Strong Customer Authentication (SCA) Compliance Audit
Independent assessment of security measures under the National Bank of Georgia's Strong Customer Authentication Rule, including authentication mechanisms, payment transaction monitoring, exemption management and fraud prevention controls.
Audience
Who Is This Audit For?
Article 1 defines the providers within the rule's scope. We determine the applicable controls and audit obligations from each provider's activities, channels and exemptions.
Commercial banks
Internet and mobile banking, card and account channels.
Microbanks
Microbanks licensed by the National Bank of Georgia.
Registered payment service providers
Providers registered with the National Bank of Georgia.
Microfinance organizations
Organizations within Article 1's defined payment-service-provider scope.
The precise scope depends on the provider's regulated activities, payment channels, applicable provisions and exemptions. We confirm applicability before work begins.
Audit scope
Nine Areas of Assessment
Each audit is scoped to the services and channels that fall under the rule. The areas below describe what we examine; the final scope is agreed for each engagement.
Strong Authentication Architecture
Articles 2, 3 and 6: we assess independent factors, one-time codes, failed attempts, blocking and session protection against the conditions that apply to each channel.
- Knowledge, possession and inherence factors
- Independence of authentication elements
- One-time code generation and resistance to forgery or reuse
- Failed attempts and authentication blocking
- Session protection and inactivity limits
- Risk-based application and recovery controls
- Protection of authentication credentials
Generic multifactor authentication (MFA) and regulatory SCA are not the same. MFA is a design approach; SCA is the specific standard set by the rule, with requirements on independence of elements, authentication codes and dynamic linking. A system can use MFA and still fall short of SCA.
Dynamic Linking and Payment Authorization
Under Article 7, we test whether the code is tied to the displayed payment amount and payee and becomes invalid if either changes.
- Payment amount and payee displayed to the payer
- Code bound to the specific amount and payee
- Code invalidation when payment details change
- Integrity of the transaction details
- Card-payment authorization where applicable
- Batch-payment authorization where applicable
- Secure authorization flows
Authentication Factor Security
Articles 8–11: we review protection of knowledge, possession and inherence factors, their independence and risks on multifunctional devices.
- Knowledge factor protection
- Possession element and replication resistance
- Biometric and inherence security
- Independence of factors
- Multifunctional device risks
- Secure execution environments
- Tamper protection
SCA Exemptions
Articles 12–20 permit specific exemptions only when their conditions are met. We check eligibility, monitoring and evidence for each exemption the provider actually uses.
- Account-information access and contactless payments
- Transport and parking terminals
- Trusted beneficiaries and recurring payments
- Transfers between the same person's accounts
- Low-value payments
- Secure corporate payment processes
- Transaction Risk Analysis exemption
- Eligibility, monitoring, evidence and withdrawal
Not every exemption is available to every provider. Each is conditional, and the audit does not assume any exemption applies.
Transaction Monitoring and Fraud Detection
Articles 3 and 20–23: we review unauthorized-transaction detection and risk-based analysis. Real-time monitoring is assessed where the rule requires it, including instant payments and Article 20 exemption use.
- Transaction monitoring mechanisms
- Fraud detection rules
- Risk scoring and decision logic
- Unusual payment behavior
- Device, location and authentication anomalies
- Fraud monitoring metrics
- Data quality and reporting integrity
- Relevant escalation and response processes
Fraud-rate calculation and audit requirements are assessed only where they apply to the provider, for example where it relies on exemptions that depend on fraud rates.
Protection of Personalized Security Credentials
Articles 24–29: we assess credential confidentiality, integrity and cryptographic protection throughout generation, delivery, activation, use, renewal and revocation.
- Credential confidentiality and integrity
- Secure generation and delivery
- Credential storage and processing
- Cryptographic protection
- Access restrictions
- Customer-device binding and activation
- Renewal, deactivation and revocation
Fraud Rate Calculation and TRA Audit
Articles 5(3), 5(5), 20–23 and the Annex: this specialized review applies where a provider relies on the Article 20 transaction-risk exemption.
- Fraud-rate methodology and relevant transaction categories
- Completeness and accuracy of source data and reported rates
- Quarterly calculations and applicable thresholds
- TRA model design and effectiveness
- Regulatory reporting and supporting records
- Suspension and resumption of the exemption
- At least annual audit of methodology, model and rates
- Independent external audit within the first year and at least every three years thereafter, or more often if required
Special Fraud Protection for Customers Over 60
Article 23¹ requires individual behavioral profiling for customers older than 60. For card transactions its 2026 amendment is in force; for other electronic payments the amendment sets a 1 May 2027 implementation date.
- Individual behavioral profile and unusual activity detection
- Amount above GEL 500 as one of the combined indicators
- High-risk activity and merchant categories
- Unusual spending or behavior under the rule's specified factors
- 48-hour suspension, or refusal where suspension is technically impossible, only when all specified conditions coincide
- Customer contact, additional explicit consent and handling after the 48-hour period
- Exclusion for card payments at a physical POS terminal
- Evidence of monitoring rules and operational decisions
A payment above GEL 500 alone does not trigger an automatic 48-hour hold. The amount, high-risk activity and unusual-behavior conditions must all be met.
E-commerce and Transitional Requirements
Article 31 distinguishes current obligations from transitional permissions. Issuers and acquirers must implement applicable e-commerce mechanisms or an NBG-agreed security model by 1 January 2027; earlier transitional dates are not future deadlines.
- Applicable e-commerce authorization requirements
- Issuer and acquirer responsibilities
- NBG-agreed alternative security model where applicable
- 1 January 2027 implementation deadline for relevant e-commerce mechanisms
- Risk-based transitional permissions before that date
- Evidence distinguishing current controls from planned changes
Engagement types
Three SCA Audit Engagements
Article 5 sets different legal bases, frequencies and independence requirements. We agree which engagement applies before defining the audit scope.
Annual security measures audit
Article 5(1) requires documentation, testing, assessment and audit at least annually under the provider's procedures. A qualified, operationally independent internal or external auditor may perform the audit.
TRA methodology and fraud-rate audit
Article 20 exemption users must audit the methodology, model and reported fraud rates at least annually, including data completeness and accuracy.
Independent external SCA audit
External audit applies when the NBG requires specified components under Article 5(4), or for Article 20 exemption users within the first year and at least every three years thereafter under Article 5(5), unless the NBG requires greater frequency.
Method
Our Audit Approach
A structured, evidence-based process in six stages.
Stage 1 — Scope & Planning
Identify applicable requirements, business services, systems, channels, responsible teams and audit boundaries.
Stage 2 — Regulatory Mapping
Map the provider's controls to the provisions that apply to its services, channels and exemptions.
Stage 3 — Documentation & Evidence Review
Review policies, technical configurations, system architecture, risk assessments, transaction controls and relevant evidence.
Stage 4 — Technical Control Testing
Perform authorized, risk-based testing of authentication mechanisms, transaction authorization, exemptions, session controls and monitoring capabilities.
Stage 5 — Compliance & Gap Assessment
Map findings to applicable regulatory requirements and assess control design and operating effectiveness.
Stage 6 — Reporting & Recommendations
Deliver a structured audit report with findings, risk ratings, supporting evidence and prioritized recommendations.
Penetration testing is not part of every SCA audit. It is an additional activity performed only where the engagement scope explicitly includes it.
Evidence
Evidence Tailored to the Audit Scope
We request only evidence relevant to the agreed activities and provisions. Typical sources include:
Authentication architecture diagrams and SCA configuration
Payment authorization workflows and transaction logs
Authentication logs and failed-attempt records
Fraud-monitoring rules and alerts
TRA models, methodology and fraud-rate calculations
Exemption decisions and registers
Risk assessments and credential-management procedures
Technical security test results
Relevant third-party contracts
Previous audit reports and corrective action plans
Deliverables
Audit Deliverables
Every engagement produces documents you can use for management decisions, corrective planning and supervisory dialogue.
Independent SCA Compliance Audit Report
A structured report describing the scope, methodology, evaluated requirements, findings and overall assessment.
Regulatory Compliance Matrix
Requirement-by-requirement mapping of applicable National Bank of Georgia provisions against the organization's implemented controls.
Technical Findings Register
Documented control deficiencies with evidence, impact, risk rating and affected systems or processes.
Fraud Monitoring and TRA Assessment (where applicable)
A distinct review of fraud-rate data, models, methodology and exemption controls when Article 20 applies.
Corrective Action Recommendations
Prioritized recommendations to address identified gaps.
Executive Summary
Management-level summary of key risks, regulatory exposure and recommended actions.
Remediation Follow-Up (Optional)
A separate follow-up assessment of corrective actions, if included in the engagement.
The audit does not result in a certificate, regulatory approval or a guaranteed compliance outcome.
Business value
What the audit helps you improve
An independent assessment turns regulatory requirements into a prioritized, evidence-based improvement plan.
Identify regulatory gaps
Map applicable requirements to implemented controls.
Validate authentication security
Evaluate factors, independence and secure operation.
Improve fraud prevention
Review monitoring, detection and response controls.
Assess exemptions
Verify eligibility and continuing conditions for exemptions used.
Strengthen evidence and reporting
Improve the traceability of findings and supervisory records.
Prioritize remediation
Focus corrective work on material risks.
Improve payment resilience
Identify weaknesses in critical authentication flows.
Prepare for regulatory review
Organize defensible evidence and clear corrective plans.
Our capabilities
Why IO Consulting?
An SCA assessment needs both regulatory understanding and technical depth. Our work combines the two.
Information security and IT audit expertise
Audit work grounded in information security practice.
Regulatory compliance assessment
Findings mapped to the provisions they relate to.
Understanding of financial-sector technology risks
Attention to how payment channels and their dependencies work in practice.
Technical control testing
Conclusions based on testing, not on documents alone.
Evidence-based reporting
Every finding is supported by traceable evidence.
Practical remediation recommendations
Prioritized actions your teams can plan and carry out.
Regulatory Basis
Regulatory Basis of the Audit
The audit is based on the Strong Customer Authentication Rule approved by the National Bank of Georgia (Order No. 156/04 of 2 September 2020, as amended). Article 1 includes licensed commercial banks and microbanks, registered payment service providers and microfinance organizations within the defined scope.
This is a Georgian regulation. We do not apply EU PSD2 or its regulatory technical standards as if they were the governing text, and the SCA rule is distinct from the National Bank of Georgia's broader information security and cybersecurity requirements.
Official sources
- Strong Customer Authentication Rule — Legislative Herald of Georgia
Primary legal source for the rule and its amendments.
- Strong Customer Authentication — National Bank of Georgia
The regulator's overview of the rule and who it applies to.
What the rule regulates
- Articles 2–3
- Strong authentication uses two or more independent elements from the categories of knowledge, possession and inherence. It is required when a payer accesses a payment account online, initiates an electronic payment or performs a remote action that carries a risk of fraud.
- Article 6
- Authentication codes must be single-use and resistant to derivation and forgery. The article also sets limits on failed attempts and on inactivity in an online session.
- Article 7
- For electronic payments, the authentication code must be linked to the payee and the amount, and must stop being valid if either changes.
- Articles 12–20
- The rule permits exemptions from strong authentication only under defined conditions. They cover areas such as account information, certain contactless and low-value payments, trusted beneficiaries, recurring payments, transfers between a customer's own accounts, secure corporate processes and transaction risk analysis. Each exemption is conditional and is not available to every provider by default.
- Article 5
- Security measures must be documented, tested, assessed and audited at least annually. The auditor must be operationally independent and competent in IT security and payment services, whether internal or external. Article 20 exemption users must also audit methodology, models and reported fraud rates annually, including data completeness and accuracy. The NBG may require an external audit of specified components; Article 20 users also need an independent external audit within one year of first use and at least every three years thereafter, or more often if required. On NBG request, a full audit report is due within 14 calendar days.
- Articles 21–23
- Providers that rely on certain exemptions calculate and document fraud rates, monitor them periodically, retain the data and notify the National Bank of Georgia when thresholds are exceeded.
- Article 23¹
- Special monitoring protects customers older than 60. The 48-hour suspension or refusal applies only when all listed amount, high-risk activity and unusual-behavior conditions coincide; physical POS card payments are excluded. The 2026 amendment applies to card payments from 1 September 2026 and other electronic payments from 1 May 2027.
- Article 31
- Issuer and acquirer e-commerce responsibilities include implementation of applicable mechanisms or an NBG-agreed security model by 1 January 2027. Other transitional permissions have their own conditions and dates; expired deadlines are not future obligations.
Checked against the supplied consolidated text through amendment No. 208/04 of 27 August 2026. Confirm later amendments and organization-specific applicability before relying on this summary; it is not legal advice.
FAQ
Frequently Asked Questions
What is Strong Customer Authentication (SCA)?
Under the National Bank of Georgia's rule, strong authentication verifies a payer using at least two independent elements from different categories: something only the user knows, something only the user has, and something the user is. It must be applied when the payer accesses a payment account online, initiates an electronic payment or takes a remote action that carries a risk of fraud.
How does SCA differ from ordinary MFA?
MFA is a general security approach. SCA is the specific standard in the rule: the elements must belong to different categories and be independent, so that compromising one does not compromise the others. Authentication codes must be single-use, and for payments they must be linked to the payee and the amount. An MFA design that does not meet these conditions may not be SCA-compliant.
Which organizations are subject to the National Bank of Georgia's SCA rule?
Article 1 includes NBG-licensed commercial banks and microbanks, NBG-registered payment service providers and microfinance organizations in the defined scope. The applicable controls depend on the provider's status, services, channels and exemptions.
When can an SCA exemption be applied?
Only in the cases and under the conditions the rule lists, such as account information access, certain contactless and low-value payments, trusted beneficiaries, recurring payments, transfers between a customer's own accounts, secure corporate processes and transaction risk analysis. Exemptions are optional, conditional and tied to monitoring and, in some cases, fraud-rate requirements. Strong authentication remains the default rule, and the audit checks whether each exemption a provider uses is justified.
What documentation and technical evidence are needed for the audit?
Typically: SCA policies and procedures, authentication architecture and configuration, risk assessments, descriptions of authentication flows, exemption decisions and their supporting analysis, fraud-monitoring rules and reports, incident and exception records, third-party and outsourcing arrangements, and results of earlier audits. The exact list is agreed during scoping.
What does the final SCA audit report include?
The report records scope, method, evaluated provisions, evidence, risk-rated findings and corrective recommendations. Deliverables can include a compliance matrix, technical register, TRA assessment where applicable and executive summary. Upon NBG request the provider must submit the complete audit report within 14 calendar days. Audit does not confer certification or regulatory approval.
Is an annual SCA audit mandatory?
Article 5(1) requires providers to document, test, assess and audit the rule's security measures at least annually under their procedures. The audit must assess and report on conformity. Article 20 exemption users also have an annual audit of their methodology, model and reported fraud rates.
Must every annual SCA audit be external?
No. Article 5(2) permits an employee or external auditor who is operationally independent and competent in IT security and payment services. The NBG may require an external audit of specified components. Article 20 exemption users need an independent external audit within one year of starting use and at least every three years thereafter, or more frequently if the NBG requires.
What extra audits apply to TRA exemptions?
Article 20 exemption users must audit their methodology, model and reported fraud rates at least annually, including data completeness and accuracy. Article 5(5) additionally requires independent external audit within one year of first use and at least every three years thereafter, or more often if required by the NBG.
What controls are examined during an SCA audit?
Depending on the agreed scope, we examine independent factors, one-time codes, dynamic linking, sessions, transaction monitoring, exemptions, fraud rates, older-customer protections and personalized security credentials against the applicable provisions.
What special fraud protections apply to customers over 60?
Article 23¹ requires individual behavioral profiling and risk-based monitoring. A 48-hour suspension or refusal applies only when the amount exceeds GEL 500, the transaction relates to specified high-risk activity and unusual behavior is identified under the rule's factors together. Customer contact and additional explicit consent are required before a held payment may proceed after the period. Physical POS card payments are excluded. The 2026 amendment applies to card payments from 1 September 2026 and other electronic payments from 1 May 2027.
Does an SCA audit include penetration testing?
Not automatically. Authorized testing of relevant technical controls can be included in the audit. A penetration test is a separate activity only when explicitly agreed in the engagement scope.
Assess Your Organization's SCA Regulatory Compliance
IO Consulting provides independent audits of security measures required under Georgia's Strong Customer Authentication Rule, including technical control testing, regulatory gap assessment and actionable recommendations.
Request an SCA Audit