Strong Customer Authentication (SCA)
SCA is the PSD2 rule that an electronic payment, or online access to a payment account, must be authenticated with two independent factors — and, for remote payments, bound to the exact amount and payee. This guide covers the whole rule set across channels: the factors and dynamic linking, what is out of scope and every exemption with its thresholds, how SCA runs for cards online and in store and for online and open banking, the UK regime, what PSD3 / PSR change, and similar mandates elsewhere.
Out of scope vs exempt
Two different things are often called "exemptions". A transaction that is out of scope is not covered by Art. 97 at all, so no one has to apply or request anything — but it must be flagged honestly. An exemption is a transaction that is in scope, where the RTS lets a PSP skip SCA under conditions, and where the issuer can always insist on SCA anyway.
| Out of scope | Why | What to send |
|---|---|---|
| Merchant-initiated transactions (MIT) | Initiated by the payee under a prior agreement, without the payer in session — subscriptions, instalments, no-shows, delayed charges. The setup of the agreement, if done online, needs SCA. | MIT flag plus the network transaction ID of the original authenticated CIT. |
| Mail order / telephone order (MOTO) | Not initiated electronically by the payer. | MOTO indicator (ECI / POS entry mode). Using MOTO for web checkouts is non-compliant. |
| One-leg-out | The issuer or the acquirer is outside the EEA. Apply SCA on a best-effort basis. | Normal flow; expect issuers outside Europe to ignore exemption flags. |
| Anonymous prepaid | Cards the issuer cannot tie to a payer (within the AML low-value limits). | Normal flow; the issuer decides. |
| Direct debits | Initiated by the payee. A mandate given electronically through the payer's PSP may itself need SCA. | Scheme mandate data. |
The RTS exemptions
| RTS | Exemption | Conditions | Typically applied by |
|---|---|---|---|
| Art. 10 | Account information, direct | User reads balance or the last 90 days of transactions without sensitive payment data. SCA at least every 180 days. Optional for the bank. | Bank |
| Art. 10a | Account information via AISP | Same data through an AISP. SCA at first access and renewed at least every 180 days. Mandatory for the bank since 25 July 2023. | Bank (renewal via the AISP) |
| Art. 11 | Contactless at the POS | ≤ €50 per transaction, and since the last SCA either ≤ €150 cumulative or ≤ 5 consecutive contactless transactions. | Issuer (counters on card or host) |
| Art. 12 | Unattended transport & parking | Unattended terminals paying transport fares or parking fees. No amount limit in the RTS. | Issuer, flagged by the terminal / MCC |
| Art. 13 | Trusted beneficiaries | Payee on a list the payer created or amended with SCA at their own PSP. | Issuer / bank only |
| Art. 14 | Recurring transactions | Series with the same amount and same payee; SCA when the series is created or amended. Mainly standing orders — card subscriptions are usually MIT instead. | Bank |
| Art. 15 | Own-account transfers | Credit transfer between accounts of the same person held at the same PSP. | Bank |
| Art. 16 | Low-value remote | ≤ €30 per transaction, and since the last SCA either ≤ €100 cumulative or ≤ 5 consecutive low-value transactions. | Issuer counts; merchant/acquirer may request |
| Art. 17 | Secure corporate payments | Payers that are legal persons using dedicated processes or protocols not available to consumers (lodged and virtual cards, host-to-host files), with the authority satisfied of equivalent security. | Issuer; flagged by merchant/acquirer |
| Art. 18 | Transaction risk analysis (TRA) | Remote transaction, amount ≤ the exemption threshold value (ETV), real-time risk analysis finds nothing abnormal, and the PSP's own fraud rate is under the reference rate (below). | Issuer, or acquirer on its own fraud rate |
TRA reference fraud rates (RTS Annex)
| Exemption threshold value (ETV) | Remote card payments | Remote credit transfers |
|---|---|---|
| €500 | 0.01% | 0.005% |
| €250 | 0.06% | 0.01% |
| €100 | 0.13% | 0.015% |
The fraud rate is the value of unauthorised and fraudulent remote transactions (whether or not the funds were recovered) divided by the total value of remote transactions of that type — all of them, authenticated or exempted — computed on a rolling quarterly (90-day) basis (Art. 19). A PSP whose rate exceeds the reference for two consecutive quarters must stop using TRA at that band and may resume only after one quarter back under it (Art. 20). An acquirer's rate covers its whole portfolio, which is why acquirers often offer TRA only to merchants whose own rate is far below the line.
The real-time risk analysis (Art. 18(2)–(3)) must at least consider abnormal spending or behavioural patterns, unusual device or software access information, signs of malware, known fraud scenarios, abnormal payer location and high-risk payee location.
Liability: who pays when an exemption goes wrong
- PSD2 Art. 74(2): if the payer's PSP does not require SCA, the payer bears no loss for an unauthorised payment unless they acted fraudulently. If the payee or the payee's PSP fails to accept SCA, they refund the payer's PSP.
- In card schemes this becomes: acquirer-applied exemptions (low value, acquirer TRA, sent straight to authorization or flagged in 3DS) leave fraud liability with the merchant/acquirer; issuer-applied exemptions inside 3DS (a frictionless outcome) generally shift it to the issuer, subject to scheme rules.
- Exemptions are never an entitlement: the issuer can always refuse and ask for SCA — which on cards arrives as a soft decline.
Related: exemptions in the 3DS message flow →
🧩 Check yourself