A couple of clients using PayPal have received an email regarding a new European Union directive.

Some info from the email –

As a business accepting card payments, your online checkout will need upgrading to comply with a new European Union directive requiring Strong Customer Authentication (SCA). The directive applies from 14 September 2019, but card issuers are working towards SCA by April so that their systems are fully operational by the deadline.

Want to know more?

Find out more about PSD2 and check out our guide to integration - https://www.paypal.com/uk/webapps/mpp/psd2

As I understand it, no changes are required if users are redirected from your website to PayPal (hosted payment integration) but changes are required if you accept card payment on the actual website (Direct or in-line payment processors)

PayPal is one of the core payment processors in CiviCRM and the in-line option is now also compatible with webforms so I’m guessing this will affect many.

How do we move forward to be ready by the deadline as transactions will be declined if no action is taken?

I’m guessing this will also affect other in-line payment processors?


2 Answers 2


Because CiviCRM is open source there is no supplier who you could ask to do this. Basicly it comes down that someone develops the software to work with the new standard.

In Open Source we have a saying that you have to scratch your own itch. Means that if your organisation is dependent on credit card payments and paypal, your organisation has to make sure it keeps working because its your organisation who would suffer.

If you have a developer in your organisation then he or she could do the job. But If you dont have a developer you have to fund a developer to make it working for you.

In this case, there is a likely change that other organisations are also willing to contribute (eg developer resources or funding). But you have to find them and come together.


Looks like we may have a solution –


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.