.svg)
.svg)
.svg)
.svg)
.svg)
The unified orchestration layer for wallets and alternative payments
.svg)
The secure repository for all your payment methods
.svg)
Workflow-driven payments intelligence for smarter routing and higher auth rates
.svg)
A flexible fraud and authentication layer. Instantly add advanced fraud tools and 3DS
One integration to sell inside ChatGPT, Gemini, and every agentic platform
The visual workflow builder that ties fraud, identity, and payment routing together in one place
The unified orchestration layer for wallets and alternative payments
The secure repository for all your payment methods
Workflow-driven payments intelligence for smarter routing and higher auth rates
A flexible fraud and authentication layer. Instantly add advanced fraud tools and 3DS
One integration to sell inside ChatGPT, Gemini, and every agentic platform
The visual workflow builder that ties fraud, identity, and payment routing together in one place
Exemption Management (SCA context)
Exemption management, in the context of Strong Customer Authentication (SCA) under PSD2, is the practice of identifying transactions that qualify for SCA exemptions and applying those exemptions in the 3DS2 authentication request, signaling to the issuing bank that the transaction meets the criteria for reduced authentication requirements, thereby preserving a frictionless checkout experience without triggering a step-up challenge.
PSD2 mandates SCA for most customer-initiated electronic payments within the EEA and UK but provides a defined set of exemptions for transaction types where the regulatory risk is lower. The most commonly used exemptions include:
**Low-value exemption:** Transactions below €30 are exempt from SCA, subject to cumulative limits (no more than five consecutive unauthenticated transactions or €100 cumulative value). When these limits are reached, SCA is required.
**Transaction Risk Analysis (TRA) exemption:** Payment service providers with sufficiently low fraud rates can apply TRA to request exemptions for transactions up to €500. The exemption availability is conditioned on the PSP maintaining fraud rates below PSD2-defined thresholds, if fraud rates rise above the threshold, the exemption tier is suspended.
**Recurring payment exemption:** After an initial authenticated transaction sets up a recurring mandate (CIT/MIT framework), subsequent merchant-initiated charges are exempt from SCA.
**Trusted merchant (beneficiary) listing:** Cardholders can designate specific merchants as trusted, enabling future transactions with those merchants to proceed without SCA challenges.
**Corporate payment exemption:** Business-to-business payments using corporate cards and lodged card programs may qualify for exemption under specific conditions.
Frequently Asked Questions
Who is responsible for applying SCA exemptions, the merchant or the payment provider?
SCA exemptions are requested at the Payment Service Provider (PSP) or acquirer level, specifically, they are included in the 3DS2 authentication request sent to the issuing bank. The merchant configures their exemption strategy in their payment system or through their payment provider, but the technical application of exemptions is the PSP's responsibility. The issuer can honor or override the exemption request based on their own risk assessment, even if an exemption is requested, the issuer may choose to require SCA.
What is the risk of using TRA exemptions, and how does it affect liability?
TRA exemptions shift responsibility for transaction risk from the issuer to the PSP requesting the exemption. If a TRA-exempted transaction later results in fraud, the PSP (not the issuer) bears the fraud liability, there is no Liability Shift protection for exempted transactions, because the exemption is specifically a claim that SCA is not needed. If the PSP's fraud rate rises above the PSD2 thresholds for TRA, the exemption tier is suspended, meaning TRA exemptions can no longer be applied until the fraud rate falls back below the threshold.
How should merchants decide which exemptions to apply?
The exemption strategy should maximize frictionless checkout (good for conversion) while managing fraud exposure and liability risk. The low-value exemption is the simplest starting point, applying it to transactions under €30 adds no fraud risk (the amounts are small) and reduces friction for the majority of low-value purchases. TRA exemptions require more careful analysis: they are most valuable for well-established merchants with strong fraud management who can confidently maintain the required fraud rate thresholds.
Related Terms
