What Is an Access Control Server (ACS) in 3D Secure?
Access Control Server (ACS) meaning: the issuer side of 3D Secure. The three 3DS domains, the transStatus codes it returns, and who runs an issuer ACS.
Article summary
TL;DR
An Access Control Server (ACS) is the card issuer's component in 3D Secure. It receives the authentication request through the card network's Directory Server, decides whether the payment passes frictionless or needs a challenge, and returns the result with an authentication value such as the CAVV. Issuers run it themselves or through an approved provider.
- The ACS sits in the issuer domain of 3D Secure. The merchant side runs the 3DS Server; the card network runs the Directory Server.
- The ACS answers with a transStatus code: Y, A, I, N, U, C or R. Only some of them let the payment go ahead with proof of authentication.
- Under Visa rules, an issuer may answer Unable to authenticate (U) only in set cases, such as a technical problem or merchant data that breaks the 3DS specification.
- An issuer that does not run its own ACS must use Visa's service or a provider listed on the Visa Global Registry of Service Providers.
ChatGPT
Claude
Perplexity
GrokOn this page
Every 3D Secure check ends at one system: the card issuer's Access Control Server. The merchant asks, the card network routes, and the ACS decides. It is the part of 3DS that the merchant never configures but always depends on.
What is an access control server?
The ACS is the issuer-side component of EMV 3-D Secure. It receives the authentication request, scores the risk from the data the merchant sent (including device and browser data), then either authenticates silently (frictionless) or asks the cardholder to prove who they are (challenge). For the full flow, see 3D Secure.
The "3-D" in the name stands for three domains. EMVCo names them as the merchant / acquirer domain, the issuer domain and the interoperability domain, where the payment systems sit.1EMVCo, How Does EMV 3-D Secure Help to Meet European Regulation (September 17, 2020)
| Domain | Component | Run by |
|---|---|---|
| Issuer | Access Control Server (ACS) | The card issuer, or its ACS provider |
| Merchant / acquirer | 3DS Server, for the 3DS Requestor | The merchant, its gateway or 3DS provider |
| Interoperability | Directory Server (DS) | The card network, such as Visa |
Visa's rules list the Visa Directory Server among Visa's own authentication technology, and set separate requirements for issuers' ACSs.2Visa Core Rules and Visa Product and Service Rules, April 18, 2026
Inside Tagada
See every payment's route, processor by processor
Set the order your processors are tried in, per store, per country or per product.
What the ACS returns
The ACS answers with a transStatus code. Adyen's 3D Secure API reference lists seven values:3Adyen Docs, 3D Secure API reference (transStatus)
| transStatus | Meaning | What happens next |
|---|---|---|
| Y | Authentication successful | Authorize with the authentication value |
| A | Attempted, could not be verified | Authorize with the attempt value |
| I | Exemption granted by the issuer | Authorize under the exemption |
| C | Challenge required | Show the issuer's challenge |
| N | Not authenticated, transaction denied | Do not authorize |
| R | Rejected by the issuer | Do not authorize |
| U | Could not be performed | Merchant decides, without 3DS proof |
On Visa, an issuer's authentication confirmations and attempt responses must include a CAVV, and the ECI shows which case applied.2Visa Core Rules and Visa Product and Service Rules, April 18, 2026 Visa also limits when an issuer may answer Unable to authenticate (U): a technical problem that prevents a timely response, merchant data that does not comply with the 3-D Secure Specification, or a non-reloadable prepaid card (Visa Core Rules, April 2026, section 10.15.2.4).2Visa Core Rules and Visa Product and Service Rules, April 18, 2026 A wave of U answers can point to your own data, not only the bank.
Who runs an issuer ACS
Large issuers can run their own ACS. Others outsource it. Visa Core Rules, April 2026, section 10.15.2.2 says an issuer that does not operate its own ACS must use "the Visa Consumer Authentication Service" or "an ACS service provider listed on the Visa Global Registry of Service Providers," and must tell Visa at once if that provider cannot meet its 3-D Secure security duties.2Visa Core Rules and Visa Product and Service Rules, April 18, 2026
The product itself is tested by EMVCo. Its approval process "attests the compliance of the Access Control Server, Directory Server, 3DS Server and 3DS SDK" to the EMV specifications, and ends with a Letter of Approval and a public approved products listing.4EMVCo, EMV 3-D Secure Approval Processes Visa requires participants' Visa Secure components to pass EMVCo's compliance testing and Visa's EMV 3DS Test Suite (section 10.15.1.1).2Visa Core Rules and Visa Product and Service Rules, April 18, 2026 If an issuer does not support Visa Secure at all, Visa answers on its behalf with an attempt response carrying a CAVV (section 10.15.2.3).2Visa Core Rules and Visa Product and Service Rules, April 18, 2026
For a merchant, the ACS decision drives the liability shift and the challenge rate. You cannot tune the issuer's risk model, but you control the data it scores. For the merchant-side guide, see payment authentication.
How Tagada helps
3D Secure inside the checkout
TagadaPay runs native 3DS2, with device intelligence and a rules engine, in the checkout. Tagada follows Visa and Mastercard rules and the laws that apply to payments.
Frequently asked questions
What is a secure access control server?
What is an issuer ACS solution?
What is the difference between an ACS and a Directory Server?
Sources
Checked October 15, 2026TagadaPay
Run 3D Secure and route payments from one checkout
Tell us what you sell and how you sell it. Each application is underwritten, and approval is not guaranteed.
- 01Tell us what you sell and how
- 02Underwriting reviews your business
- 03Process through TagadaPay alongside your other processors