SCA exemption is a PSD2 rule that lets a card payment complete without strong customer authentication, with no one-time code or banking-app approval, in a market where authentication would otherwise be mandatory. The merchant or its acquirer sets the exemption flag in the payment message through its gateway, and the cardholder's issuer decides whether to accept it or soft-decline and demand a challenge. Transaction risk analysis carries most volume, exempting payments up to 100, 250 or 500 euros depending on the acquirer's fraud-rate band; the low-value exemption covers payments under 30 euros. The trade-off is liability: an exempted payment loses the fraud chargeback shift to the issuer, so the merchant or acquirer absorbs any fraud that follows.
Who asks, who decides, and what happens when they disagree
The exemption is a flag, and the flag has to be built correctly by the gateway or payment service provider assembling the request. An issuer that is unconvinced can soft-decline and demand a challenge anyway. That is not a lost sale unless the merchant treats it as one: the right answer is to re-present the payment through full authentication, which is why exemption strategy and a working decline recovery path are really one project.
The exemptions worth building for
Transaction risk analysis carries the most volume. The acquirer scores the payment in real time and may exempt it up to 100, 250 or 500 euros depending on the fraud-rate band the acquirer sits in — better fraud performance buys a higher ceiling.
The low-value exemption covers payments under 30 euros, with counters that force authentication after five consecutive exempt payments, or once 100 euros of exempt spend has accumulated on the card.
Trusted beneficiary means the cardholder has added the merchant to a whitelist held at their own bank. Merchant-initiated transactions — subscription billing renewals and similar charges the customer does not trigger — sit outside the rules once the first payment was authenticated and a mandate exists. Corporate payments through secure dedicated processes, and unattended transport and parking terminals, have carve-outs of their own.
Watching the counter
Three purchases at 12, 18 and 25 euros pass unchallenged. The fourth and fifth do too, but the running total is now close to 100 euros, and the next payment on that card is challenged regardless of size. Businesses with high-frequency small tickets should expect that moment and design the checkout to survive it, rather than read it as a failure.
What the exemption costs you
Authentication moves fraud chargeback liability to the issuer. Claim an exemption and the protection is gone: the merchant or acquirer absorbs the fraud. A frictionless flow is the other way to reach a checkout with no visible step, and it keeps the liability shift, because the authentication genuinely happened. The choice is commercial — exempt the traffic where extra approvals outweigh the fraud absorbed, authenticate the rest.
Measuring it honestly
Three numbers, kept apart: how often exemptions are requested, how often issuers accept them, and the fraud that follows. A high request rate proves nothing if most issuers refuse.
See also: Dynamic 3DS (3-D Secure).