SCA exemption

An SCA exemption is a case where a card payment can be processed without strong customer authentication, even in a market that normally requires it. Strong customer authentication asks the cardholder to verify themselves, often with a step such as a one-time code or a device prompt, and an exemption lets a qualifying low-risk transaction skip that step so the payment goes through without a challenge.

Exemptions exist because authentication adds friction, and forcing every payment through a challenge would abandon sales that pose little real risk. Regulations that mandate strong customer authentication in certain regions also define categories that can be exempted, such as low-value payments, transactions a risk analysis judges to be low risk, and merchant-initiated charges where the cardholder is not present. Claiming an exemption is a request, not a guarantee: the issuer still decides whether to accept it or require authentication anyway. A subscription platform such as Recurly can flag eligible transactions with the appropriate exemption so recurring charges are not challenged unnecessarily. Recurly automatically applies the merchant-initiated exemption to eligible renewals and flags Admin Console transactions as MOTO-exempt, and its 3DS dunning flow, which re-authenticates the customer if an issuer rejects an exemption, is available on Adyen and Worldpay.

Why SCA exemption matters for subscription businesses

For recurring billing, exemptions are what keep renewals flowing without asking absent cardholders to complete a step they cannot. A subscription renewal happens when the customer is not there, so requiring authentication on it would cause the charge to fail. Correctly claimed exemptions let those charges process smoothly while staying compliant.

A few reasons it matters:

• It protects renewal success, since a merchant-initiated charge claimed under the right exemption does not need the absent cardholder to authenticate.

• It reduces checkout friction, because low-risk customer purchases can proceed without a challenge that might cause abandonment.

• It balances conversion against liability, since skipping authentication can shift fraud liability, which makes the choice of when to claim an exemption a deliberate one. Generally, an authenticated 3DS transaction shifts fraud liability to the issuer, while a transaction processed under an exemption keeps that liability with the merchant if it turns out to be fraudulent.

How to use SCA exemption

Match the exemption to the transaction. A renewal and a first-time checkout are different situations, and each has its own eligible exemptions. Because the issuer can still demand authentication, design the flow so that a declined or challenged transaction can fall back to a full authentication step rather than simply failing.

Points to get right:

• Identify which exemption fits each transaction type, such as a merchant-initiated exemption for renewals or a low-value or risk-based exemption at checkout.

• Set up the initial customer transaction to authenticate and capture consent, so later merchant-initiated charges can rely on it.

• Handle issuer soft declines by falling back to authentication, since an exemption request can be refused. Recurly's 3DS dunning flow provides this fallback and is available on Adyen and Worldpay.

• Monitor which exemptions are being accepted so the approach can be tuned over time.

Benefits and examples

Used well, SCA exemptions let a business keep authentication where it adds protection and remove it where it only adds friction. Renewals process without interrupting customers who are not present, and low-risk purchases clear without an unnecessary challenge, all while the business stays within the rules of the markets it operates in.

For example, a subscription service based in a market that requires strong customer authentication signs up a new customer, who authenticates once at checkout and agrees to recurring billing. Each later renewal is a merchant-initiated transaction, and the service claims the merchant-initiated exemption so the charge processes without asking the absent customer to authenticate. If an issuer occasionally refuses the exemption and requests authentication, the service can reach out to the customer to complete a step rather than losing the payment outright.

Frequently asked questions

What is the difference between SCA and an SCA exemption? Strong customer authentication is the requirement to verify the cardholder on a transaction. An SCA exemption is a defined case where that verification can be skipped because the transaction is considered low risk or the cardholder is not present. The exemption is the exception to the rule.

Can an issuer still require authentication when an exemption is claimed? Yes. Claiming an exemption is a request, and the issuer can decline it and require authentication anyway. A well-designed flow falls back to an authentication step rather than treating the transaction as failed.

Which transactions can be exempt from SCA? Common categories include low-value payments, transactions a risk analysis deems low risk, and merchant-initiated charges where the cardholder is not present. The specific categories and any value limits are set by regulation and vary by region. This is primarily PSD2 and strong customer authentication in the EU and UK, with common categories including low-value transactions under €30, transaction risk analysis for low-fraud-rate merchants, and the recurring merchant-initiated exemption.

Are subscription renewals exempt from SCA? Renewals are typically handled as merchant-initiated transactions, which can qualify for an exemption because the cardholder is not present, provided the customer authenticated and consented on the initial transaction. The initial sign-up usually still requires authentication.