A strong customer authentication exemption is one of a set of conditions under which a payment service provider in the European Economic Area or the United Kingdom may complete an electronic payment without applying strong customer authentication (SCA). SCA, required by PSD2, normally means the payer must prove their identity with two independent factors, such as a phone and a fingerprint. The exemptions exist so that low-risk or low-value payments can go through without friction while fraud remains under control.
The exemptions are set out in the regulatory technical standards on strong customer authentication, adopted by the European Commission and later carried into UK rules by the Financial Conduct Authority. They are distinct from transactions that are outside the scope of SCA altogether, such as merchant-initiated transactions and mail or telephone orders. The payer's provider, usually the card issuer or bank, always decides whether to apply an exemption, even when a merchant or acquirer requests one.
The main exemptions
The standards list several exemptions, each with its own conditions:
| Exemption | Main condition |
|---|---|
| Contactless at point of sale | Small payments up to a per-transaction limit, with SCA required after a cumulative amount or number of payments |
| Unattended transport and parking terminals | Fares and parking fees paid at unattended machines |
| Trusted beneficiaries | The payer has added the payee to a list of trusted beneficiaries held by their provider |
| Recurring transactions | A series of payments of the same amount to the same payee, after SCA on the first |
| Transfers to own accounts | Credit transfers between accounts held by the same person at the same provider |
| Low-value remote payments | Online payments up to a small limit, with cumulative amount and count limits |
| Secure corporate payments | Payments made through dedicated corporate processes that the regulator considers equally secure |
| Transaction risk analysis | Remote payments assessed as low risk by real-time analysis, where the provider's fraud rate is below set reference levels |
In the EU, the contactless limit is €50 per payment, with SCA due after €150 cumulative or five consecutive contactless payments, and the low-value remote limit is €30, with SCA after €100 cumulative or five consecutive payments. The UK raised its contactless limits after leaving the EU, to £100 per payment and £300 cumulative.
Transaction risk analysis
The transaction risk analysis (TRA) exemption is the most important for e-commerce. It allows the payer's or payee's provider to skip SCA on remote payments that its risk-based authentication systems rate as low risk, as long as the provider's overall fraud rate for that payment type stays below reference levels. For remote card payments, the exemption can be used for transactions up to €100 if the provider's fraud rate is no more than 0.13%, up to €250 at 0.06% and up to €500 at 0.01%; it is not available above €500. Credit transfers have lower reference rates. Providers must monitor and report their fraud rates and stop using the exemption if they exceed the threshold.
How exemptions work in card payments
For online card payments, exemptions are requested through 3-D Secure 2 or directly in the authorisation message. An acquirer that applies TRA on its own fraud rate takes on liability for fraud on those transactions, while an exemption applied by the issuer usually leaves liability with the issuer. If the issuer refuses an exemption, it returns a soft decline or starts a challenge flow, and the cardholder must authenticate. Exemptions are closely tied to frictionless authentication in 3-D Secure: in the EEA and UK a frictionless approval normally relies on an exemption, because background risk checks alone do not amount to two-factor SCA. Merchants and payment providers therefore build logic to choose the right exemption for each transaction, balancing approval rates against liability.
Exemptions in account payments and open banking
Exemptions also apply to bank transfers and account access. Trusted beneficiary and own-account exemptions reduce friction for regular transfers, and variable recurring payments and sweeping arrangements have been designed around SCA rules. For account information services, a separate provision allows SCA to be repeated only periodically when a third party accesses account data, which was extended from 90 to 180 days in a later amendment.
Criticism and review
Merchants have criticised the complexity of the exemption framework, uneven application by issuers and the effect of declined exemptions on sales, while issuers argue that exemptions shift fraud risk onto them. Regulators have reviewed SCA as part of the revision of EU payment law, with proposals to clarify scope, improve accessibility for people who cannot use smartphones and address fraud types, such as social engineering, that SCA alone does not prevent.