RDX SpecificationCode RecipesAPI ReferenceChangelogADX Specification
Changelog
Back to All
Improved

RDX 2.2.5 Updates

October 27th, 2026

What's new in RDX 2.2.5

Changes documented below will only be sent to partners configured with RDXMessageVersion 2.2.5. Issuers using 2.2.4 or earlier will receive the 2.2.4 payload, including ExemptionInfo.MCRiskScore. Fields without a value will be omitted from the payload (never sent as null), and objects without populated fields will be omitted entirely.

Visa Payment Passkeys (VPP)

  • RiskRequest: new PasskeyInfo object (VerificationStatus, VisaPasskeyIndicator).
  • StepupRequest: new StepupPasskeyInfo object (VerificationStatus, VisaPasskeyIndicator, PasskeyOfferOnSuccess).
  • ValidateRequest: new ValidatePasskeyInfo object (PasskeyOfferOnSuccess).
  • RiskResponse, StepupResponse, ValidateResponse: new optional PasskeyOfferOnSuccess object, which lets the partner ask VCAS to offer passkey enrollment after a successful challenge (PasskeyOfferOnSuccessResponse).
  • RiskRequest, StepupRequest: new MerchantInfo.ThreeDSRequestorID, which identifies the 3DS Requestor, e.g. Click to Pay. For Visa Payment Passkeys it also identifies who manages the passkey.
  • RiskRequest, StepupRequest: new MerchantAuthInfo.ThreeDSReqAuthMethod (80 = Reserved for Visa Payment Passkeys (Visa transactions only)).
  • MerchantAuthInfo: corrected to a single field, ThreeDSReqAuthMethod. DecoupledRequestIndicator and DecoupledMaxTime, listed in the 2.2.4 specification, have been delted.

Extension Data

  • RiskRequest: new ExtensionData.MasterCardRiskExtension, carrying the Mastercard RBA values of the AReq message extension A000000004-acsRBA.
  • RiskRequest: new ExtensionData.EMVPaymentTokenExtension, carrying the EMVCo payment token message extension A000000802-003.
  • RiskRequest, StepupRequest: new ExtensionData.VisaAuthenticationSignals, carrying the Visa authentication signals of the AReq message extension A000000003-008-001.
  • VisaPaymentTokenExtension: structure unchanged; the allowed values of TokenAssuranceMethod are now documented.

Retired

  • RiskRequest.ExemptionInfo.MCRiskScore is not sent from 2.2.5. This value is now delivered on ExtensionData.MasterCardRiskExtension.Score. If MCRiskScore is the only populated field, ExemptionInfo will be omitted.

Clarified

  • RiskRequest: the MerchantChallengeIndicator description now lists the EMV 3DS threeDSRequestorChallengeInd code behind every value, including:
    • 05: NoChallengeRiskPerformed
    • 06: NoChallengeDataOnly
    • 07: NoChallengeSCAPerformed.