Trusted beneficiaries
The strong customer authentication exemption that lets payers put a payee on an allowlist held by their own bank.
The exemption sits in Article 13 of the PSD2 technical standard. The payer adds a payee, such as a landlord or a shop they use regularly, and has to authenticate strongly at that moment. After that, the bank may wave through payments to the same payee without asking again. The list lives with the payer's bank or card issuer, never with the merchant. A merchant can ask to be added, and 3-D Secure 2.2 gained a field for exactly that request, but the decision is the customer's.
Banks aren't obliged to offer it, and plenty never built it. Those that did are often reluctant to apply it, since the bank carries the fraud liability when it does. An allowlist is also exactly what the people behind APP fraud want their victims to add them to.