Authentication wins the exemption debate

For years, merchants have leaned on Strong Customer Authentication (SCA) exemptions to keep checkout smooth and reduce friction.

But the rules are changing. Regulators are tightening standards, schemes are adding new fees and issuers are rewarding transactions that carry stronger authentication.

The old habit of placing exemptions in authorization now comes with higher costs and lower approvals. The choice merchants face is simple: Stick with what’s familiar or embrace 3DS as the smarter way forward. The impact isn’t theoretical – it shows up in fraud rates, approval percentages and revenue.

Regulators and schemes raise the bar

Banque de France requires all exemptions on French-issued cards to run through 3DS. Mastercard now applies a 2p fee for exemptions placed directly in authorization. Visa has recently increased its fees and now charges 7.5 basis points when neither 3DS nor a Network Payment Token (NPT) is used.

These changes are designed to shift merchant behavior. And with good reason: Worldpay data shows exemptions in 3DS reduce fraud by almost one basis point compared to authorization. Approval rates also rise by more than 3%. Issuers see less risk and say yes more often.

Mark Dobinson, partnerships director at Visa, put it plainly: “Reducing fraud benefits the entire ecosystem – merchants, issuers and consumers. By using 3DS, merchants not only meet regulatory expectations but also give issuers greater confidence to approve more transactions.”

Why merchants still lean on authorization

Despite these incentives, most exemptions processed through Worldpay today are still placed in authorization. That behavior is rooted in the early days of PSD2:

• In 2020, most issuers didn’t support exemptions in 3DS because they lacked 3DS 2.2.0. That version is now mandated and widely adopted.
• Many merchants still believe exemptions in authorization cost less. With Visa and Mastercard fees in play, the opposite is often true.

Issuer behavior adds complexity

Not all issuers respond the same way. Some strongly prefer exemptions in 3DS, others lean toward authorization. Differences exist across countries – and even among banks in the same market. That inconsistency makes it impossible for merchants to set a single rule and expect consistent results.

Smarter tools for merchants

This is where Worldpay adds value. Our processing scale gives us unmatched visibility into issuer behavior. Since 2020, our Exemption Engine has used that intelligence to predict the best path for each transaction. It adapts dynamically – steering exemptions into 3DS or authorization depending on what delivers the best chance of approval.

For merchants ready to go further, our 3DS API provides direct access to authentication. It allows you to verify customers’ identities and reduce fraud, meet Strong Customer Authentication (SCA) requirements under PSD2 and shift liability for fraudulent transactions to the issuer.

Why authentication matters beyond compliance

Authentication is no longer just a regulatory checkbox. By providing issuers with stronger assurance, 3DS reduces false declines and helps merchants capture more genuine transactions. It also strengthens chargeback defense thanks to liability shift, ensuring that fraudulent losses are absorbed by issuers rather than merchants.

"3DS reduces false declines and helps merchants capture more genuine transactions."

When paired with biometric options, authentication can even support smoother checkout experiences for customers. Just as importantly, 3DS positions merchants to stay ahead of the regulatory changes that continue to shape payments across Europe and beyond.

The bottom line

Exemptions are no longer neutral. Merchants who continue to rely on authorization risk higher fees, more fraud and lower approvals. Those who shift exemptions into 3DS see stronger issuer support and better performance across the board.

With Worldpay’s Exemption Engine and 3DS API, merchants can stop guessing, adapt in real time and keep revenue flowing.