What are the main SCA exemptions for card payments?

Low value (up to EUR 30, capped at EUR 100 or five transactions since the last SCA), transaction risk analysis up to EUR 500 depending on the PSP’s fraud rate, trusted beneficiaries whitelisted at the issuer, recurring transactions of a fixed amount, and secure corporate payments. Merchant-initiated transactions are out of scope rather than exempted.

How the low-value and TRA exemptions work

The low-value exemption covers remote payments up to EUR 30, with a ceiling of EUR 100 or five transactions since the last SCA. The issuer keeps the counters, so the merchant cannot know in advance whether the exemption will hold. Under transaction risk analysis, the acquirer or issuer may exempt a payment if its fraud rate stays under a reference rate for the amount band: 0.13% up to EUR 100, 0.06% up to EUR 250 and 0.01% up to EUR 500. Two consecutive quarters above the reference rate and the exemption is lost for that band.

Whitelists, recurring and corporate payments

With trusted beneficiaries, the cardholder adds a merchant to a whitelist at the issuer after one SCA, and later payments skip it. Recurring transactions of the same amount to the same payee are authenticated once when the series starts. Secure corporate payments use dedicated corporate processes and cards.

What falls outside SCA

Merchant-initiated transactions, such as a variable subscription charge or a hotel’s final bill, are not customer-initiated, so no SCA applies after the initial mandate. A payment where either the issuer or the acquirer sits outside the EEA is out of scope. When the merchant requests an exemption, the fraud liability stays with the merchant.

More detail in our #PayDecoding episode on 3-D Secure.