E-Commerce In Europe Is About To Change Forever

Not all transactions are required to adhere to SCA. Key exemptions include:

• Merchant-initiated transactions. This includes recurring purchases of the same amount made to the same merchant, such as gym memberships and digital services subscriptions. An important caveat is that SCA will be required for the initial payment to the merchant. At this time, metered billing subscriptions (e.g., subscriptions of varying monthly amounts, such as a utility bill) and various other types of ‘off-session’ payments (e.g., crowd funding) will not be included as part of this exemption.
• Low-value transactions. Purchases under €30 are exempt from SCA. However, SCA will be required once five transactions below €30 have been made or the total value of those transactions reaches €100. At that time, SCA will be applied and then the ‘transaction count’ will be reset.
• Trusted beneficiaries. Under this exemption, cardholders can request that their card issuer ‘white-list’ a merchant so that SCA need not be applied to future transactions. The onus is on the card issuer to manage white lists for each cardholder. This exemption is worthy of close consideration by merchants and their payments partners to ensure that frequent customers have the best possible checkout experience. Merchants (especially those reliant on card-on-file transactions) should work with their payments partners to streamline the process for customers to add them to a white list.
• Transaction Risk Analysis (TRA). TRA is perhaps the most important exemption because it allows merchants to skirt SCA requirements if their payment provider’s aggregate fraud rate (e.g., across all the provider’s customers) is below certain thresholds. These fraud thresholds are .13% for transactions under €100, .06% for transactions between €100 and €250 and .01% for transactions between €250 and €500. Permitted the payment provider’s fraud rates stay beneath these thresholds, real-time risk analysis can be applied to the transaction to assess if SCA should be applied.
• Secure corporate card payments. Transactions made with a corporate card will be exempt from SCA if the card is ‘lodged’ (e.g., stored with a travel agency that makes airline bookings on behalf of employees) or a virtual card number is used for the transaction.

It’s important to note that applying an exemption is optional. When an exemption is applied as part of EMV 3DS, the fraud liability will fall back on the payment provider (and often, ultimately the merchant) instead of the card issuer, which will own the fraud liability on all transactions where SCA is applied. Further, it is ultimately the decision of the card issuer to support and accept an exemption. We expect that it will be highly unlikely all issuers will be prepared to support every exemption by September 14.

What’s the Market Impact?