What is Issuer exemption?

SCA exemption applied by the issuer's ACS based on its risk view of the transaction, often the origin of frictionless approvals on higher tickets.

Issuer exemption is a regulatory provision under PSD2’s Strong Customer Authentication (SCA) requirements, whereby the cardholder’s issuer can unilaterally decide to exempt a transaction from SCA after receiving an authentication request.

This decision is made by the issuer’s Access Control Server (ACS) based on its real-time risk assessment of the transaction and the cardholder’s behaviour.

If the issuer determines the transaction to be low risk, it can apply an issuer exemption by returning an ‘authentication successful’ message in the 3D Secure 2 (3DS2) frictionless flow, typically with a specific Electronic Commerce Indicator (ECI) value indicating an issuer-applied exemption.

For a merchant, an issuer exemption results in a frictionless transaction for the cardholder, meaning no challenge is presented and the payment proceeds directly to authorisation.

This exemption is particularly noticeable on higher-value transactions that might otherwise be expected to trigger a challenge, improving conversion rates without merchant intervention.

A common operational pitfall occurs when merchants misinterpret a decline following an issuer exemption as a 3DS failure, whereas the exemption merely bypasses the challenge and the subsequent decline is an authorisation decision, often due to insufficient funds or other issuer-specific rules.