The verdict in three sentences
A store accepting cards without 3DS2 or PCI DSS compliance faces uncovered chargebacks, fines and merchant-account suspension. 3DS2 cuts card fraud by about 70% and shifts dispute liability to the issuing bank, in exchange for 2 to 5% friction at payment. In Nigeria, the CBN mandates 3DS and Paystack is PCI DSS Level 1 certified, sparing you from storing card data yourself.
Compliance requirements and their cost
Compliance isn't a checkbox but a trade-off between security, cost and conversion. Here are the main requirements (2026 order of magnitude) for a store accepting cards.
| Requirement | Compliance cost | Conversion impact | Fraud reduction | Chargeback liability |
|---|---|---|---|---|
| 3DS2 (strong authentication) | Included via PSP | -2 to -5% | -70% | Shifted to bank |
| PCI DSS SAQ-A (tokenized PSP) | ~150,000 FCFA/yr | None | High | Shared |
| PCI DSS Level 1 (self-managed) | 8 to 20M FCFA/yr | None | Very high | Merchant |
| TLS 1.3 encryption | Included in hosting | None | Medium | — |
| Anti-fraud rules (velocity, AVS) | 50,000 to 200,000 FCFA/mo | -1% | -40% | Merchant |
| Card tokenization | Included via PSP | None | High | PSP |
3DS: the fraud / conversion trade-off
3DS adds an authentication step (OTP, biometrics) that deters some buyers but eliminates almost all fraud. The right tuning relies on small-amount exemptions and frictionless 3DS.
| Scenario | Fraud suffered | Chargebacks/mo | Monthly fraud cost | Card conversion |
|---|---|---|---|---|
| No 3DS | 1.8% of card revenue | 22 | 540,000 FCFA | 68% |
| 3DS on everything | 0.5% of card revenue | 6 | 150,000 FCFA | 63% |
| Frictionless 3DS + exemptions | 0.6% of card revenue | 7 | 175,000 FCFA | 67% |
| 3DS + anti-fraud rules | 0.3% of card revenue | 4 | 90,000 FCFA | 66% |
The winning scenario combines frictionless 3DS (authentication runs in the background when risk is low) and targeted anti-fraud rules: you keep 66 to 67% conversion while dividing fraud by six.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Chidi, who runs an online apparel store in Lagos, does 4M FCFA/month by card. Without 3DS, he suffers 1.8% fraud, i.e. 72,000 FCFA/month, plus 22 chargebacks at 5,000 FCFA bank fees each (110,000 FCFA). By enabling frictionless 3DS via his PSP (cost included) and anti-fraud rules at 80,000 FCFA/month, his fraud drops to 0.3%, i.e. 12,000 FCFA: he saves 170,000 FCFA/month net and protects his merchant account from closure.
FAQ
Do I have to be PCI DSS Level 1 certified? No, if you use a tokenized PSP (Paystack, Stripe) that never passes you card numbers. You then fall under the much lighter SAQ-A, around 150,000 FCFA/year.
Does 3DS really scare customers away? It adds 2 to 5% friction, but frictionless mode authenticates low-risk transactions in the background, limiting real loss to 1 to 2%.
Who pays for a chargeback with 3DS? With 3DS2, liability for fraud disputes shifts to the card's issuing bank, not the merchant. That's the major benefit beyond fraud reduction.
Is mobile money subject to PCI DSS? No, Wave and Orange Money don't handle card data: PCI DSS only applies to card payments. That's one more reason to prioritize mobile money.
How long to become compliant? Plan 1 to 2 weeks via a tokenized PSP: enabling 3DS, configuring anti-fraud rules and testing chargeback scenarios before going live.
Let's talk about your project. We secure your card checkout with 3DS2 and a PCI DSS-certified PSP, without sacrificing your conversion. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
