CCD2 Readiness: New 2FA Requirements for Pay Later Transactions

Dear Unzer Merchants & Partners,

As part of the revised EU Consumer Credit Directive (CCD2), new consumer verification requirements will apply from 20 November 2026.

With the 20 November 2026 deadline approaching, we strongly recommend reviewing your integration with Unzer / Payolution now and completing any required preparations as soon as possible, especially ahead of Black Friday and potential code freezes.

What do you need to do as a Merchant or Partner?

Depending on your integration type, technical updates may be required on your side.

The overview below provides a high-level introduction to the different integration types before explaining what the changes mean for your business and your customers. Please review the section relevant to your integration type and take the necessary action.

Using Unzer Payment Page, Unzer Pay Later Instore, or a plugin-supported shop system with the latest Unzer plugin version?

Using an older plugin version?

Please use our  CCD2 Readiness Check  to determine whether you need to update to a supported Unzer plugin version.

Using a server-side-only integration or UI Components (PAPI in JSON)?

Using a server-side-only integration with Payolution / PayOn Wrapper (XML)?

Please ensure your integration supports the new 2FA authentication flow and corresponding response handling. The required changes are described in the relevant  API Specifications .

Using a Payolution plugin or Payolution Instore?

Please contact us to discuss the switch to a supported plugin or Instore solution. Our teams will be happy to help identify the best option for your setup.

Contact: support@unzer.com

Using BNPL through a payment service partner (e.g. Payone, Qliro)?

Your payment service partner must support the new additional verification flow before any required changes can be implemented on your side. Please contact your payment service partner for information about their implementation plans and any actions required from you.

What does this mean for your business and customers?

What does this mean for your customers?

The new risk-based 2FA step is only triggered when additional verification is required. Most transactions will continue without this additional step, helping maintain a smooth checkout experience while satisfying regulatory requirements.

What does this mean for your business?

We expect the impact on conversion to be minimal, as additional verification will only be requested in selected scenarios.

The additional verification provides our risk engine with more information to make an informed decision and may help approve transactions that otherwise might not have been approved.

How Unzer will support you

Ongoing assessment of requirements

As part of our ongoing CCD2 readiness activities, we continue to assess the regulatory and technical requirements and their potential impact on our solutions and integrations.

If further changes or actions become necessary, we will proactively contact affected merchants and partners and provide the relevant information and guidance in due time.

Need help?