What Is a Good Card Authorization Rate?

By Mark Stiltner, Director of Content and Web Marketing at Rapyd, with insights from Antoine Trota, Director of Product Solutions at Rapyd

ISOs, PayFacs, and cross-border enterprises, use this guide to understand and improve your card authorization rate performance to recover lost revenue.

Your card authorization rate shows how much of your customers’ intent turns into revenue. For ISOs and PayFacs, it also decides whether merchants stay in your portfolio or leave for a provider that approves more of their transactions. For cross-border enterprises, every point you recover is revenue from buyers who already chose you, with no extra spend on acquisition.

So what does good look like in 2026? Mastercard’s benchmark approval rate for the EEA and UK, across all acquirers, was 84% between December 2023 and August 2024. Rapyd delivers authorization rates up to 97%.

This guide explains how to close that gap. It draws on Rapyd partner data and the authorization optimization playbook shared by Antoine Trota (https://www.linkedin.com/in/antoine-trota-67707954/), Director of Product Solutions at Rapyd.

Key Takeaways: Card Authorization Rates in 2026

• The market benchmark is 84%. That’s Mastercard’s approval rate for the EEA and UK across all acquirers from December 2023 to August 2024.[1]
• Rapyd delivers up to 97%. Rapyd’s owned 3DS server and dual role as acquirer and issuer give it greater control and insight into transaction declines.
• You lose payments in two places. Some transactions fail at authentication (3DS). Others are declined at authorization by the issuer. Optimize both.
• Authentication has four main levers. Use 3DS exemptions, populate the challenge indicator, send valid cardholder data and keep going after a failed authentication where the rules allow it.
• Retry with Merchant Advice Codes. Retry logic built on decline reason codes and Mastercard Merchant Advice Codes (MAC) tells you when a retry may succeed and when to stop.
• “Good” depends on your mix. Benchmarks shift by market, vertical and transaction type, so segment before you compare.

What Is a Card Authorization Rate?

A card authorization rate is the percentage of card transactions an issuing bank approves out of all authorization requests submitted. Divide approved transactions by total authorization requests, then multiply by 100.

If you submit 10,000 authorization requests and 9,500 are approved, your authorization rate is 95%. You’ll also see this metric called an approval rate or acceptance rate.

Authorization Rate vs Conversion Rate

Authorization rate only tells part of the story. In card-not-present eCommerce, conversion rate is the metric that matters most, because it captures every point where a payment can fail.

Here’s how Rapyd breaks down the payment journey: (numbers for demonstration purposes only)

1. 100 transactions start checkout and pass through the Rapyd 3DS server.
2. 96 transactions complete authentication. Four are lost to unsuccessful 3DS authentication, such as cardholder abandonment or ACS (access control server) timeouts.
3. 94 transactions are approved by the issuer. Two more are declined for reasons such as insufficient funds, card lifecycle issues or soft declines.

That’s a 94% conversion rate. But the authorization rate on the same traffic is roughly 98% (94 out of 96). If you only track authorization rate, you miss the four transactions lost before the issuer ever saw them.

That’s why auth rates should be one of your main focus points when you choose an acquirer, and why conversion is the number to watch end to end.

What Is a Good Authorization Rate in 2026?

There’s no single universal number. Rates vary by market, card type, vertical and transaction model. But you can anchor your expectations with three reference points.

The Market Benchmark: 84%

Mastercard’s benchmark approval rate for the EEA and UK, across all acquirers, was 84% from December 2023 to August 2024. Treat this as the floor, not a goal.

What Strong Performance Looks Like: Rapyd’s Benchmark: Up to 97%

Rapyd delivers authorization rates up to 97%. Rapyd also provides local card acquiring with global reach, an owned 3DS server, AI-powered authorization rate optimization and guidance from the Rapyd Implementation team.

Why Context Matters

Comparing your rate against a single headline number can mislead you. Two merchants with identical overall rates can perform very differently once you segment by geography, card brand, vertical and transaction type. Recurring billing, one-time purchases, cross-border traffic and deposits into iGaming or trading accounts all behave differently. Benchmark each segment separately.

Why Do Cross-Border Card Payments Decline More Often?

Cross-border declines happen because issuers treat transactions from foreign acquirers with more caution. When a cardholder in the United Kingdom pays a merchant whose acquirer sits in another country, the issuer applies stricter fraud thresholds. Cross-border card transactions, where the acquirer and issuer are in different countries, run 5 to 15 points below domestic rates on the same card mix.[1]

Currency mismatches add another layer. If the transaction currency doesn’t match the cardholder’s billing currency, the issuer may flag it for extra scrutiny or decline it.

Regulation also plays a role. In the EEA and UK, Strong Customer Authentication (SCA) rules determine when a cardholder must complete a 3DS challenge. Exemptions that avoid unnecessary challenges are requested through the authentication and authorization flow, so your acquirer’s setup directly shapes how many challenges your customers see.

Missing or poor-quality transaction data makes all of this worse. Issuers have fewer signals to tell legitimate purchases from fraud.

Where You Lose Transactions: Authentication and Authorization

Every card-not-present payment has to clear two gates:

• Authentication. The 3DS server and the issuer’s ACS decide whether the cardholder is authenticated without a challenge or needs to complete one.
• Authorization. The issuer approves or declines the transaction.

Rapyd optimizes both. On the authentication side, Rapyd helps you maximize the number of transactions authenticated without a challenge through exemptions, cardholder data and smart step-ups to challenge. On the authorization side, Rapyd helps you flag each authorization with the correct parameters and build a custom retry strategy for declines.

Here are the seven levers that matter most: four through authentication, and three via authorization. 

Authentication: Four Ways to Reduce Challenges and Lost Authentications

1. Use Every 3DS Exemption You Qualify For

Exemptions let qualifying transactions skip the challenge step. Four to know:

• Low value: for amounts at or below €30.
• Transaction risk analysis (TRA): for amounts at or below €250.
• Authentication outage: when one of the systems in the 3DS chain is unavailable.
• Credentials on file: for recurring payments, installments and saved credentials.

Exemption thresholds and conditions are set out in the EU’s regulatory technical standards for SCA, Commission Delegated Regulation (EU) 2018/389. TRA thresholds depend on the payment provider’s fraud rates.

Rapyd applies adaptive 3DS and logic that lifts Strong Customer Authentication requirements when exemptions apply.

2. Populate the 3DS Requestor Challenge Indicator

The 3DS Requestor Challenge Indicator lets you share your challenge preference with the issuer’s ACS. Sending no preference gives the ACS less to go on.

Mastercard card acquiring data for the Europe-acquired region shows how much the indicator influences outcomes:

Challenge indicator value	Challenge rate (September to November 2024)
01: No preference	51% to 52%
02: No challenge requested	36% to 37%
03: Challenge requested (3DS requestor preference)	81% to 82%
04: Challenge requested (mandate)	91% to 92%
05: No challenge requested (TRA performed)	7% to 8%

Sending “no preference” leaves roughly half your transactions facing a challenge. Requesting no challenge cuts that to 36% to 37%. Where you’ve performed transaction risk analysis, the challenge rate falls to 7% to 8%.

3. Send Complete, Valid Cardholder Data

Never send placeholder values. Wrong data can confuse ACS risk models.

Personally identifiable information (PII) is essential for merchants using EMV 3DS. Without it, the issuer’s transaction risk monitoring can’t assess risk effectively. That means lower success rates and higher challenge rates. ACSs rely on quality data for challenge decisions, and wrong data can confuse their risk models.

Mastercard data for Europe shows how often key fields arrive valid:

Data field	Valid	Missing	Dummy data
Name	74%	21%	5%
Email	68%	31%	1%
Billing address	50%	46%	4%
Shipping address	15%	79%	6%
Telephone	16%	81%	3%

For every field, transactions with valid data saw lower challenge rates than transactions where the field was missing, typically by one to three percentage points. Shipping address and telephone are the biggest gaps, and they’re often easy to fix at checkout. 

4. Don’t Treat a Failed Authentication as a Final Answer

An incomplete 3DS authentication doesn’t always mean you should abandon the transaction. Technical hiccups or non-responses often allow you to proceed to authorization using your own fraud assessment.

Additionally, be prepared to step up to 3DS when required. If you attempt a frictionless authorization (such as relying on an exemption) and the issuer wants to verify the cardholder, they will return a soft decline. This is your signal to retry the transaction and initiate a 3DS challenge.”

How to handle common 3DS scenarios:

• Issuer can’t confirm enrollment: Determine the risk level using your internal fraud engine and proceed with authorization if risk is within acceptable range.
• Card not enrolled in 3DS: Determine the risk level using your internal fraud engine and proceed with authorization if risk is within acceptable range.
• Authentication successful: Proceed with authorization.
• Authentication attempted, issuer not responding: Proceed with authorization (a liability shift is generally granted in this scenario).
• User abandonment (e.g., the cardholder closes the challenge pop-up): Decline the transaction or prompt the customer to try a different payment method. Do not proceed to authorization, as this is a strong indicator of fraud and carries no liability shift.
• Technical failure (e.g., merchant server timeout before the challenge renders): Resubmit the authentication request. If it fails again, determine the risk level internally and proceed with authorization only if risk is within acceptable range.
• Failure for risk or incorrect credentials: Decline the authorization.

Because Rapyd owns its 3DS server, it has built mechanisms to save authentications that would otherwise be lost, usually because of issues on the ACS side, such as ACSs that don’t comply with 3DS standards.

Authorization: Three Ways to Win More Issuer Approvals

5. Flag Every Authorization Correctly and Leverage Tokenization

Rapyd helps you flag each authorization with the correct parameters to support a high approval rate, while leveraging tokenization to lift conversions on stored credentials.

Stored credentials need special care. Merchants using network tokens typically see 2 to 5 points of authorization improvement on stored-credential transactions.[1] Rapyd tokenization converts card details into reusable tokens, and token lifecycle management automatically updates token details for lost, stolen or expired cards. Network Reference IDs link transactions with unique IDs recognized by the networks involved.

6. Build Retry Logic Around Decline Codes and Merchant Advice Codes

Rapyd partners are encouraged to build retry logic based on the decline reason code and the Mastercard Merchant Advice Code (MAC), with guidance from Rapyd. MACs tell you when to retry, how to retry and whether to retry at all, as this guide to Mastercard Merchant Advice Codes explains. Soft declines, which account for roughly 60% to 70% of card declines, are often recoverable with the right retry strategy.[1]

Decline reason (DE 39)	Merchant advice (DE 48, sub-element 84)	What to do
51: Insufficient funds (recurring transactions only)	24: retry after 1 hour; 25: after 24 hours; 26: after 2 days; 27: after 4 days; 28: after 6 days; 29: after 8 days; 30: after 10 days	Retry after the interval given in the advice. This may improve the likelihood of approval.
79: Lifecycle or 82: Policy	01: information needs updating before you retry	Updated card details may be available in the Mastercard Automatic Billing Updater (ABU) database. Get the new information before you retry.
79: Lifecycle or 82: Policy	03: do not retry	Don’t retry.
83: Security	01: information needs updating before you retry	Check the card details are correct. Authentication may improve the chance of approval, so retry using EMV 3DS.
83: Security	03: do not retry	Suspected fraud. Don’t retry.

Respecting “do not retry” codes matters as much as retrying the right ones. Retrying hard declines wastes processing and won’t win approvals. For a developer’s view of MAC-aware retry logic, read the Rapyd Developer Community guide to intelligent retries.

7. Let AI Screen Authorizations Before They Reach the Schemes

Rapyd AI models monitor and scrub authorization requests and responses across Rapyd’s systems. By analyzing historical data, the models identify the most frequent causes of transaction declines, flag potential issues and optimization opportunities, and report patterns immediately.

The models also block transactions with a high likelihood of being declined before they’re sent to the card schemes. That raises the quality of the transactions the schemes receive. Because the approach is proactive, the Rapyd team can quickly advise partners on remedial steps.

What This Means for ISOs and PayFacs

For ISOs and PayFacs, authorization rates are a portfolio metric as well as a merchant metric. Merchants churn when approval rates lag, and approval-rate issues threaten your merchants’ revenue and your own.

The same playbook applies, but at scale. Rapyd helps partners:

• Lift approvals across the portfolio: with up to 97% authorization rates and AI-powered authorization rate optimization.
• Reduce acquirer dependency: with direct acquiring licenses, you rely less on fragmented regional providers.
• See performance in one place: with unified reporting and reconciliation across all acquirers.
• Manage fraud rules across merchants with confidence: the Rapyd Protect rule simulator lets you test rules before they go live, so you don’t block good transactions.
• Serve complex industries: with leading approval rates for online gambling, Forex and CFDs, and creator economy verticals.
• Gain PayFac-like control as an ISO: Rapyd gives ISOs more control over funds flow, merchant onboarding and the end-customer experience, using Rapyd’s licenses and infrastructure.

Explore the Rapyd Partner Programme for ISOs and ISVs and PayFacs.

What This Means for Cross-Border Enterprises

Authorization rates vary by market. Where you process matters.

Rapyd’s multi-license approach lets you process locally in its direct acquiring markets. Local acquiring, which processes transactions through an acquirer licensed in the cardholder’s country, lifts approval rates by 3 to 8 points compared with cross-border routing on the same card traffic.[1] Smart routing processes your transactions through the most optimal path. And localized checkout adapts to each customer’s location, language, currency and preferred payment methods, with hundreds of local payment methods and payments in 150+ currencies.

Authorization Rates in LATAM

LATAM is one of the clearest examples of why a single benchmark misleads. Card acceptance, regulation and payment preferences vary country by country, so what counts as a good rate in one market isn’t the same in the next.

Rapyd helps you improve LATAM performance in three ways:

• Local processing through MoR: Rapyd’s Merchant of Record services process transactions locally in LATAM to maximize approvals, without the need for a local corporate entity.
• Local payment methods: Trusted local options add another layer of conversion optimization. These include real-time payment networks like Brazil’s Pix, Mexico’s SPEI, and Colombia’s PSE, alongside cash-based vouchers, digital wallets like Mercado Pago, and installments.

False declines carry a real cost in the region. In a ClearSale survey of online shoppers in the US, Canada, Mexico, Colombia and Argentina, 41% said they’d never shop with a brand again after a false decline, according to the ClearSale State of Consumer Attitudes report.

Authorization Rates in iGaming

In iGaming, deposit declines mean lost players. And high dispute rates can threaten your ability to process at all. That makes authorization optimization a growth priority.

To improve auth rates, 

• Send complete, valid player data so issuers and ACSs can assess risk accurately.
• Flag transactions correctly so issuers know exactly what they’re approving.
• Respect “do not retry” codes and build retries around MAC guidance, rather than hammering issuers with repeat attempts.
• Use built-in fraud protection to score transactions in real time and reduce the false positives that block legitimate players.

Rapyd delivers leading approval rates for online gambling and sports betting, and supports iGaming and online gambling businesses with direct card acquiring and built-in fraud protection. Learn more about Rapyd for iGaming and online gaming).

How to Measure and Monitor Your Authorization Rate

A single aggregate rate hides more than it reveals. Use our Rapyd Authorization Rate Optimization Table table below as your model, and track these metrics separately:

BIN country	Transactions passing risk checks	Authentication rate (%)	Exemption granted (%)	Authorization rate (%)	Conversion rate (%)

• Authentication rate: the share of transactions that pass 3DS.
• Exemption granted rate: the share of exemption requests issuers accept.
• Authorization rate: the share of authorized transactions the issuer approves.
• Conversion rate: the share of all transactions that end as approved payments.

Segment transactions by BIN country, card brand, transaction type (one-time, recurring or stored credential), payment method and sales channel. Then review trends over four to eight weeks rather than single-day snapshots. A sudden drop in one corridor usually traces back to a specific change, such as a new fraud rule, a configuration update or a shift in customer mix.

Set alert thresholds for each segment so your payments team can investigate before a dip becomes a sustained revenue loss. Rapyd’s Client Portal helps you track payment activity, authorization trends, settlement activity and operational performance.

The Cost of Ignoring Low Authorization Rates

Every declined transaction has a direct revenue cost. For a merchant processing ten million pounds in annual card volume, a two-point lift in authorization rate means an extra two hundred thousand pounds in captured revenue.

At market scale, the numbers are larger. PYMNTS Intelligence found that false declines put $157 billion of US eCommerce sales at risk in 2023, with $81 billion projected to be permanently lost, as reported by PYMNTS.

Declines also damage relationships. Your customer is one click away from completing the same purchase with someone else. For ISOs and PayFacs, the merchant is one conversation away from moving their volume. Authorization rates sit at the center of revenue and retention strategy.

Build a Stronger Authorization Rate Strategy

A good card authorization rate in 2026 isn’t one that just beats a benchmark. It’s one that keeps climbing to the top of your segment. 

Start by separating authentication losses from authorization losses. Use every exemption you qualify for, populate the challenge indicator and send valid cardholder data. Then flag authorizations correctly, retry with MAC guidance and let AI screen out transactions likely to be declined.

Why Rapyd Is Built to Deliver Higher Authorization Rates

Rapyd’s position in the payment chain gives it more control over the outcome of each transaction.

• Rapyd owns its 3DS server. That lets Rapyd save authentications that would otherwise be lost to ACS issues.
• Rapyd is both an acquirer and an issuer. This dual role gives Rapyd greater control and insight into transaction declines and how 3DS rules are interpreted between the ACS and the 3DS server. It also lets Rapyd evaluate how specific 3DS and authorization optimizations affect the issuing process.
• Rapyd has close relationships with many issuers. That helps Rapyd quickly identify issues with underperforming BINs.
• Rapyd holds direct acquiring licenses. Rapyd is a Principal Member of Visa and Mastercard with direct licenses in the UK, EEA, Israel, Hong Kong and Colombia, plus Merchant of Record (MoR) services in LATAM.
• Fraud protection is built in. Rapyd Protect is embedded in Rapyd Collect, so there’s no separate integration. It combines AI-powered fraud decisioning, real-time fraud scoring that reduces false positives, a drag-and-drop rule builder that can activate 3D Secure dynamically, and a rule simulator to test rules before you switch them on.
• You see why transactions decline. Rapyd provides descriptive issuer decline reason codes, with visibility into issuer decline and MAC codes by issuer, country and card type.
• You get expert guidance. The Rapyd Implementation team provides the tools and guidance partners need to optimize conversion.

Ready to turn more declines into revenue? Talk to the Rapyd team about building a payment stack that performs globally.