How the low-value exemption works
The exemption has a limit for each payment and two counters. In the EU the payment may not exceed EUR 30. In addition, since the payer's last strong customer authentication, either the total of earlier remote payments is no more than EUR 100 or their number is no more than five in a row.
In the UK, the FCA's technical standards set £25 for the payment and £85 for the running total, with the same count of five. Once the counters are passed, the next payment is authenticated and they start again.
Who decides whether the exemption applies
The article allows the exemption and obliges no one to use it. The counters run on the payer's side, so only the issuer knows whether a given payment still fits.
A merchant or its acquirer can ask for the exemption in the 3-D Secure or authorisation request, without knowing where the counters stand. The issuer can accept, or answer that authentication is needed, and the checkout then takes the buyer through a challenge.
Why low-value transactions matter to a product
Small, frequent payments such as fares, digital content and top-ups lose buyers at every extra step. A checkout flags them and recovers cleanly when the issuer asks for authentication, and an issuer keeps the counters in its authorisation logic.
Low-value, contactless or TRA exemption?
- Contactless exemption
- For payments at a terminal, under Article 11. In the EU: EUR 50 a payment, and EUR 150 in total or five payments in a row since the last authentication.
- TRA exemption
- For remote payments that the provider has scored as low risk, with limits tied to the provider's fraud rate. The transaction risk analysis exemption has no counter of payments.
Where a low-value transaction shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- Delegated Regulation (EU) 2018/389, Articles 11 and 16 (EUR-Lex)
- FCA Handbook, technical standards on strong customer authentication, Article 16
General information, not legal advice: what applies to you depends on your services and your market.