution plugins need migrating
Legacy Payolution plugins will not be updated for the new authentication flow. You need to move either to an Unzer plugin, listed in the plugin documentation, or to the Payolution server-side integration described above, depending on your setup.
Payolution Instore: a new product is ready
Unzer is introducing a new in-store BNPL experience, Unzer Instore, with the additional authentication step built in from the start. If you currently offer Payolution’s in-store BNPL, there is nothing for you to do right now. Unzer will reach out shortly to offer you the new product. Once you are on Unzer Instore, you are CCD2 ready.
What to do: Unzer (PAPI) plugins
If you use one of Unzer’s supported plugins for PAPI, the plugin already handles the redirect and the status flow for you. You only need to be on a version that has this built in.
Plugin version support
Based on our latest internal test pass, here is where each plugin stands. If you are on a supported version or newer, you are CCD2 ready and there is nothing for you to do.
| Plugin | Supported versions |
|---|---|
| Shopify | All versions |
| Shopware 6 | 7.0.0 and above |
| Magento 2 | 4.0.0 and above |
| Oxid 6 | All versions |
| Oxid 7 | All versions |
| Plentymarkets | All versions |
| PrestaShop | All versions |
| Payment Pages (UPP) | All versions |
| JTL 5 | 2.0.4 and above |
| WooCommerce | 2.1.4 and above |
| Shopware 5, Drupal, Ecwid, Gambio, Modified eCommerce, nopCommerce, Opencart, osCommerce, Sylius | Not supported |
Find the install and upgrade steps for your system in the plugin documentation.
FAQ
Which payment methods does this affect?
Unzer Invoice, Unzer Installment, and Unzer Direct Debit. Card and PayPal already use comparable strong-authentication flows.
Does every transaction get an extra verification step?
No. Unzer’s risk engine decides case by case, and most transactions will not need it. Since you cannot predict or control which ones will, your integration needs to handle it regardless of how often it happens.
Why is Unzer introducing this?
Beyond the CCD2 requirement, the additional verification gives Unzer’s risk engine more data to work with. That means some customers can be approved who previously could not, which improves acceptance rates independently of the regulatory deadline.
What happens if my integration is not ready?
Without the additional verification available, the risk engine may not have enough data to make a positive decision, so it may decline transactions it would otherwise approve. This mainly affects higher-risk transactions such as large baskets or luxury goods.
Need help
Not sure which integration type applies to you? Check with your development team. If you still cannot tell, or you run into other issues, contact support@unzer.com.