What is 3-D Secure exemption? Definition and example

3-D Secure exemption

A 3-D Secure exemption is a request to skip strong customer authentication on a card payment under one of the cases allowed by the PSD2 regulatory technical standards, such as low-value payments or transaction risk analysis, with the issuer making the final decision.

Also called: SCA exemption, 3DS exemption, PSD2 exemption, frictionless exemption, low-value exemption, TRA exemption, transaction risk analysis exemption

Updated 16 October 2026

How does a 3-D Secure exemption work?

Commission Delegated Regulation (EU) 2018/389 sets out the cases in which strong customer authentication may be skipped. For card payments the main ones are low-value remote payments under EUR 30 (Article 16, with a cumulative cap of EUR 100 or five payments since the last authentication), transaction risk analysis (Article 18, where the provider’s fraud rate is below reference rates that allow amounts up to EUR 500), trusted beneficiaries (Article 13) and recurring payments of the same amount to the same payee (Article 14). The exemption is flagged in the 3-D Secure request or in the authorization, and the issuer accepts or refuses it.

Why do exemptions matter for approval rate?

Every challenge is a step where customers can abandon or fail. As an illustrative example: if 10% of challenged customers drop out, 20,000 European card payments that are all challenged lose 2,000 payments. If a quarter of them qualify for an accepted exemption, about 500 of those losses are avoided.

What are the risks of using exemptions?

Liability for fraud usually moves back to the merchant when an acquirer-requested exemption is used instead of authentication. Transaction risk analysis is only available while the fraud rate stays below the reference rate, so a fraud spike can remove the option. In high-risk merchant categories, issuers often refuse exemptions and return a soft decline, which adds a retry and some latency.

Where does Omno use it?

3-D Secure and exemption requests are performed by the connected PSP. Omno’s routing and cascading keep the authentication state consistent when a payment moves between routes, and the routing-decision log records the response code for each attempt.

Frequently asked questions

Who decides whether an exemption is applied?

The acquirer or PSP can request an exemption, but the issuer decides. An issuer can always insist on strong customer authentication and return a soft decline asking for it, in which case the payment has to be retried with a 3-D Secure challenge.

Does PSD2 strong customer authentication apply to merchants outside Europe?

The PSD2 rules apply when both the issuer and the acquirer are in the European Economic Area, with equivalent rules in the UK. A transaction with a non-European acquirer or a non-European card is one-leg-out and outside the mandate, although issuers may still request authentication and some other markets have their own 3-D Secure rules.