Exemption

Description

What action is needed by merchant

Low value

Remote transactions up to and including 30 PONDS may receive an SCA exemption, however this exemption is limited to a maximum of 5 consecutive transactions, or a cumulative limit of 100 PONDS.

Merchants may need to make changes depending on e-Commerce product type and integration method (see your relevant implementation guide).

Only the issuer can determine when the transaction counter or cumulative limit is reached and (if yes) will request authentication.

TRA

The TRA exemption allows for certain remote transactions to be exempted from SCA subject to a real-time risk check and depending on the transaction value and acquirer’s fraud rate. It is therefore also referred to as the “low risk” exemption. TRA is key to delivering frictionless payment experiences for low-risk remote transactions. Issuers and Acquirers can both apply the TRA exemption if they meet certain requirements, including achieving fraud rates according to the thresholds below:

This exemption relies heavily on the data provided for a transaction, so that the issuer / acquirer can assess the risk of a transaction properly. Therefore, it is highly recommended to provide all the information on a transaction as well as the cardholder. The information you as a merchant or your PSP has to provide depends on your integration method. This is explained in the relevant guide from EVO or your 3rd party gateway.

EVO is planning to offer this acquirer exemption type from April 2022.

Recurring Transactions

Applicable when the customer makes a series of recurring payments for the same amount, to the same business. SCA is required for the customer’s first payment – subsequent charges however may be exempted from SCA.

Note: Visa does not consider recurring payments an exemption as they are part of their MIT network and thus in their opinion they are out of scope of SCA.

The transactions must be flagged as a recurring transaction according to your PSP’s specifications in order to qualify for an exemption application. You also need to provide the trace ID of the first payment.

Mastercard: White Listing

Visa: Trusted Beneficiaries

Cardholders may add a merchant to a list of whitelisted/trusted beneficiaries held by their Issuer. Subsequent payments to such merchants do not require SCA.

This is primarily an issuer exemption as the information needed is stored by the issuer. The flagging of the granted issuer exemption in the authorisation is managed by your PSP – no action needed.

Secure corporate payments

Payments made through dedicated corporate processes and protocols (e.g. lodge cards, central travel accounts and virtual cards) which are initiated by business entities, not available to consumers and which already offer high levels of protection from fraud may be exempted from SCA, subject to the view of the relevant competent authorities.

Lodge Cards, Central Travel Accounts and Virtual Cards that are not associated with an individual cardholder and are used within a secure dedicated corporate payment process are examples that may fall into this category.

This is primarily an issuer exemption as the needed information is stored by the issuer. The flagging of the granted issuer exemption in the authorization is managed by your PSP – no action needed.

Exclusion / Out of Scope

Description

Note: Merchants must ensure that transactions are coded, flagged or validated correctly for all out of scope payment scenarios to ensure correct treatment and processing

Anonymous prepaid cards

Due to their very nature, payments made through the use of anonymous payment instruments, such as anonymous prepaid (e.g. gift) cards, are not subject to the obligation of strong customer authentication.

The Issuer is the only one able to identify this type of card. The acquirer will not be able to identify from the primary account number that the product is an anonymous product.

Managed by card issuer – no action needed.

Mail Order/Telephone Order – MOTO

Payments transacted by email or telephone are not considered to be electronic payments, and are deemed out of scope for SCA.

Ensure your MOTO transactions are correctly coded for all cardholder purchase / payment scenarios.

“One-leg” transaction

SCA regulations apply only to transactions made entirely within the EEA. If issuer or acquirer is domiciled outside the EEA (“One-leg out”), no SCA mandates apply. The nationality of the cardholder nor the merchant’s business location are relevant for the assessment as to whether a transaction is out of scope due to the “one-leg” rule. EVO Risk policy and systems can influence if SCA should be applied in such instances.

Managed by your PSP – no action needed. Issuers and acquirers may still require SCA to be applied to one-leg transactions. EVO’s current policy will require SCA for one-leg transactions.

Merchant initiated transactions – MIT

SCA is required for the customer’s first payment where the cardholder agrees to the terms and conditions of later subsequent charges. These subsequent charges however are excluded from SCA, provided that the cardholder is not present in the check-out flow (sometimes referred to as off-session) at the time when the charge occurs. This category also includes subsequent recurring payments.

The transactions must be flagged as a Recurring or MIT according to your PSPs specifications/ MIT framework in order to be approved by the Issuer’s as not requiring SCA. You also need to provide the ID of the first (Cardholder initiated & SCA authenticated) payment