All Small Payments Without 3DS? How SCA Exemptions Really Work

In this article:

• Low-value exemption applies to payments up to €30, but the issuer also tracks a cumulative client limit — €100 or five payments without 3DS.
• An issuer decline of the exemption is not a declined payment — it's a command to run a full 3DS challenge, and the final approval depends on how the checkout is set up to handle that.
• Many industries don't use LVE because don’t know about it or their risks are much higher than average.

Today, we will address a critical topic for many industries operating in the European Union: Low-Value Exemption (LVE) for card processing. On paper, it is one of the simplest exceptions to Strong Customer Authentication (SCA); in practice, it is among the most misunderstood. EU regulation under PSD2 strictly mandates full identity verification and explicit payment confirmation via 3D Secure (3DS). However, the framework includes practical exemptions designed to streamline checkout for low-risk, small-value transactions — avoiding unnecessary friction where it isn't required.

Merchants often treat the Low-Value Exemption as a blanket rule: if an order is under €30, 3DS isn't required, end of story. The reality is far more nuanced. Beneath that single threshold lies a mechanism with several built-in traps that directly impact both conversion rates and liability for fraudulent transactions.

This piece of payments guide from Monoup breaks down what LVE actually means, why it was created, and how to use it effectively.

What Is Low-Value Exemption and Why Does It Matter?

Under PSD2, Low-Value Exemption is one of five valid grounds for bypassing mandatory SCA, alongside Transaction Risk Analysis (TRA), whitelisting, recurring payments, and corporate exemptions. Simply put, if a payment meets specific criteria, it can skip full 3DS authentication (such as entering a one-time passcode) because its low monetary value classifies it as low risk.

To qualify, an individual transaction cannot exceed €30. Additionally, it must comply with cumulative caps: either the total amount of exempted transactions since the cardholder's last successful SCA cannot exceed €100, or the number of consecutive exempted payments cannot exceed five. These limits function on an “OR” basis — if a cardholder reaches either threshold, transaction loses eligibility. If more than five exempted payments have occurred, if cumulative exempted spend crosses €100, or if the current single charge is over €30, LVE cannot be applied.

This is where merchants frequently stumble: they overlook the fact that this counter is tracked centrally by the card issuer across all of the customer's spending, not independently on a per-merchant basis. The issuer’s counter tallies exempted transactions across every merchant the cardholder has bought from since their last 3DS authentication. If a customer bought a €5 coffee this morning at a different venue under LVE, and comes to your platform an hour later to purchase €20 in digital goods, that coffee purchase has already consumed part of their available limit.

Since individual merchants cannot know customer’s external purchase history or cross-merchant activity, they only ever see their own siloed transaction data. The issuing bank, however, has full visibility over the card’s complete history. Still, merchants can leverage this mechanism to deliver a frictionless experience for eligible segments — provided they understand the roles of each actor in the chain.

In practice, some merchants build mathematical models attempting to predict whether LVE will apply to a given transaction. Due to asymmetric data, these predictive efforts generally do not perform. The goal for a merchant or PSP is not to guess the issuer’s internal decision, but rather to format and route the exemption request correctly based on known data (i.e., the single transaction amount).

Crucially, LVE is not a “free pass” for businesses selling low-ticket items; it represents a deliberate shift in liability. While bypassing the 3DS challenge optimizes conversion, the merchant absorbs the full financial risk. In the event of a fraud dispute, the merchant bears the burden of explaining why the transaction skipped two-factor authentication, waiving their primary defense in chargeback claims. When requesting LVE or TRA, a merchant actively trades risk for conversion: 3DS is bypassed, but fraud liability lands entirely on the seller.

Alternatively, an issuing bank may independently route a payment through a Frictionless Flow based on its own risk assessment. If bank chooses not to present a 3DS challenge to a trusted customer on its own accord, the liability shift remains in favor of the merchant. This represents the ideal scenario for merchant: customer skips OTP entry (maximizing conversion) while the transaction remains fully protected against fraud chargebacks by the issuing bank.

Rock-solid proof of customer consent requires a full 3DS challenge involving active confirmation (via SMS OTP or biometric approval). Simplified flows exist, but choosing them always comes down to a strategic tradeoff between checkout convenience and risk management.

As a result, many digital merchants avoid LVE altogether, as high chargeback exposure and varied user demographics could turn the feature into a direct threat to margins. For many verticals, obtaining active payment authorization is paramount; furthermore, acquirers and card networks frequently restrict exemption capabilities for high-risk merchant categories entirely.

Alongside LVE, some merchants leverage Transaction Risk Analysis (TRA) exemptions, which accommodate much higher transaction caps — up to €500. However, TRA requires maintaining a proven, ultra-low fraud rate across rolling 90-day windows. For merchants with low average order values (AOV) and modest risk infrastructure, LVE remains the simpler route, whereas high-volume merchants with elevated AOVs benefit more from TRA. Visa Europe estimates that 40–50% of e-commerce transactions by volume are theoretically eligible for an exemption, yet adoption of LVE remains limited in practice due to issuer opacity and fraud concerns.

Structuring the Exemption Workflow

Because the issuing bank ultimately determines whether an SCA exemption is accepted, declines may occur. However, a decline in this context is rarely a hard refusal of the transaction itself — a distinction many merchants misinterpret.

The Soft Decline mechanism was engineered specifically for this scenario. When an issuer rejects an exemption request, it returns a specific response code indicating that full authentication is required, rather than declaring the payment invalid. The merchant or PSP must recognize this soft decline code and automatically trigger a step-up request presenting a standard 3DS challenge (OTP or biometrics).

This step represents a major operational vulnerability where approval rate is frequently lost. While an issuer soft decline is expected behavior, a merchant's checkout engine or PSP setup may fail to parse soft decline codes properly. Without an automated retry mechanism, the decline is treated as a final failure, ending the customer journey prematurely even though the payment could have been completed upon authentication.

Therefore, the primary objective is not fine-tuning the initial LVE request parameters, but rather building a resilient workflow around the issuer's response. Systems must reliably detect soft declines as standard operational events and automatically present the 3DS challenge without dropping the user from the checkout session.

Conversion performance is decided at this handling layer, rather than at the initial exemption selection phase. Consequently, measuring performance should focus on post-facto metrics — such as the authorization rate of requested exemptions and recovery success on soft-decline retries — rather than attempting to forecast frictionless ratios for sub-€30 transactions in advance.

Businesses with AOVs well below €30 (common across many online categories) can rely heavily on LVE as a core strategy. However, the decision must be aligned with the brand's risk profile: for low-risk businesses, it is almost always a favorable tradeoff; for edge cases with elevated fraud metrics, it requires deliberate calculation rather than automatic application across all eligible orders. Otherwise, disputed transactions can scale rapidly. Digital merchants face a higher burden of proof than physical goods, as fulfilment and usage are regularly contested by issuers — an issue unaffected by whether LVE was granted.

For high-risk verticals, access to LVE and simplified authentication flows is generally restricted for clear reasons: high volumes, frequent velocity, and significant chargeback exposure negate the benefits of skipping SCA. Nevertheless, for standard e commerce, LVE offers a compliant mechanism to eliminate friction, foster customer loyalty, and lift conversion rates.

Ultimately, this portion of European regulation grants merchants a tool to manage friction where customer drop-off is highest. Mandatory two-factor authentication inherently depresses baseline approval ratio due to input errors, page load failures, or 3DS server timeouts. While processing charges without extra steps is a common goal, the cost of Low-Value Exemption is full fraud liability. Where fraud levels are low, well-monitored, and mitigated by advanced fraud tools, LVE delivers clear performance gains. Where fraud exposure is higher, the downside risk can quickly outweigh the approval rate upside.