The EU is aware that requiring additional steps for an online purchase introduces friction during a sensitive part of the sales process. To help reduce this friction, they have made some exceptions to the SCA rules. The following transactions are exempt from SCA:

Low-risk transactions 

A well-established payment provider may be allowed to calculate the fraud risk for a transaction and determine whether to enable SCA or not. In general terms, the exemption requires that the level of fraud the payment service provider reports must be lower than the reference fraud rates throughout the EU for the same type of transactions. Other factors in the calculation include the transaction amount being less than €500, and the behaviour and geographic location of the customer as it relates to the normal behaviour for that online payment method.

It’s important to know that this assessment is done by the payment service provider and has nothing to do with the health or profile of your business.

Low-value payments

If the customer has made fewer than five payments in the last 24 hours or if the sum or the payments in the last 24 hours is less than €100, it is usually considered exempt.

Recurring payments

When you bill your customer monthly via credit or debit card, SCA is only applied for the first payment. If the amount changes each month, then SCA may be applied. Recurring payments are usually invoices for regular services, subscriptions or instalments. Recurring payments managed through SEPA direct debit have their own security procedures and are completely separate from SCA protections.

Allowlist members

If your customer uses a commercial credit card, meaning one that is issued by another company’s business account, then any transactions will likely be exempt since PSD2 doesn’t apply to B2B purchases.