Exemption (SCA Exemption)

An SCA exemption lets a payment skip strong customer authentication under specific low-risk conditions set by regulation, rather than forcing the full authentication process onto every single transaction. Exemptions exist to keep checkout friction proportionate to actual risk, avoiding pointless authentication steps for low-value or low-risk payments. For merchants, applying exemptions appropriately can support conversion without necessarily reducing security — though outcomes depend on how exemptions are used.

Which Transactions Actually Qualify

Common exemption categories include low-value transactions under a set threshold, recurring payments to a previously authorised merchant, and transactions a merchant or acquirer's risk engine has assessed as genuinely low risk. Others cover trusted beneficiaries, where a customer has already whitelisted a merchant, and corporate payments made through secure dedicated channels. Each category comes with its own specific conditions, and getting the wrong one can get a transaction declined by the issuer.

An Exemption Is a Request, Not a Guarantee

Full 3D Secure checks require the cardholder to complete an extra step, a one-time passcode, biometric confirmation, before a payment gets authorised. An exemption skips that step for qualifying transactions, cutting friction but shifting more of the fraud risk onto whoever requested the exemption. Issuers keep the final say, and they can decline an exemption request and demand full authentication regardless, an exemption request is not a guarantee of outcome.

Getting the Exemption Strategy Right Takes Ongoing Work

Merchants applying exemptions need a clear read on which transactions actually qualify, since 3DS strategy by industry varies a lot depending on average transaction value, chargeback history and sector-specific risk. Getting the balance right usually takes ongoing monitoring rather than a fixed, set-once configuration, since issuer behaviour and fraud patterns keep shifting. Plenty of merchants work directly with their payment provider to test and tune exemption strategies against real approval and decline data.

Push Too Hard on Exemptions and It Backfires

Requesting exemptions too aggressively raises fraud exposure and, in some cases, shifts chargeback liability back onto the merchant, since skipping authentication removes a layer of issuer-side verification. Go too conservative, though, and full authentication gets requested more than it needs to be, adding friction that dents checkout completion. Most merchants find the right balance through iterative testing rather than applying one fixed rule across every transaction type.

Regulation Keeps Moving the Goalposts

Regulators periodically revisit exemption rules as fraud patterns shift and authentication technology matures, meaning a strategy that worked well last year might need revisiting this year. Merchants operating across several jurisdictions also have to account for local variation in how exemptions actually get interpreted and enforced, since enforcement isn't perfectly uniform market to market. Staying current usually takes close coordination between a merchant's payment provider, compliance function and technical team, not a setting configured once and left alone.