<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2018-10-26","gaps":[],"covered":["EBA Q&A 2018_4035 — Q&A — Criteria for the application of the transaction risk [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4035-criteria-for-the-application-of-the-transaction-risk","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4035-criteria-for-the-application-of-the-transaction-risk","title":"EBA Q&A 2018_4035 — Q&A — Criteria for the application of the transaction risk [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4035-criteria-for-the-application-of-the-transaction-risk","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 26 October 2018","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4035","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"375ebbcbff59943f","change_date":null,"nearest_versions":["2018-10-26"],"first_text_date":null,"correction_applies":false,"versions":["2018-10-26"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4035-criteria-for-the-application-of-the-transaction-risk/versions/2018-10-26","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4035-criteria-for-the-application-of-the-transaction-risk/versions/2018-10-26/rev/375ebbcbff59943f","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4035-criteria-for-the-application-of-the-transaction-risk/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4035-criteria-for-the-application-of-the-transaction-risk/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 26 Oct 2018 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2018-10-26","question_submitted_on":"2018-06-28","locators":{"published_on":"EBA Q&A register entry 2018_4035, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4035, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2018_4035 — Q&A — Criteria for the application of the transaction risk [Final Q&A]"
shortTitle: "EBA Q&A 2018_4035 — Q&A — Criteria for the application of the transaction risk [Final Q&A]"
answer_id: EBA_QA_2018_4035
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 97 PSD2"
date: 26 October 2018
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4035
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 26 October 2018"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4035"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2018_4035, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2018-10-26"
  question_submitted_on: "2018-06-28"
  locators:
    published_on: "EBA Q&A register entry 2018_4035, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2018_4035, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 26 Oct 2018 [Final Q&A]**

*Final Q&A · EBA Q&A register, 26 October 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4035)*

| | |
|---|---|
| **Full title** | EBA Q&A 2018_4035 — Q&A — Criteria for the application of the transaction risk \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2018_4035 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 26 October 2018; question submitted 28 June 2018 |
| **Legal basis** | Article 97 PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Criteria for the application of the transaction risk analysis (TRA) exemption – Application of the TRA exemption by authorized PSPs other than the issuer and the acquirer**

### Question

May an authorized PSP other than the issuer and acquirer apply the TRA exemption on the basis of its own fraud rate and risk analysis?

### Background

The RTS allow PSPs to apply the TRA exemption. In the case of card transactions, this generically means that both issuers and acquirers are allowed to apply the TRA exemption. Card payments may involve other authorized PSPs in addition to the issuer and the acquirer. These can be, for example, wallet providers, gateways, or an acquirer’s subsidiary that is a separate legal entity from the parent acquirer and provides its acquiring services under its own PSD2 authorization.

We believe that any authorized PSP that is involved in a card transaction should be allowed to apply the TRA exemption on the basis of its own fraud rates and risk analysis.

***

### Answer

In accordance with Article 18 of the Commission Delegated Regulation (EU) 2018/389 \[RTS on Strong customer authentication and secure communication\] “payment service providers shall be allowed not to apply strong customer authentication where the payer initiates a remote electronic payment transaction identified by the payment service provider as posing a low level of risk”. Table 2 (on page 9) of the EBA Opinion on the implementation of the RTS on Strong customer authentication and secure communication clarifies that either the payer’s or the payee’s payment service providers (PSP) may apply the transaction risk analysis exemption, taking into account the consequences of the requirements for liability for unauthorised payment transactions under Article 74(2) of PSD2. Only the payer’s and payee’s PSP may make a decision of whether or not to apply the exemption and the payer’s and payee’s PSPs apply this exemption based on their own fraud rate. Table 2 of this EBA Opinion also specifies that in the specific case of card payments, the payer’s PSP always makes the ultimate decision on whether or not to accept or apply an exemption.

In the event that the payer’s or payee’s PSP have contractual arrangements with other entities, whether or not authorised or registered by a financial regulator, this remains the

decision of the payer’s or payee’s PSP whether to apply an exemption and the reference fraud rate remains the fraud rate of the payer’s or payee’s PSP respectively.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4035)

## Related Level 1 articles

- [Article 97 — Authentication](../../../articles/97.md)