--- title: "EBA Q&A 2018_4127 — Q&A — Application of Transaction Risk Analysis (TRA) exemption [Final Q&A]" shortTitle: "EBA Q&A 2018_4127 — Q&A — Application of Transaction Risk Analysis (TRA) exemption [Final Q&A]" answer_id: EBA_QA_2018_4127 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 98 PSD2" date: 7 June 2019 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4127 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 7 June 2019" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4127" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2018_4127, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2019-06-07" question_submitted_on: "2018-07-17" locators: published_on: "EBA Q&A register entry 2018_4127, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2018_4127, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 7 Jun 2019 [Final Q&A]** *Final Q&A · EBA Q&A register, 7 June 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4127)* | | | |---|---| | **Full title** | EBA Q&A 2018_4127 — Q&A — Application of Transaction Risk Analysis (TRA) exemption \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2018_4127 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 7 June 2019; question submitted 17 July 2018 | | **Legal basis** | Article 98 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Application of Transaction Risk Analysis (TRA) exemption – Real time risk analysis / monitoring** ### Question Is it acceptable if a payment service provider (PSP) looking to apply the TRA exemption makes a best effort using the information available to them to identify that none of the six individual factors mentioned in Article 18(2)(c) of the Commission Delegated Regulation 2018/389 are applicable, but does not have to actually identify non-applicability of all of these factors to be able to use the TRA exemption? ### Background A PSP looking to trigger the TRA exemption is required, in addition to other considerations, to conduct real time risk analysis and to not identify any of the six risk factors listed at Article 18(2)(c). It is not clear if a PSP looking to trigger the TRA exemption is required to take pro-active steps to identify all of these factors, or only those for which the PSP has information available to do so. While it is envisaged both payer and payee PSPs will be able to trigger the TRA exemption, these PSPs have varied access to the information required to perform real time risk analysis against each of the six individual factors. As an example, a gateway provider used by the payee may not provide relevant information to the PSPs looking to apply the TRA exemption. This leads to an uneven playing field, where some PSPs cannot apply the TRA exemption in the same way as the other PSPs given their limited view of the transaction environment and related information. *** ### Answer Article 18(2)(c) of the Commission Delegated Regulation (EU) 2018/389 requires payment service providers (PSPs) not to have identified any of six specified factors as a result of performing a real time risk analysis. The identification is performed by the PSP using the transaction risk analysis tool. Recital 14 of the Delegated Regulation states that effective and risk-based requirements “should combine the scores of the risk analysis, confirming that no abnormal spending or behavioural pattern of the payer has been identified, taking into account other risk factors including information on the location of the payer and of the payee with monetary thresholds based on fraud rates calculated for remote payments”. The PSP, in the context of the exemption, is expected to check, as far as it possibly can, whether all the six specified factors are present given that those factors are considered together with the conditions set out under Article 18(2) (a) and (b) of the Delegated Regulation, in order to identify whether or not a payment transaction is low risk for the purpose of the exemption. To enable the PSP to undertake this real time analysis to the greatest extent possible, it should consider requesting information from another PSP in the payment chain. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4127) ## Related Level 1 articles - [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)