Home → Blog → Visa 3DS DAF Sunset in 2026: 7 Migration Steps for High-Risk E-Commerce Merchants to Keep 3-D Secure Coverage Active

Visa 3DS DAF Sunset in 2026: 7 Migration Steps for High-Risk E-Commerce Merchants to Keep 3-D Secure Coverage Active

By admin Published
By admin · Published October 21, 2026

Call Bridge Capital Partners at 866-305-6454 to review your card-not-present payment processing and confirm your authentication setup. Visa’s Digital Authentication Framework (DAF) 3-D Secure program sunset in September 2026. Check your live payment flow now. Do not assume returning-customer challenge suppression still applies.

What DAF 3DS Was and What the Sunset Removes

Visa DAF 3DS was a program for qualifying authentication requests. Visa’s developer documentation describes a specific treatment for repeat authentication: when later requests met DAF requirements for the same merchant, customer, and payment account, the issuer was not permitted to request a step-up or challenge.

That mechanism mattered to merchants with returning customers. A customer who had already completed an eligible authentication could encounter fewer repeated challenges on subsequent qualifying requests. DAF did not eliminate 3-D Secure. It did not guarantee that every transaction would be frictionless. It applied to the repeat-request conditions set by Visa.

The sunset removes that DAF-specific challenge suppression. Since the program ended in September 2026, merchants should not rely on the old treatment for new authentication requests. Issuer decisions and other authentication methods still apply. The practical issue is whether your gateway, 3DS Server, and acquirer have updated their handling of returning-customer traffic.

This is a program migration, not a reason to disable 3DS. Keep authentication available. Confirm which current methods your providers support. Review how they route eligible transactions and report outcomes.

The Sunset Timeline

Visa’s October 2025 Merchant Business News Digest announced that it would sunset the DAF 3DS program in September 2026 while moving toward newer authentication methods, including Visa Payment Passkey. Visa also said it would accept no new DAF 3DS participants.

The digest gave merchants an early certification change: starting 30 October 2025, DAF test cases became optional for Visa Secure certification. That gave teams more flexibility when certifying an implementation without requiring DAF test coverage.

The sunset applies to the DAF 3DS program. Visa said the Visa Token Service (VTS) DAF program would remain in place, with no impact to token transactions. Do not treat that statement as an extension of DAF 3DS challenge suppression. Confirm how it applies to your particular token and authentication flows with your acquirer.

As of October 2026, the sunset period has passed. Merchants should verify their current production configuration and request written confirmation from their providers. Visa’s digest is a summary. It directs merchants to contact their acquirer for further information.

Why High-Risk Merchants Should Check Their Flows

Authentication affects the balance between fraud controls and checkout friction. A challenge can add steps for a legitimate buyer. A decline can stop a sale. A frictionless outcome can reduce disruption, but it does not mean every transaction is safe or approved.

High-risk merchants may feel changes in repeat-challenge behavior more sharply. Their checkout traffic can include recurring customers, stored credentials, and transactions that already receive closer issuer scrutiny. If customers encounter an unexpected challenge or an authentication failure, conversion and customer support may be affected. If the business responds by weakening controls without reviewing risk, it may expose itself to other problems.

The correct response is measurement, not assumptions. DAF’s end does not itself change Visa’s VAMP program. But authentication, fraud signals, disputes, and operating controls all matter to risk management. Keep your VAMP and dispute monitoring separate from this DAF migration. Use the dedicated Rapid Dispute Resolution and card testing attacks resources for those distinct topics.

A well-configured high risk merchant account can support specialized payment operations. It does not replace the need to verify how authentication works across your own gateway and processor.

Graphic-novel illustration of a payment operations team examining returning-customer authentication paths and a challenge-rate dashboard

Step 1: Inventory Your Current Authentication Stack

Start with a map of your production payment flow. Identify the components that participate in 3-D Secure. Include the checkout page or app, gateway, 3DS Server, processor, acquirer, fraud tools, and any orchestration layer that changes routing.

Ask whether DAF 3DS was ever enabled for your merchant ID, payment account, or particular transaction paths. If it was enabled, identify which traffic used it. Check for one-time purchases, stored credentials, subscription payments, account updates, and returning customers. Do not assume the same configuration covered each use case.

Then ask your gateway or processor to confirm, in writing:

A provider’s general product page may not answer these questions. Ask for a response tied to your merchant account and integration. If multiple providers touch the flow, request confirmation from each one.

Step 2: Baseline Challenge and Decline Rates

Create a clear baseline from your own transaction data. Record authentication requests, completed authentications, challenges presented, challenge completions, authentication failures, authorization approvals, and declines. Track those outcomes separately. An authorization decline is not the same as an authentication failure.

Segment the data so you can compare like with like. Separate first-time customers from returning customers. Review stored-credential and recurring traffic apart from one-time checkout. Where available, break results down by issuer, device type, card type, geography, gateway route, and transaction type.

Record the reporting window and definitions used by each provider. One dashboard may count challenge attempts; another may count completed challenges. Confirm what each metric includes before comparing reports.

Since the sunset has already taken place, use the most reliable pre-sunset reporting you retained as your comparison point. If the reporting platform did not preserve it, document that gap. Establish a current baseline now, and note any changes in configuration, routing, or customer mix that could affect comparisons.

Avoid treating a single movement as proof that the sunset caused a change. A shift may also reflect issuer behavior, traffic mix, fraud controls, or an unrelated gateway update. Ask your provider to help separate those factors.

Step 3: Evaluate Visa Payment Passkey Readiness

Visa identifies Visa Payment Passkey (VPP) as a newer authentication option. It is built to FIDO standards. The passkey is stored on the cardholder’s device and can replace passwords or SMS one-time codes with device-based authentication, such as a biometric or device PIN.

VPP is not a direct continuation of DAF. It uses a different setup and depends on participation across the payment experience. Visa says consumers complete a one-time setup to bind their device. A frictionless checkout experience is available at participating merchants. Visa also describes VPP as usable with EMV 3-D Secure.

Ask your gateway, processor, and acquirer whether they support Visa Payment Passkey for your merchant setup. Confirm the participating issuer and device requirements, how customer enrollment works, what happens when a customer has not enrolled, and what fallback flow is used when a passkey is unavailable. Confirm how results appear in your authentication reports.

Visa publishes a figure stating that biometric authentication had 50% lower fraud rates than SMS one-time passcodes. Visa’s footnote says the comparison was based on VisaNet data globally from July through December 2023, comparing biometric authentication to step-up by text-message OTP. Treat this as Visa’s published comparison, not an independent result or a forecast for your business. Your actual outcomes may vary by customer, issuer, device, and implementation.

Graphic-novel illustration of a customer using a secure passkey on a smartphone connected to an online checkout

Step 4: Confirm Your VCES Status

Visa Credential Enrichment Service (VCES) is separate from DAF 3DS. Visa describes VCES as a service designed to improve token-provisioning success rates for card-on-file token requestors.

Visa’s May 2026 digest says VCES would be enabled for all card-on-file token requestors effective 30 October 2026. Visa says it carries no extra product fee because it is covered as part of Digital Commerce Service Fees (DCSF). The digest gave token requestors an opt-out path through their acquirer, with an opt-out request due by 30 September 2026.

That opt-out deadline has passed. If you submitted an opt-out request, ask your acquirer to confirm its status. If you did not, contact your acquirer now to confirm your VCES status, the upcoming enablement, any applicable account actions, and how token-provisioning results will be reported. Do not assume that VCES replaces DAF 3DS. It addresses token provisioning, not the DAF repeat-challenge mechanism.

Step 5: Map DCAP Data Quality

Visa’s Digital Commerce Authentication Program (DCAP) launched in the United States on 18 April 2026. Visa’s digest warns that transactions that do not meet DCAP data-quality standards will not qualify and may be subject to compliance enforcement.

The enhanced data fields identified for DCAP are:

Map where each field originates in your checkout, customer, and payment systems. Check whether the values are present, correctly formatted, and passed through the required Visa Intelligent Data Exchange solution. Ask your provider to identify missing or rejected fields and explain how data-quality problems appear in reporting.

Do not treat a field as complete simply because your storefront collects it. The value must reach the appropriate payment flow and meet the program’s requirements. Review privacy notices, consent, data handling, and access controls with the appropriate internal teams before changing collection or transmission practices.

The Visa U.S.A. Interchange Reimbursement Fees schedule effective 18 April 2026 lists card-not-present incentive tiers for eligible transactions: Type 1 at minus 0.05% for EMV Token, Type 2 at minus 0.10% for DCAP, and Type 3 at minus 0.15% for DCAP plus EMV Token. These incentives require CPS qualification and are subject to change. The schedule also lists exclusions and special cases. Confirm your specific transaction eligibility with your financial institution.

Step 6: Work the Cost Math Honestly

Use the interchange schedule as a reference for possible qualification. Do not treat its incentive as a guaranteed reduction to your merchant discount. Visa explains that interchange reimbursement fees are between financial institutions. Merchants pay a merchant discount to their financial institution, which may include other processing services and charges.

Here is a modeled illustration using the Services 1 / All Other Products example in Visa’s schedule. The listed base rate is 1.65% + $0.10. If a transaction qualifies for Type 3, the listed 0.15% incentive yields an illustrative rate of 1.50% + $0.10. The percentage difference is 0.15 percentage points. On a $1,000 transaction, that percentage difference equals $1.50. The fixed $0.10 component is unchanged in this illustration.

This is arithmetic based on the schedule, not a quote, promise of savings, or prediction of your statement costs. Qualification, card product, transaction details, acquirer pricing, and other charges affect the outcome. Ask your acquirer to confirm the applicable category and show how the item will appear on your statement. Review your transparent credit card processing pricing separately from interchange eligibility.

Small Merchant Fee Program rules have their own caveats. Visa lists a qualifying ceiling of $280,000 in gross Visa consumer credit sales, based on twelve months of Visa system activity. In that program, DCAP alone generally qualifies for Type 1, with Small Merchant Product 1 as the stated exception: that product follows the Type 2 treatment for DCAP. Verify your merchant’s category and eligibility with the acquirer.

Charity 1 also has a specific carve-out in the schedule: DCAP transactions qualify for Type 1. The standard incentive treatment excludes Charity 1 and CPS/Utility from the usual EMV Token, DCAP, and combined Type 3 rules. Do not apply a standard tier to a transaction without checking its program category.

What the Sunset Means for Liability and VAMP Exposure

Authentication changes reach further than checkout friction. Visa's 3-D Secure programs move fraud liability for fully authenticated transactions, so a merchant whose authentication coverage weakens after the September 2026 sunset faces a different dispute posture, not just more customer friction. The mechanics are covered in our piece on 3D Secure 2.0 for high-risk e-commerce merchants, and the dispute-program side is covered in our Rapid Dispute Resolution explainer. The connection here is timing: a merchant who discovers a challenge-rate jump in October, after the sunset has already removed DAF suppression, is doing that discovery while VAMP ratio measurement continues in the background.

The practical sequencing advice is to measure before the change, not after. A baseline challenge rate captured before the sunset took effect gives the merchant an honest before-and-after comparison. A merchant who never baselines will only know that friction feels higher, and friction that cannot be quantified cannot be escalated to a gateway or acquirer with evidence.

Card-testing exposure follows the same logic. Authentication strength is one of the controls that keeps low-value card-testing attempts from escalating into dispute volume, and our guide to detecting card testing attacks covers the monitoring side of that control. A merchant re-working its authentication stack for the DAF sunset should treat that re-work as an opportunity to re-verify the rest of the chain rather than a single swap.

Step 7: Sequence the Migration and Re-Test

DAF 3DS has already sunset. If your migration work is incomplete, start with a provider review and a test plan. Do not make an untested production change to authentication rules.

Ask your gateway or processor to set up a controlled test using the routes and customer cases relevant to your business. Include a returning customer and a first-time customer. Include stored-credential traffic if you process it. Confirm the expected behavior for frictionless authentication, a challenge, an incomplete challenge, and an unavailable alternative method. Keep test and production results clearly separated.

Run the tests with your provider’s approved certification and testing methods. Visa’s October 2025 digest states that DAF test cases became optional for Visa Secure certification starting 30 October 2025. That does not mean all other certification or production testing is optional. Ask which current test cases apply to your specific implementation.

After making changes, monitor challenge rates, authentication completion, authorization approvals, and declines. Compare like-for-like segments against your baseline. Track customer support contacts related to checkout or authentication. Recheck the results after provider changes and when your transaction mix shifts.

If outcomes move unexpectedly, pause further rule changes and ask the provider to inspect the authentication and authorization records. Capture timestamps, response codes, transaction type, and route details. Keep a change log showing what was changed and when. This provides a practical record for your acquirer and internal teams.

Graphic-novel illustration of a merchant data-quality workbench showing device, IP address, email, and billing-address icons flowing into a secure payment network

What to Ask Your Gateway or Processor

Send a written request to your gateway, processor, and acquirer. Ask them to answer for your account and production configuration:

Request a written answer rather than relying on a general product description. Keep the response with your integration records.

Keep 3-D Secure Coverage Active

The DAF 3DS sunset removes a specific repeat-challenge treatment. It does not remove the need to manage authentication. Verify your current production flows, measure outcomes, and evaluate supported alternatives with your providers.

Keep authentication, tokenization, data quality, and interchange analysis distinct. For a broader view of 3D Secure 2.0, review the separate 3DS2 resource. For a provider review, confirm your payment gateway integration supports the functions your business actually uses. Review network tokenization separately from DAF and passkey authentication.

Call Bridge Capital Partners at 866-305-6454 to discuss gateway, processor, and high-risk payment processing options.

Sources

Need Help With Payment Processing?

Talk to our team about rates, gateways, and solutions for your business.

Get a Free Quote →