Merchants should use TRA exemptions only for transactions that are demonstrably low risk, based on real-time fraud scoring, transaction history, and customer behaviour. The goal is to reserve SCA and 3DS for higher-risk payments while letting low-risk purchases pass with less friction. Strong controls, ongoing monitoring, and clear thresholds are essential so exemption use supports both compliance and conversion.
How to judge whether a TRA exemption is actually low risk
TRA exemptions work best as a controlled exception, not a blanket checkout optimisation. The deciding question is whether the payment still looks low risk when you combine transaction value, merchant fraud history, device and customer signals, and the quality of the fraud model. If the data is thin, stale, or inconsistent, the exemption is usually too weak to trust.
A practical decision rule is to treat the exemption threshold as a risk boundary, not a conversion target. That means merchants should define which patterns qualify automatically, which require extra review, and which always fall back to SCA and 3DS. The threshold should be calibrated to observed fraud losses, chargeback outcomes, and false-positive rates, then adjusted as the portfolio changes.
Low-risk classification also needs to be explainable after the fact. If a merchant cannot show why a transaction was exempted, the control is probably too loose. That is why real-time scoring, stable customer behaviour, and transaction history matter more than a single static rule or a broad value-based shortcut.
Where TRA exemptions go wrong in practice
The main failure mode is overuse. Once exemptions are treated as a routine bypass, merchants can erode the very protection they are meant to preserve. Fraudsters look for merchants with generous thresholds, weak monitoring, or exemption decisions that do not respond quickly to changing attack patterns.
Another common problem is using outdated signal logic. A customer who has behaved safely for months may still present elevated risk if the device changes, the order pattern shifts sharply, or the payment profile no longer matches normal behaviour. Exemptions should therefore be revisited as conditions change, not locked in by habit or convenience.
- Monitor exemption approval rates alongside fraud and chargeback trends.
- Revise thresholds when the merchant mix, customer base, or attack pattern shifts.
- Route ambiguous transactions back to stronger authentication rather than stretching the exemption band.
If a merchant wants a useful benchmark for what strong identity and access controls look like in adjacent fraud-sensitive environments, NHI governance guidance such as NHI Mgmt Group’s Ultimate Guide to Non-Human Identities is useful for thinking about thresholds, visibility, and lifecycle control. The same operational discipline applies here: exceptions only work when they are observable and tightly bounded. For broader control mapping, merchants can also use NIST Cybersecurity Framework 2.0 to anchor governance, monitoring, and response around the exemption process, and NIST SP 800-53 Rev 5 Security and Privacy Controls for control discipline around access decisions, logging, and review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | TRA exemptions need a defined risk tolerance and decision threshold. |
| DE.CM-01 — Monitor for Adverse Events | Ongoing monitoring is needed to detect when exemptions start increasing fraud risk. | |
| Recommendation — Set exemption thresholds against fraud risk appetite and review them as loss patterns change. Track exemption outcomes continuously and tighten thresholds when loss signals worsen. | ||
| CIS Controls v8 | 6.8 — Audit Log Management | Exemption decisions must be observable and reviewable to catch misuse. |
| 5.1 — Establish and Maintain an Inventory of Assets | Risk scoring depends on knowing which checkout, device, and payment paths are in scope. | |
| Recommendation — Log exemption decisions and review them for drift, abuse, and control failure. Maintain a current inventory of payment channels and decision points feeding exemption logic. | ||
| NIST AI RMF | MAP 1.3 — Contextualize AI System Risks | If machine scoring is used, the model context and limitations affect exemption quality. |
| Recommendation — Validate the scoring context, inputs, and limitations before trusting automated exemption decisions. | ||
Practitioner Guidance
What to verify: Before relying on an exemption, confirm that the fraud model uses current transaction features, that the merchant can segment risk by channel and customer cohort, and that the exemption outcome is auditable. If any of those three are missing, the merchant is probably taking on more fraud exposure than the friction savings justify.
Decision rule: If the transaction is unusual, the customer profile is incomplete, or the fraud signal quality has degraded, default to stronger authentication rather than stretching the exemption threshold. If the exemption is granted, require post-transaction monitoring that can detect whether the threshold is drifting into unsafe territory.
What practitioners underestimate: TRA exemptions are not just a payment UX choice, they are a control design choice. The safe operating point is the one where the merchant can prove the exemption still discriminates well between genuine and risky payments as behaviour and fraud patterns evolve.
Practitioner takeaway: Use TRA exemptions as a narrow, measurable exception path, and let the fraud model, not checkout pressure, define when reduced friction is actually justified.
Related resources from NHI Mgmt Group
- How should merchants reduce manual fraud review without increasing fraud risk?
- How should governments design self-service identity enrollment without increasing fraud risk?
- How should organisations strengthen remote identity proofing without increasing fraud or bias risk?
- How should organisations secure customer-facing AI agents without exposing sensitive data or increasing fraud risk?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
