---
title: "SCA Exemption"
url: "https://mahouse.world/glossary/sca-exemption"
type: "glossary term"
topic: "Regulation"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-10"
---

# SCA Exemption

An SCA exemption is one of the cases in which a European electronic payment may proceed without strong customer authentication — the two-factor check PSD2 requires — because the transaction is low-value, low-risk under the acquirer's or issuer's fraud rates, recurring, to a merchant the customer has whitelisted, or between two accounts of the same person. Exemptions are the difference between a checkout that converts and one that does not, and applying them well is a payments company's competitive edge.

**Also known as:** Strong customer authentication exemption, TRA exemption, Low-value exemption

## Key facts

- **Used at:** every card-not-present payment in the EU and UK since SCA enforcement (2021 in the EU, 2022 in the UK); the exemption is requested by the acquirer or merchant and granted or refused by the issuer
- **Binding:** yes — the regulatory technical standards under PSD2 list the exemptions and their conditions; liability for fraud on an exempted transaction sits with whoever claimed the exemption
- **Typical exemptions:** low value (under €30, with cumulative limits); transaction risk analysis (TRA — up to €100, €250 or €500 depending on the acquirer's or issuer's fraud rate); recurring transactions of a fixed amount after the first; trusted beneficiaries (merchants the customer has whitelisted with the issuer); corporate payments through dedicated processes; merchant-initiated transactions are out of scope
- **Typical effect:** SCA challenges cost 10–25% of conversions when they were introduced; a well-tuned exemption strategy recovers most of that by challenging only the transactions that need it
- **Parties:** the merchant, the acquirer, the issuer (which decides), the card schemes (whose 3-D Secure 2 carries the request), and the regulators who set the fraud-rate thresholds

## How SCA exemptions work in practice

A customer buys a €45 item online. Without an exemption the issuer must challenge — a code, a banking-app prompt — and some share of customers abandon at that step. The merchant's acquirer, whose fraud rate is below 0.13%, may request the TRA exemption for transactions up to €100; it sends the transaction through 3-D Secure 2 flagged as exempt, with the data the issuer needs to assess risk. The issuer's own risk engine agrees and approves without a challenge: a frictionless flow. Had the issuer disagreed — the card had been used in a new country ten minutes earlier — it would have challenged anyway, which is its right.

The exemption strategy is a trade of conversion against liability. An exempted transaction that turns out to be fraud is the liability of the party that claimed the exemption — the acquirer or merchant — not the issuer's, as it would be after a completed challenge. So acquirers exempt where their fraud data says the risk is low and challenge where it is not, and payment orchestration layers route each transaction through the exemption most likely to be accepted. Fraud rates must stay below the thresholds for the exemption to be available at all, which is the regulator's leash.

For a payments company the quality of its exemption engine is measurable: the challenge rate, the frictionless approval rate and the fraud rate, and a buyer of the company reads all three.

## Example

An acquirer processes €2bn a year of card-not-present volume for 5,000 merchants. Before an exemption strategy it challenges 62% of transactions and converts 84% of them: 10% of volume lost at authentication. It builds one: low-value exemption below €30; TRA up to €250 on a fraud rate it keeps at 0.09%; recurring flagged; trusted-beneficiary enrolment offered at checkout. Challenge rate falls to 21%; frictionless approvals run at 96%; overall conversion rises from 84% to 93% — €180m of volume a year recovered, on which the acquirer earns €2.7m at its margin. Its fraud rate rises to 0.11%, still below the €250 threshold; it takes €0.4m of fraud liability it would previously have passed to issuers. A buyer's diligence values the engine at more than the acquirer's own developers thought.

## Common mistakes

- Challenging everything to avoid liability, and losing a tenth of the volume.
- Exempting everything and watching the fraud rate cross the threshold that disqualifies the exemption.
- Treating the issuer's soft decline of an exemption request as a decline rather than as a request to challenge.
- Merchant-initiated and recurring transactions flagged wrongly, so a subscription renewal is challenged with nobody present.
- A merchant assuming its acquirer's TRA threshold is its own; it is the acquirer's fraud rate that qualifies.

## Related terms

- [Strong Customer Authentication](https://mahouse.world/glossary/strong-customer-authentication.md)
- [3-D Secure 2](https://mahouse.world/glossary/3-d-secure-2.md)
- [Frictionless Flow](https://mahouse.world/glossary/frictionless-flow.md)
- [Cart Abandonment](https://mahouse.world/glossary/cart-abandonment.md)
- [Approval Rate](https://mahouse.world/glossary/approval-rate.md)
- [PSD2](https://mahouse.world/glossary/psd2.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov