How the TRA exemption works
Three conditions apply together. The provider's fraud rate for that type of payment is within the reference rate, the amount is within the threshold for that rate, and the real-time analysis finds no warning sign, such as abnormal spending, unusual device information, malware or a high-risk payee location.
For remote card payments the thresholds are:
- Up to EUR 100 with a fraud rate of 0.13% or less
- Up to EUR 250 with a fraud rate of 0.06% or less
- Up to EUR 500 with a fraud rate of 0.01% or less
How the fraud rate is measured
Article 19 sets the rate as the total value of unauthorised or fraudulent remote transactions divided by the total value of all remote transactions of the same type, over a rolling 90 days. A provider whose rate is above the reference rate for two quarters in a row stops using the exemption in that threshold range (Article 20).
The UK kept the exemption in the FCA's technical standards, also as Article 18.
Who applies the TRA exemption
The EBA's opinion of 13 June 2018 says that for card payments both the issuer and the acquirer may apply the exemption, that the issuer always has the final decision, and that a merchant can never decide. The acquirer's rate is calculated on all the transactions it acquires, not on one merchant's.
Where the payee's provider does not accept strong customer authentication, Article 74 of PSD2 has it refund the damage to the payer's provider. An exemption asked for by the acquirer therefore generally leaves the fraud loss on the acquirer's side.
TRA exemption or low-value exemption?
- Low-value exemption
- Covers small remote payments up to a fixed amount, with a cumulative limit, and has no fraud-rate condition.
- Frictionless flow
- In 3-D Secure, the issuer approves without challenging the cardholder. That can be the issuer's own use of the TRA exemption.
Where the TRA exemption shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
- Delegated Regulation (EU) 2018/389, consolidated: Articles 18 to 20 and Annex (EUR-Lex)
- EBA, Opinion on the implementation of the RTS on SCA and CSC, EBA-Op-2018-04, 13 June 2018
- Directive (EU) 2015/2366, PSD2, Article 74 (EUR-Lex)
- FCA Handbook, UK technical standards on SCA: Chapter 3, exemptions
General information, not legal advice: what applies to you depends on your services and your market.