Access Control Server (ACS)
The card issuer's half of 3-D Secure — the server that decides whether a shopper sails through or has to prove who they are.
3-D Secure splits the world into three domains: the acquirer's (where the merchant's 3DS Server lives), the interoperability domain (the card network's Directory Server) and the issuer's. The ACS is the issuer's end. It receives the transaction data, scores the risk and answers either frictionless — approved without the customer noticing — or with a challenge: one-time code, banking app or biometrics.
In the old 3DS 1.0 the ACS was mostly a pop-up asking for a password everyone had forgotten. EMV 3DS 2.x, specified by EMVCo from 2016 onwards, ships over a hundred data fields — device, shipping address, purchase history — so the ACS can wave most purchases through. Few banks run their own; most rent one from a handful of specialist vendors.