Secure corporate payment exemption
The PSD2 exemption that lets businesses pay without strong customer authentication, provided the payment runs through processes only businesses can use.
It lives in Article 17 of the EU's technical standard on strong customer authentication. It covers payers who are not consumers, paying through dedicated corporate protocols: travel agencies' central cards lodged with airlines, virtual cards generated per invoice in a procurement system, or direct host-to-host links between a company and its bank. In those setups there is often no cardholder around to tap anything in a banking app.
Being a limited company is not enough. The national competent authority has to be satisfied that the process offers at least equivalent security. As a result the exemption is used mostly by issuers with large commercial card programmes, and the card networks have their own flags in 3-D Secure to signal it.