Transaction risk analysis (TRA)
PSD2's most-used exemption from strong customer authentication — available to anyone who can prove their fraud rate is low.
The regulatory technical standards for SCA (Delegated Regulation (EU) 2018/389, Article 18) let a payment provider skip the two-factor step when real-time analysis rates a purchase as low-risk. The ceiling depends on the provider's own fraud rate: for remote card payments it is €100 at no more than 0.13%, €250 at 0.06% and €500 at 0.01%.
Either the acquirer or the issuer may request the exemption, but whoever asks for it also eats the loss if the purchase turns out to be fraud. The design turns fraud rates into a competitive edge: the fewer frauds you let through, the fewer checkouts where the customer has to go hunting for their phone.