How to manage strong customer authentication (SCA) exemptions in 2026

This guide explains what SCA exemptions are, the main types available, how the most valuable ones work in practice, and how merchants and payment service providers can manage them to protect both conversion and security.

Introduction to Strong Customer Authentication (SCA) and exemptions

Regulatory background and scope of SCA

Strong Customer Authentication is a requirement introduced under the second Payment Services Directive (PSD2) in the European Economic Area, and retained in UK law through the Payment Services Regulations 2017, enforced by the Financial Conduct Authority. It applies to most electronically initiated payments where both the cardholder’s bank (the issuer) and the merchant’s acquirer are located within the EEA or UK.

At its core, SCA requires that a customer’s identity is verified using at least two of three independent factors: something they know (a password or PIN), something they have (a phone or device) and something they are (a fingerprint or facial scan). In ecommerce, this is most often delivered through 3-D Secure 2 (3DS2), which passes data between the merchant, the acquirer and the issuer to authenticate the shopper.

Learn more about strong customer authentication regulation and background

What is SCA exemption and why does it exists?

An SCA exemption allows a payment to be processed without applying full authentication, while still complying with the regulation. The principle is risk-based. Regulators recognise that forcing a challenge on every single payment would create needless friction on transactions that are demonstrably low risk, so they defined a set of conditions under which authentication can be skipped.

Crucially, an exemption is a request, not a guarantee. The merchant or payment service provider flags that a transaction qualifies, but the issuer ultimately decides whether to honour the exemption or insist on a challenge. Managing exemptions well, therefore, means understanding both the rules and how issuers behave.

Core types of SCA exemptions

Several categories of exemption exist under PSD2 and the equivalent UK rules. The most relevant for ecommerce merchants are summarised below before we look at the highest-value ones in detail.

The low value transaction exemption applies to individual remote payments under €30 (or £30 in the UK), subject to cumulative limits.

The transaction risk analysis (TRA) exemption allows low-risk transactions to bypass authentication when a provider’s fraud rates stay below defined thresholds.

The trusted beneficiaries exemption lets customers whitelist merchants they trust so future purchases are not challenged.

Recurring payments for a fixed amount require authentication only on the first transaction.

Corporate and dedicated payment processes, such as lodged cards and virtual card platforms, can be exempt where secure dedicated protocols are used.

Finally, mail order and telephone order (MOTO) transactions and genuine merchant-initiated transactions fall outside the scope of SCA entirely, as they are not electronically initiated by the cardholder.

Low value transaction exemption in detail

Thresholds, cumulative limits and reset conditions

The low value exemption covers individual remote electronic payments below €30 in the
EEA, or £25 under the UK rules. It is the simplest exemption to apply, but it carries built-in counters designed to stop it being abused. Authentication must be triggered once the
cumulative value of consecutive exempted payments exceeds €100 (£85 in the UK), or
once the customer has made five consecutive low value payments without
authenticating, whichever comes first. When a customer completes an authenticated
payment, those counters reset.

In practice, the issuer tracks these counters, not the merchant, which means a
transaction you flag as low value may still be challenged because the customer has hit
their limit elsewhere.

Use case, risks and best practice of low value transaction exemption

This exemption suits high-volume, low-ticket merchants such as digital content, food delivery and everyday consumables, where average order values sit comfortably below the threshold and friction directly damages conversion.

The main risk is that fraudsters deliberately test stolen cards with small payments to stay under the radar. Best practice is to combine the exemption with your own real-time risk checks rather than applying it blindly to every eligible transaction.

Transaction risk analysis (TRA) exemption

The TRA exemption is the most powerful tool available to most merchants, because it scales with transaction value and rewards strong fraud performance.

Definition, thresholds and fraud rate requirements

TRA allows a payment service provider to request an exemption for remote transactions where its overall fraud rate sits below a regulated threshold. The higher the value you want to exempt, the lower your fraud rate must be:

• Transactions up to €100 (£85 in the UK) require a fraud rate below 0.13%
• Transactions up to €250 require a fraud rate below 0.06%
• Transactions up to €500 require a fraud rate below 0.01%

The exemption can only be applied if real-time risk analysis finds no abnormal spending patterns, no signs of malware and no unusual device or location behaviour for that specific payment.

Data inputs and ongoing monitoring

Effective transaction risk analysis depends on the quality of the data feeding it. Useful signals include device fingerprinting, IP and geolocation, behavioural patterns, transaction history and known fraud indicators. Because eligibility is tied to your fraud rate, TRA is not a set-and-forget exemption. Providers must report their fraud rates to their national regulator every 90 days, and a rise in fraud can push you into a lower threshold band or out of eligibility altogether.

Issuer and acquirer responsibilities

Both acquirers and issuers can apply TRA. In ecommerce, acquirers (and merchants working through them) most often request the exemption on the outbound transaction, while issuers run their own risk analysis on the inbound side and decide whether to accept it. Monitoring and adjusting your TRA models over time, and maintaining open feedback loops between fraud and payments teams, is what keeps the exemption working in your favour.

Trusted beneficiaries and whitelisting

The trusted beneficiaries exemption lets a customer add a merchant to a list of trusted payees held by their issuer. Once whitelisted, future purchases from that merchant can proceed without a challenge.

Customers create and manage these lists through their bank, typically during an authenticated transaction or in their banking app, and the issuer is responsible for verifying and storing the list. For merchants with loyal, repeat customers, encouraging whitelisting is a quiet but effective way to remove friction from the most valuable relationships. The security consideration is that whitelisting shifts trust to the issuer’s controls, so it works best alongside, not instead of, your own monitoring.

Recurring payments, merchant-initiated transactions and special environments

Subscriptions and instalments for a fixed amount need SCA only on the first payment; subsequent fixed-amount charges are exempt. Where the amount or date varies, the payment is usually treated as a merchant-initiated transaction, which sits outside the scope of SCA provided there is a valid agreement (mandate) set up with an initial authenticated transaction.

Corporate payments made through secure dedicated processes, such as lodged cards, central travel accounts and virtual card numbers, can also be exempt where the protocols and processes meet the required security standards. These environments are common in business travel and procurement, where the cardholder is not present at checkout in the usual sense.

Payments that fall outside the scope of SCA

It is important to distinguish exemptions from out of scope payments. An exemption applies to a transaction that is in principle subject to SCA but is allowed to skip authentication under defined conditions. An out of scope payment is one the SCA requirements never apply to in the first place, so no exemption flag is needed. Knowing the difference helps merchants route each payment correctly and avoid challenging transactions that do not require it.Several categories sit outside the scope of SCA:

• Mail order and telephone order (MOTO) transactions. Payments where card details are taken by post, over the phone or by another non-electronic channel are not electronically initiated by the cardholder, so SCA does not apply.
• Merchant-initiated transactions (MITs). Where a merchant charges a stored card under a prior agreement with the customer, such as variable subscription renewals, usage-based billing or post-stay hotel charges, the payment is initiated by the merchant rather than the cardholder and is out of scope. The mandate must be set up with an initial customer-initiated transaction that is itself authenticated.
• One-leg-out (inter-regional) transactions. SCA only applies when both the issuer and the acquirer are located in the European Economic Area or the UK. If either party sits outside this area, the transaction is one-leg-out and falls outside the SCA requirements, although merchants should still apply robust fraud screening as these payments can carry higher risk.
• Anonymous prepaid cards. Certain anonymous prepaid instruments are excluded from SCA because there is no identifiable payer to authenticate.

Treating these payments as out of scope keeps the checkout friction-free where authentication is not legally required, but it places more weight on a merchant’s own fraud controls, since the issuer is not applying a challenge to catch bad transactions.

Technical implementation of SCA exemptions

Signalling exemptions through 3-D secure 2

Exemptions are requested in the messaging that flows during a transaction, most commonly through 3DS2. The merchant or its payment service provider sets an exemption flag in the authentication request, signalling to the acquirer and issuer that the payment qualifies and that a challenge may not be necessary.

Learn more about 3-D Secure

Issuer decisioning, soft declines and fallback to strong customer authentication

The issuer then makes the final call. It may accept the exemption and approve the payment, or it may respond with a “soft decline” indicating that authentication is required after all. When that happens, your systems must be able to fall back gracefully to a full SCA challenge and retry the transaction, rather than treating the soft decline as a hard failure. A poorly handled fallback turns a recoverable payment into a lost sale, so the resilience of this step matters as much as the exemption logic itself.

Balancing customer experience and security

The entire point of managing exemptions is to reduce friction while maintaining compliance. The best-performing merchants design their checkout so that the system decides, in real time, whether to request an exemption, send a transaction straight to a challenge, or route it through TRA, based on the risk of each individual payment.

That means treating exemptions as one layer in a broader strategy rather than a blunt instrument. A high-value order from a brand-new account on an unfamiliar device probably warrants a challenge; a £20 repeat purchase from a long-standing customer almost certainly does not. Designing customer journeys around this logic protects conversion on good transactions and concentrates friction where it genuinely reduces risk.

Visit our SCA checklist for a better customer experience sets out the practical steps in more detail.

Risk management and fraud considerations

Because TRA and the low value exemption both depend on staying under fraud thresholds, fraud monitoring is not optional once you rely on exemptions. You need continuous visibility of fraud rates by exemption type, value band and segment, and you need to act quickly when they move.

The most resilient programmes build tight feedback loops between fraud teams and product or payments teams, so that a spike in chargebacks feeds straight back into exemption strategy. After a fraud incident, that might mean tightening the rules on which transactions are flagged for exemption, lowering value bands temporarily, or routing more traffic to authentication until the underlying issue is resolved.

Compliance, reporting and governance

Managing exemptions responsibly also means being able to prove what you did and why. Payment service providers must document their exemption policies and decision criteria, retain records that justify each exempted transaction, and report fraud rates to their regulator on the required 90-day cycle. Clear governance protects you in the event of a dispute or audit and makes it far easier to adjust strategy with confidence.

Future developments in SCA and exemptions

The regulatory picture continues to evolve. In the EU, the proposed Payment Services Regulation and PSD3 are progressing through the legislative process, with political agreement reached in late 2025 and a transition period to follow.

The authentication framework is expected to retain SCA at its core while refining the exemption regime. In the UK, the FCA has signalled appetite for a more flexible, outcomes-based approach post-Brexit, which may see UK and EU rules diverge over time. Merchants selling across both markets should plan for two regimes rather than one.

Learn more about the Payment Services regulation and PSD3

Conclusion and practical takeaways

SCA exemptions are not loopholes; they are a deliberate, risk-based mechanism for keeping good customers moving while holding fraud in check. The merchants who get the most from them treat exemptions as a dynamic, data-driven part of their payments strategy: applying the low value and TRA exemptions where the risk genuinely justifies it, encouraging whitelisting among loyal customers, handling soft declines gracefully, and monitoring fraud rates relentlessly so they stay within the thresholds that keep their exemptions available.

That balance, lower friction without higher fraud, is exactly where the right partner makes the difference. Signifyd helps merchants apply the right SCA exemptions to the right transactions, tailoring fraud prevention to your risk appetite and growth stage so you can lift approval rates and protect conversion with confidence.