An in-house passkey stack is roughly 27.5 FTE-months to build and 1.5 FTE per year to maintain. PCI DSS 4.0, DORA, and the 2023 Interagency Guidance reshape the math — build remains defensible for very large institutions with dedicated IAM teams or hard sovereignty constraints, but for most banks buying a bank-grade managed layer frees engineering capacity for work that actually moves the institution.

Most passkey programs are launched on a security argument and extended on a CFO argument. The four cost categories that move when passkeys arrive, grounded in published 2025-2026 industry data, and the payback math that makes the spend defensible.

Let’s be honest, most two-factor authentication (2FA) methods are kind of a pain. Whether it’s scrambling to find your phone, entering a one-time code, or figuring out how to register a passkey, the process usually asks something of you. That’s fine for tech-savvy users. But what about everyone else?

For businesses operating online, getting a customer to the checkout page is hard enough. But getting them past it? That’s where payment acceptance becomes make-or-break.