Using Nuvei with external risk engines

About risk engine support

Nuvei's externalRiskScore field enables a merchant who runs their own risk engine, to tell Nuvei directly how a payment should be authenticated, instead of Nuvei running their own risk analysis.

BR-DGE enables this behaviour for merchants by translating its own API flags (threeDSecureRequired, challengeRequested, scaExemption), all sent as part of the payment request, into the score that Nuvei expects.

Risk engine support complements the existing BR-DGE ability to support Nuvei 3DS handling by passing SCA exemption preferences and 3DS flows through to Nuvei.

The externalRiskScore field accepts any value 1–100, but only four outcomes are used in practice. The specific values (100 / 90 / 40) are fixed by agreement between Nuvei and the merchant using them.

Authentication scoring

The API flag threeDSecureRequired decides which path is followed. Within that path, one further flag decides the score that BR-DGE adds to the threeD object sent to Nuvei.

threeDSecureRequired	Merchant flag	Score sent	Meaning
`true`	`challengeRequested`: `true`	100	Challenge mandated - the cardholder must authenticate
`true`	`challengeRequested`: `false` or omitted	90	3DS with no challenge preference - frictionless.
`false` / omitted	`scaExemption`: `TRA` or `LOW_VALUE`	40	Exemption requested.
`false` / omitted	no `scaExemption`	None	No score sent - BR-DGE doesn't guess on the merchant's behalf.

📘
Important:
When threeDSecureRequired is true, the challenge preference decides the score and supersedes any exemption request. Only when threeDSecureRequired is false (or omitted) does the exemption flag get considered.

Choosing the correct payment scenario

Find the outcome you want from the list below and send ONLY the fields listed for that scenario.

Requesting a 3DS challenge
Set:
- threeDSecureRequired: true
- challengeRequested: true
Do not include scaExemption — if you send it, it will be ignored.
Requesting frictionless 3DS
Set:
- threeDSecureRequired: true
- challengeRequested: false
Do not include scaExemption — if you send it, it will be ignored.
Requesting an SCA exemption
Set:
- scaExemption: TRA or scaExemption: LOW_VALUE
Do not include threeDSecureRequired or challengeRequested.

If threeDSecureRequired: true is also sent, it overrides the exemption entirely — you will be put into a challenge or frictionless flow instead (as per scenarios 1 and 2, depending on challengeRequested).

If challengeRequested is sent without threeDSecureRequired: true, it is ignored.
No explicit request
Do not include threeDSecureRequired, challengeRequested, or scaExemption.
Sending any one of these fields puts you into scenario 1, 2, or 3 instead.

Prerequisites

This feature is available to any Nuvei merchant running their own risk engine.

Requesting risk engine support by Nuvei

Use the BR-DGE Support Centre to reach out to our Customer Support Team to request risk engine support from Nuvei.

Access is enabled for each merchant when requested and per retail-channel.

Scores only take effect once Nuvei's Risk Team has configured your account to read 40 / 90 / 100 exactly as BR-DGE maps them. An unconfigured account simply ignores the score, so sending it is safe by default.

To create a new support ticket, you need an account in the Support Portal.