The transaction risk analysis (TRA) exemption lets a provider skip strong customer authentication on low-risk remote payments, but only while its own fraud rate stays under a reference rate for the amount band. The bands are EUR 500, EUR 250 and EUR 100. Exceed the rate for two consecutive quarters and the exemption stops.
What the regulation sets
Article 18 of Delegated Regulation (EU) 2018/389 allows the exemption for remote electronic payments the provider judges to be low risk. The Annex fixes the thresholds. For card payments, the reference fraud rates are 0.01 percent for payments up to EUR 500, 0.06 percent up to EUR 250 and 0.13 percent up to EUR 100.
For credit transfers the figures are lower: 0.005 percent, 0.01 percent and 0.015 percent for the same three bands.
| Band | Card fraud rate | Credit transfer fraud rate |
|---|---|---|
| Up to EUR 500 | 0.01 percent | 0.005 percent |
| Up to EUR 250 | 0.06 percent | 0.01 percent |
| Up to EUR 100 | 0.13 percent | 0.015 percent |
Read the Annex yourself before relying on this table. It is a summary, and the legal text controls.
What "the fraud rate" is a measure of
It is the provider's own fraud rate for that payment type, not an industry average. That makes the exemption a reward for good fraud controls. A provider with weak detection loses it, and its customers get challenged more often.
Losing the exemption
Under Article 20, a provider that exceeds the reference rate for two consecutive quarters must stop using the exemption for that band. This has a data consequence for engineering teams: you need fraud and volume numbers by band, by payment type, by quarter, and they need to be trustworthy enough to report.
What to build
- Tag each payment with its band and whether SCA was applied or exempted.
- Record confirmed fraud against the original payment, so rates stay accurate when fraud is reported weeks later.
- Alert when a band's rate approaches its reference rate, before the quarter ends.
- Keep a switch that turns the exemption off per band without a deploy.
A drifting rate is easier to fix early. If the rate has already crossed the line, you will be challenging customers while you investigate.
What this does not cover
The regulation sets the thresholds and the consequence. It does not tell you how to detect fraud. Your fraud model, device signals and velocity rules are your own design. Whatever you use, keep a record of how it was tested and changed, because a regulator may ask.
Quick check
Is the fraud rate measured across the whole industry?
No. It is the provider's own rate for the payment type and band, compared with the reference rate in the Annex.
Does the TRA exemption apply to contactless payments in a shop?
It is described for remote electronic payments. Contactless at a terminal has its own exemption in Article 11.
Sources
Last reviewed: 19 October 2026.
