ComBank pioneers state-of-the-art 3DS authentication for UnionPay cardholders

Commercial Bank of Ceylon, in its commitment to provide secure and world-class technologies to its customers, has further strengthened the security and convenience of online payments for its UnionPay cardholders by becoming the pioneering financial institution in Sri Lanka and the wider South Asian region to introduce advanced 3-D Secure (3DS 2.x) authentication for UnionPay e-commerce transactions.

This milestone makes the UnionPay card a fully empowered e-commerce instrument, enabling cardholders to shop securely at millions of merchants worldwide.

The latest addition to the Bank’s robust 3DS-enabled card portfolio ensures that UnionPay users benefit from the same high-level authentication and fraud protection extended across Commercial Bank’s international card offerings.

The enhancement follows the successful integration of UnionPay cards into the Bank’s ComBank Access Control Server (ACS) platform, enabling secure authentication for online payments through UnionPay’s latest 3-D secure protocol.

Mr. Kapila Liyanage, AGM Personal Banking and Retail Products at Commercial Bank described this latest development as a reflection of the Bank’s commitment to continuously expand Sri Lanka’s digital payment ecosystem.

“The benefits of technology must encompass the widest possible customer base to ensure seamless and secure service anywhere in the world,” he said.

“By extending 3D secure authentication to UnionPay cards, we are providing another important segment of our customers with access to global-standard payment solutions.”

Mr. Crispin Wijesekera, Country Manager – Sri Lanka & Maldives at UnionPay International, said:

“The introduction of 3D secure authentication for UnionPay cardholders by Commercial Bank of Ceylon marks an important milestone in strengthening the security and trust of digital payments in Sri Lanka.

As e-commerce continues to grow, enhanced authentication technologies such as 3DS provide cardholders with an additional layer of protection while enabling a smooth and convenient online payment experience.”

“UnionPay remains committed to working closely with our banking partners to continuously enhance payment security standards and expand digital acceptance, ensuring that UnionPay cardholders can transact with confidence both locally and globally,” he added.

The new capability introduces UnionPay-specific Risk-Based Authentication (RBA) on the ACS platform.

When a customer makes an online purchase at a participating merchant, the system intelligently evaluates the transaction in real time.

Where additional verification is required, the system initiates a step-up authentication process by generating a One-Time Password (OTP), which is securely delivered to the cardholder’s registered mobile number and email through the Bank’s established SMS and email gateways.

The cardholder then enters the OTP on the secure ACS interface to authorise the transaction.

Where transactions are assessed as low risk, the system allows them to proceed through a seamless ‘frictionless’ authentication flow, enabling fast and convenient payments without additional steps.

Together, these capabilities ensure strong protection while maintaining a smooth customer experience for online purchases, the Bank said.

The Bank implemented the new capability by routing the UnionPay 3DS step-up authentication process through its existing OTP distribution infrastructure, allowing seamless integration without requiring complex backend changes.

While the ACS platform manages OTP generation and validation, Commercial Bank’s systems ensure the secure delivery of authentication messages to customers.

The Bank said the project successfully completed rigorous internal information systems audits and met UnionPay’s strict certification standards, while ensuring that existing authentication flows for other global card networks remain unaffected.

By extending advanced 3-D Secure protection to UnionPay cards, Commercial Bank has further unified its e-commerce security architecture across card platforms, enabling UnionPay cardholders to shop online with enhanced confidence while benefiting from sophisticated fraud protection mechanisms and minimal transaction friction.

Commercial Bank noted that the implementation forms part of its broader digital payments strategy to deliver secure, reliable and internationally compliant payment solutions for its customers, while strengthening Sri Lanka’s digital commerce ecosystem.

The first Sri Lankan bank with a market capitalisation exceeding US$ 1 Bn., and the first bank in the country to be listed among the Top 1000 Banks of the World, Commercial Bank has the highest capital base among all Sri Lankan banks, is the largest private sector lender in Sri Lanka, and the largest lender to the country’s SME sector.

Ranked No. 1 in the Business Today Top 40, the Bank is recognised as the most respected and most-awarded bank in Sri Lanka, is a leader in digital innovation and is the country’s first 100% carbon-neutral bank.

Commercial Bank operates more than 270 strategically-located branches and an extensive network of automated machines island-wide, and has the widest international footprint among Sri Lankan banks, with 21 branches in Bangladesh, a fully-fledged Tier I Bank with a majority stake in the Maldives, a microfinance company in Myanmar, and a representative office in the Dubai International Financial Centre (DIFC).

The Bank’s fully-owned subsidiaries, CBC Finance PLC. and Commercial Insurance Brokers (Pvt) Limited, also deliver a range of financial services via their own branch networks.

Photo caption - Mr. Kapila Liyanage, Assistant General Manager – Personal Banking and Retail Products at Commercial Bank, and Mr. Crispin Wijesekera, Country Manager – Sri Lanka and Maldives at UnionPay International after signing the agreement for the collaboration.