A PSD2 exemption that allows a payment provider to skip Strong Customer Authentication on lower-risk transactions when documented fraud-rate evidence stays within RTS thresholds. The exemption depends on measurable risk performance, supporting data, and ongoing monitoring, not on a one-time approval.
What Transaction Risk Analysis Exemption Means in PSD2
The transaction risk analysis exemption is a PSD2 control exception, not a free pass. It lets a payment provider skip Strong Customer Authentication only for eligible low-risk transactions, and only when its observed fraud performance remains inside the RTS thresholds.
How the Exemption Works in Practice
The exemption is tied to measurable fraud outcomes, transaction context, and ongoing evidence. In practice, the provider must demonstrate that its risk engine, monitoring, and reporting are strong enough to justify reduced friction without pushing fraud above the regulatory ceiling.
This makes the exemption fundamentally conditional. If the evidence weakens, if monitoring is incomplete, or if the fraud rate drifts upward, the exemption stops being defensible and the transaction should fall back to stronger authentication.
Why Risk Scoring and Monitoring Matter
The point of the exemption is to move from static approval to continuous risk management. It is not enough to assess a merchant, customer, or payment flow once, because transaction risk changes with behaviour, fraud patterns, device signals, velocity, and channel conditions.
That is why the exemption depends on a live control loop: detect, measure, review, and adjust. The provider is effectively proving that the lower-friction path remains safe enough over time, rather than assuming it will stay safe because it was safe yesterday.
Where the Exemption Fits in Stronger Authentication Strategy
The exemption should be treated as a selective optimisation inside a broader authentication strategy, not as a replacement for stronger controls. It is most valuable when the provider can separate genuinely low-risk transactions from those that still need step-up authentication or a different fraud decision.
Good use of the exemption preserves conversion and user experience while keeping stronger checks available for higher-risk traffic. Poor use turns the exemption into silent control erosion, where convenience expands faster than the evidence base that supports it.
Risk and Threat Considerations
The main risk is control drift: a payment flow can look low risk until fraud patterns, account takeover activity, or merchant abuse shift the baseline. If that happens, exemptions may continue longer than they should and can create a wider window for unauthorised payments.
Failure mechanism: The fraud-rate test becomes stale, monitoring misses deterioration, or the exemption is applied too broadly across transactions that are no longer genuinely low risk.
Impact: Elevated fraud losses, weakened authentication assurance, and potential non-compliance with the PSD2 RTS conditions that justify the exemption.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Transaction risk exemption depends on reviewable fraud evidence and monitoring. |
| IA-2 — Identification and Authentication (Organizational Users) | The exemption is a decision to bypass strong authentication on selected payments. | |
| AC-6 — Least Privilege | The exemption narrows stronger auth to only the higher-risk transaction cases. | |
| Recommendation — Review exemption telemetry for fraud drift and escalate when evidence weakens. Apply step-up authentication when transaction risk no longer supports exemption. Limit exemption use to the smallest transaction set justified by evidence. | ||
Practitioner Guidance
Governance implication: Treat the exemption as a monitored policy decision with ownership, evidence, and review cadence, not as a one-time configuration. The operational question is whether the current fraud data still supports reduced authentication for the specific transaction population being exempted.
What to watch for: Changes in fraud rate, channel mix, device reputation, merchant concentration, or chargeback behaviour should prompt revalidation of the exemption boundary. NIST SP 800-53 Rev 5 Security and Privacy Controls provides a useful control lens for monitoring, authentication, and auditability around decisions like this.
Related resources from NHI Mgmt Group
- What breaks when transaction risk analysis is too weak?
- How should payment service providers build a transaction risk analysis programme that helps merchants keep checkout friction low under SCA?
- When should organisations prioritise transaction risk analysis exemptions over forcing more step-up authentication at checkout?
- Who is accountable when a low-risk payment exemption is granted but the transaction later turns out to be fraudulent?
