Under the PSD2 technical standards, a payment can skip strong customer authentication (SCA) only when a specific exemption applies. The main ones cover low-value payments, contactless taps, trusted payees, recurring payments, own-account transfers and low-risk remote payments. Each has limits you must track in code, not just in policy.
Why developers care about exemptions
SCA means two independent factors from knowledge, possession and inherence. Applying it to every payment hurts conversion, so the regulation lists cases where it may be skipped. Skipping is never automatic. The provider decides, and the exemption can be withdrawn if the numbers behind it stop holding.
The list below comes from Commission Delegated Regulation (EU) 2018/389. Check the current consolidated text before you hard-code any value.
The exemptions and their limits
- Account information (Article 10): viewing balances or transactions from the last 90 days, without sensitive payment data, is exempt. SCA applies on first access and again once more than 90 days have passed since the last SCA.
- Contactless at point of sale (Article 11): a single payment up to EUR 50, as long as cumulative contactless spend since the last SCA is up to EUR 150 or there have been no more than five consecutive contactless payments.
- Unattended terminals (Article 12): transport fares and parking fees.
- Trusted beneficiaries (Article 13): payees the customer has put on a list. SCA applies when the list is created or changed.
- Recurring transactions (Article 14): SCA at setup, then no SCA for later payments of the same amount to the same payee.
- Own-account transfers (Article 15): payer and payee are the same person, both accounts at the same provider.
- Low-value remote payments (Article 16): up to EUR 30, with cumulative EUR 100 or five consecutive payments as the counters.
- Corporate processes (Article 17): dedicated processes for non-consumers, where authorities find them at least as secure.
- Transaction risk analysis (Article 18): low-risk remote payments, covered in a separate post.
Counters are the part teams get wrong
Cumulative and consecutive limits mean state. You need a per-customer, per-instrument record of what has been exempted since the last successful SCA, and it must reset correctly when SCA happens. A stateless service that checks only the single amount will approve the sixth contactless payment that should have triggered a challenge.
Two patterns help:
- Store the counters next to the instrument, not in a session.
- Log the reason code for every exemption you apply, so an auditor or a dispute team can see why SCA was skipped.
Exemptions are a choice, not a right
A merchant or third party can request an exemption, but the issuer can still challenge. Build your checkout to handle a challenge at any step, including after you thought you had an exemption. Treat "exemption requested" and "exemption granted" as separate states.
Quick check
Does a trusted beneficiary list remove SCA for adding a new payee?
No. SCA applies when the list is created or changed. The exemption covers later payments to payees already on the list.
Can a EUR 20 online payment always skip SCA?
No. It may qualify as low value, but only while the cumulative and consecutive counters since the last SCA stay within their limits.
If you want to know which libraries sit inside your payment flow, Safeguard can build an SBOM and scan dependencies, and there is a free scan at https://gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
