Exemptions are transactions that don't need strong customer authentication, and they don't necessarily need explicit cardholder authentication. These transactions don't need prior authentication for authorisation or go through a frictionless authentication flow, meaning the cardholder does not need to authenticate themselves with the issuer.

Exemption types

These exemptions include transactions that are:

• Low value
• Low risk
• Between cardholder and merchant, where the cardholder has allowlisted the merchant as a trusted beneficiary
• Made with a corporate card

If you request an exemption:

• The issuer has the authority to override exemption requests.
• Some acquirers may not allow specific exemptions for their merchants. Merchants should consult with their acquirers to understand which exemptions they can use.

Request an exemption

You can request exemptions by setting the appropriate value in the threeDSecure.exemptionFlag field.

Soft declines

If you request an exemption via authorisation (skipping the 3-D Secure call), the acquirer may reject the exemption request. In such cases, the transaction receives a soft decline, indicated by the 300.100.100 result code.

The correct action after a soft decline is to:

1. Re-send the transaction to 3-D Secure authentication.
2. After authentication, proceed to authorisation with the authentication result.

Soft declines could occur even after 3-D Secure authentication, for example, if you performed a frictionless authentication but you should have challenged the transaction.

Options for handling soft declines

1. Manual handling:

   • The gateway can return the soft decline code to the merchant.
   • The merchant can either treat it as a decline or manually re-send the transaction.
   • For a manual retry, include the challengeIndicator=04 field in the request.

2. Automatic retry: The gateway can automatically retry the transaction.

Retried transactions always involve a challenge flow for the customer.

Out-of-scope transactions

Certain transactions are out of scope from Strong Customer Authentication (SCA). Send these transactions directly for authorisation and the acquirer or issuer approves them. However, you must mark such transactions with the proper flags to qualify them as out of scope.