The article makes clear that exemption handling does not remove merchant liability for fraud. Even when a PSP requests the exemption and the issuing bank accepts it, the merchant can still bear responsibility if the payment is later found to be fraudulent. That makes ownership shared in practice, but accountability for downstream loss still sits with the merchant unless another rule specifically shifts it.
Who owns the loss when an exemption is granted?
The key issue is that a payment exemption changes the processing path, not the underlying fraud accountability model. If the merchant or its PSP chose the low-risk exemption route, the later fraud outcome usually remains a merchant-side commercial loss unless the card scheme, acquirer, or contract explicitly reassigns liability. The exemption is permission to skip a step, not a guarantee that the transaction is risk-free.
A practical way to think about this is that exemption approval can reduce friction, but it does not create a liability shield. The relevant question is who accepted the risk decision, who documented the basis for that decision, and which party contractually agreed to absorb chargeback or fraud loss if the transaction later fails.
For broader payment security context, PCI DSS v4.0 remains the clearest external reference point because payment governance still hinges on access control, account handling, and disciplined transaction controls even when an exemption changes the normal flow.
Why exemption handling and liability are not the same thing
Exemptions exist to support a specific payment policy objective, such as reducing friction for lower-risk transactions or avoiding unnecessary challenge. That policy decision is separate from post-event loss allocation. In practice, the exemption framework asks whether the transaction could proceed with less intervention; liability asks who bears the consequence if the transaction later proves fraudulent.
This distinction matters because many teams assume that an approved exemption means the issuer has accepted the risk. That is not generally true. The issuer may accept the request and process the authorization, while the merchant still retains liability under the commercial and scheme rules that govern fraud outcomes, especially when the exemption was requested by the merchant side through the PSP.
Merchants therefore need to treat exemption approval as an operational control, not as a settlement of blame. The strongest governance question is whether the exemption criteria, supporting evidence, and liability allocation are documented in a way that can survive dispute handling, chargeback review, and internal audit.
For card-program teams, the payment rules themselves are the primary control surface, which is why the PCI Security Standards Council document library is the right place to anchor internal policy interpretation when the exemption decision and the fraud outcome must be reconciled.
What practitioners should verify before relying on a low-risk exemption
Before accepting any exemption-driven process as “safe,” teams should verify three things: the scheme rule that permits the exemption, the PSP or acquirer responsibility for requesting it, and the exact contract language governing downstream fraud loss. Without all three, teams can easily confuse process approval with liability transfer.
- Confirm who can request the exemption and under what conditions.
- Check whether the merchant, PSP, or acquirer owns evidence for the exemption decision.
- Review chargeback and fraud-loss clauses for explicit exception handling.
- Keep a record of the transaction attributes that justified the exemption in case the decision is later disputed.
Where the payment stack is integrated with APIs or delegated payment services, control failures in authorization and request handling can also affect how much trust the exemption deserves. The transaction may be low-risk by policy, but the surrounding implementation still needs clear authorization boundaries and traceable decision evidence. That is why OWASP API Security Top 10 is relevant when exemption decisions are mediated through service integrations.
Practitioner takeaway: Treat a low-risk exemption as a routing decision, not a liability decision. If the transaction later proves fraudulent, the merchant usually needs to assume it still owns the loss unless the rulebook or contract clearly says otherwise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack surface, CIS Controls v8 and NIST CSF 2.0 set the technical controls, and PCI DSS v4.0 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| PCI DSS v4.0 | Req. 7 — Restrict access by business need | Exemption handling depends on tightly controlled approval and payment process access. |
| Req. 8.6 — System and application accounts | Payment exemptions are often executed through PSP and application accounts that need governed use. | |
| Recommendation — Restrict exemption approval and payment exception access to the smallest authorized business group. Inventory and govern application accounts that request or process exemption-based transactions. | ||
| CIS Controls v8 | 6 — Access Control Management | Who can approve or trigger an exemption is an access-control question with fraud-loss consequences. |
| Recommendation — Limit who can request or approve exemption flows and review those permissions regularly. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication and Access Control | Payment exemption decisions rely on controlled access and accountable system actors. |
| Recommendation — Apply PR.AA controls to ensure exemption requests are made only by authorized actors. | ||
| OWASP Agentic AI Top 10 | A2 — Identity and Access Abuse | If payment exemptions are initiated by automated agents or workflows, access abuse can alter outcomes. |
| Recommendation — Constrain agent-driven exemption requests with explicit authorization and auditable limits. | ||
Related resources from NHI Mgmt Group
- Who is accountable when a 3D Secure authenticated transaction later turns out to be fraudulent?
- What happens when a valid authorised transaction later turns out to be fraudulent under the new Amex CID policy?
- Who is accountable when an access request is approved through a ticket but later turns out to be inappropriate?
- Who is accountable if a filtered log later turns out to contain an attack signal?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
