Strong customer authentication: the exemptions and how risk-based approval works
Under PSD2, electronic payments need strong customer authentication unless an exemption applies. The main exemptions are low-value contactless payments up to EUR 50, low-value online payments up to EUR 30, recurring payments of the same amount to the same payee, trusted beneficiaries, and transaction risk analysis, which allows online card payments up to EUR 500 without authentication for providers with very low fraud rates.
The rule and why exemptions matter
Strong customer authentication (SCA) means confirming a payment with two independent factors: something the customer knows, has or is. It cuts fraud but adds friction, and friction loses sales. The regulatory technical standards in Commission Delegated Regulation (EU) 2018/389 therefore allow exemptions. Using them well is a commercial decision as much as a compliance one.
The main exemptions
| Exemption | Limit | Notes |
|---|---|---|
| Contactless at the point of sale (Art. 11) | Up to EUR 50 per payment | SCA again after EUR 150 cumulative or five consecutive contactless payments |
| Low-value remote payments (Art. 16) | Up to EUR 30 per payment | SCA again after EUR 100 cumulative or five consecutive payments |
| Unattended terminals for transport fares and parking (Art. 12) | No amount limit set | Applies only to these uses |
| Trusted beneficiaries (Art. 13) | No amount limit set | The payer adds the payee to a list held by their bank, with SCA at that point |
| Recurring transactions (Art. 14) | Same amount, same payee | SCA for the first payment and when the series changes |
| Transfers between own accounts (Art. 15) | No amount limit set | Accounts of the same person at the same provider |
| Secure corporate processes (Art. 17) | No amount limit set | Dedicated processes and protocols for businesses, approved by the supervisor |
| Transaction risk analysis (Art. 18) | Up to EUR 100, 250 or 500 | Depends on the provider’s fraud rate, see below |
How transaction risk analysis works
Transaction risk analysis (TRA) lets a payment service provider skip SCA for a remote payment that its real-time risk monitoring considers low risk, provided its overall fraud rate stays below a reference rate. For remote card payments the reference rates in the annex of the standards are 0.13 percent for payments up to EUR 100, 0.06 percent up to EUR 250 and 0.01 percent up to EUR 500. Fraud rates are calculated each quarter over the previous 90 days, and a provider whose rate stays above the reference rate for two consecutive quarters must stop using the exemption at that level.
Both the issuer and the acquirer can apply TRA, each based on its own fraud rate. For merchants, an acquirer with a low fraud rate can therefore reduce friction at checkout, and that is a reason to ask acquirers about their exemption strategy.
Who decides
An exemption is never an obligation. The cardholder’s bank, the issuer, has the final word and can always ask for authentication. Merchants and acquirers can request an exemption, but the issuer may decline it. Payments initiated by the merchant without the customer present, such as later charges agreed in advance, fall outside SCA altogether and are not an exemption.
What banks and acquirers should review
- Fraud rates per channel against the TRA bands, and the share of payments that could qualify at each level.
- Real-time risk scoring good enough to keep fraud below the band while applying the exemption widely.
- Exemption handling in authorization messages, so requests and declines are visible and measurable.
- Conversion data: how many payments fail or are abandoned at the authentication step, by issuer and channel.
Why it matters commercially
Every authentication step is a point where a customer can give up. For merchants, the share of payments completed without a challenge directly affects sales; for issuers, it affects how often customers choose their card; for acquirers, a strong exemption capability is a reason for merchants to stay. Fraud and conversion should therefore be managed together, by the same team, with the same data.
A practical starting point is a monthly report that shows, by channel and issuer, how many payments were exempted, how many were challenged, how many failed and how fraud moved against the TRA bands.
What comes next
The EU is revising the payments framework through PSD3 and a new Payment Services Regulation. Until those apply, the 2018 standards govern, and the exemptions above remain the main tool for balancing security and conversion.
This article is general information, not legal advice. Supervisors and card schemes apply further rules; confirm details with your competent authority and scheme documentation.
Related service: Strategy and digitalization
Sources and dates
- Commission Delegated Regulation (EU) 2018/389, regulatory technical standards for strong customer authentication, EUR-Lex, checked Oct 14, 2026
- EBA Single Rulebook Q&A on the transaction risk analysis exemption (2018_4034), checked Oct 14, 2026
Published Sep 21, 2026. Last reviewed Oct 14, 2026.