In accordance with Article 18 of the Commission Delegated Regulation (EU) 2018/389 [RTS on Strong customer authentication and secure communication] “payment service providers shall be allowed not to apply strong customer authentication where the payer initiates a remote electronic payment transaction identified by the payment service provider as posing a low level of risk”. Table 2 (on page 9) of the EBA Opinion on the implementation of the RTS on Strong customer authentication and secure communication clarifies that either the payer’s or the payee’s payment service providers (PSP) may apply the transaction risk analysis exemption, taking into account the consequences of the requirements for liability for unauthorised payment transactions under Article 74(2) of PSD2. Only the payer’s and payee’s PSP may make a decision of whether or not to apply the exemption and the payer’s and payee’s PSPs apply this exemption based on their own fraud rate. Table 2 of this EBA Opinion also specifies that in the specific case of card payments, the payer’s PSP always makes the ultimate decision on whether or not to accept or apply an exemption.

In the event that the payer’s or payee’s PSP have contractual arrangements with other entities, whether or not authorised or registered by a financial regulator, this remains the
decision of the payer’s or payee’s PSP whether to apply an exemption and the reference fraud rate remains the fraud rate of the payer’s or payee’s PSP respectively.