What is Visa's Digital Commerce Authentication Program (DCAP) for the United Arab Emirates?

Visa’s Digital Commerce Authentication Program (DCAP) is an optional program from Visa intended to reduce fraud and improve transaction performance.

To participate, you’ll need to use Visa authentication solutions to share customer data with issuers.

What are the benefits?

Visa is introducing the DCAP as part of a wider series of fee changes to its authentication and network token fees in the UAE. 

Authentication fee changes from October 1

Network Token fee changes from October 1

New unauthenticated PAN fee from October 24

Note that the unauthenticated PAN fee will not apply to Account Funding Transactions or Original Credit Transactions (Card Payouts).

How these changes could affect your costs

• If you adopt DCAP, you would benefit from a 0.005 USD reduction per authentication request if you process ≤ 1 million requests per month, and a 0.0015 USD reduction per authentication request if you process > 1 million requests per month
   
• If you are not currently processing network tokens and begin doing so, you would avoid the 0.05% increase in transaction fees, and begin to be assessed a fee of between 0.01 USD and 0.0035 USD, depending on your transaction volumes 

Checkout.com recommends adopting both the DCAP and network tokens for the lowest transaction costs.

What data fields does Visa require for DCAP?

To qualify for the data sharing element of the DCAP, you will need to provide the data elements outlined below.

The API fields you’ll need to send will depend on your 3D Secure integration. You should ensure the data you provide is complete and avoid using dummy fields or invalid data.

For the Integrated 3D Secure integration

• risk.device.network.ipv4 (device IP address)
• customer.email (customer email address)
• 3ds.exemption set as "data_share"

You’ll also need to send the customer’s device ID using one of the following options:

• risk.device_session_id through our Risk.js SDK
• risk.device.provider.id using data you collect via your own risk solution
• Our Flow integration, which collects the device ID automatically as part of the payment process

For our Standalone (Hosted and Non-Hosted) 3D Secure integrations

• channel_data.ip_address (device IP address)
• source.email (customer email address)
• challenge_indicator set as "data_share"

You’ll also need to send the customer’s device ID using one of the following options. 

• device_information.device_session_id through our Risk.js SDK - optional for the Hosted integration
• device_information.device_id using data you collect via your own risk solution - optional for the Hosted integration

Frequently Asked Questions

Can I qualify for DCAP if I authenticate with FPAN and authorize with DPAN?

No. This will cause the CAVV associated with the token to fail qualification at the authorization stage. There must be 1:1 mapping between the PAN used across authentication and authorization for a transaction to qualify for DCAP.

Do I need to be opted in to DCAP?

No. If you provide the data elements above, you’ll benefit from DCAP savings automatically for qualified transactions.

Will Google Pay and Apple Pay transactions qualify for DCAP incentives?

No. Wallet-based transactions do not qualify for DCAP incentives.

Does Visa allow retrying the cryptogram for DCAP transactions across multiple PSPs?

Yes. The cryptogram is tied to the transaction rather than the 3D Secure server so Visa will still give the incentive. However, Visa does not recommend sharing cryptograms across PSPs if the initial attempt fails.

Will my customers have to authenticate through 3D Secure for their transactions to qualify for DCAP?

No. DCAP uses Visa’s data only flow. This a frictionless 3D Secure flow and customers don’t need to go through authentication.

Could the data only flow add latency to my transactions?

Yes. Data only will add an API call to Visa’s risk engine. If you notice an impact on performance, please let us know.

Do DCAP qualified transactions benefit from liability shift?

No. Because the data only flow does not authenticate the transaction, there’s no liability shift benefit.

Will issuers decline transactions sent through the data only flow if data elements are invalid or missing?

No. However, poor data quality can lead to transactions not qualifying for DCAP and can contribute to an issuer decline.