--- title: "EBA Q&A 2019_4702 — Q&A — Transaction risk analysis (TRA) exemption – Calculation [Final Q&A]" shortTitle: "EBA Q&A 2019_4702 — Q&A — Transaction risk analysis (TRA) exemption – Calculation [Final Q&A]" answer_id: EBA_QA_2019_4702 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 98 PSD2" date: 24 July 2020 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4702 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 24 July 2020" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4702" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2019_4702, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2020-07-24" question_submitted_on: "2019-05-09" locators: published_on: "EBA Q&A register entry 2019_4702, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2019_4702, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 24 Jul 2020 [Final Q&A]** *Final Q&A · EBA Q&A register, 24 July 2020 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4702)* | | | |---|---| | **Full title** | EBA Q&A 2019_4702 — Q&A — Transaction risk analysis (TRA) exemption – Calculation \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2019_4702 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 24 July 2020; question submitted 9 May 2019 | | **Legal basis** | Article 98 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Transaction risk analysis (TRA) exemption – Calculation of fraud rate – Impact of unauthorized transactions on issuers and acquirers** ### Question In the case of card-based transactions, shall issuers include in their fraud rate calculation only the unauthorized transactions for which they apply strong customer authentication (SCA) or an exemption? Or, shall issuers also include unauthorised transactions for which the acquirer applies an exemption? Shall acquirers include in their fraud rate calculation only the unauthorised transactions for which they apply an exemption? Or shall acquirers also include unauthorised transactions for which the issuer applies an exemption? ### Background The EBA’s Opinion on the implementation of the RTS on SCA and CSC, EBA-Op-2018-04, June 2018 clarifies that Payment Service Providers (PSPs) should not only include in the calculation of their fraud rates the unauthorized transactions for which they are liable, but also those they have not prevented: “\[i\]n the case of transactions processed by more than one PSP (e.g. card transactions), the EBA would also like to clarify that the fraudulent transactions included in the calculation for a given PSP’s fraud rate should be based on (i) the unauthorised transactions for which the given PSP has borne liability, as determined in accordance with Article 74 of PSD2, and (ii) other fraudulent transactions which have not been prevented by that PSP.” (point 46, page 10). Under a literal interpretation, this would mean that unauthorized transactions would always impact the issuer’s fraud rates. This is because the issuer has the ‘final say’, i.e., it is technically able to decline transactions or to step-up and request SCA. This interpretation would, however, unduly penalize issuers that are relying on exemptions applied by acquirers. In addition, it would incentive issuers not to accept the exemptions applied by acquirers, as this would increase the issuer’s fraud rate and ultimately its ability to apply the TRA exemption. As a consequence, this interpretation would limit the possibility for both issuers and acquirers to apply exemptions. This would be contrary to the spirit and wording of PSD2 and the RTS (Article 98(1)(b) and (3) PSD2 and Recital 9 RTS). Acquirers should also exclude from their fraud rate calculation the unauthorized transactions for which the issuer applies an exemption. Otherwise, the acquirer would be penalized for an issuer’s conduct that falls outside the acquirer’s control. We therefore believe that a more sensible approach would be that unauthorized transactions should impact only the fraud rate of the PSP that applies an exemption (be it issuer or acquirer). *** ### Answer Article 19(1), second paragraph of the Commission Delegated Regulation (EU) 2018/389 provides that, for the purpose of the transaction risk analysis exemption in Article 18 of the Delegated Regulation, payment service providers (PSPs) shall calculate “the overall fraud rate for each type of transaction \[...\] as the total value of unauthorised or fraudulent remote transactions \[...\] divided by the total value of all remote transactions for the same type of transactions, whether authenticated with the application of strong customer authentication (SCA) or executed under any exemption referred to in Articles 13 to 18 on a rolling quarterly basis (90 days)”. It follows from the above that the payer’s Payment Services Provider (PSP) (the issuer) should include in the calculation of its fraud rate, all unauthorised or fraudulent remote payment transactions, which includes those transactions authenticated with the application of SCA and those where any exemption from SCA as referred to in Articles 13 to 18 of the Delegated Regulation were applied by the issuer or the PSP of the payee (the acquirer). Similarly, acquirers should include in the calculation of its fraud rate, all acquired unauthorised or fraudulent remote payment transactions, which includes those transactions authenticated with the application of SCA and those where any exemption from SCA as referred to in Articles 13 to 18 of the Delegated Regulation were applied either by the acquirer or the issuer. Q&A 2018\_4034 provides further details on the application of the transaction risk analysis exemption from SCA. Further, Q&A 2018\_4042 clarified the liability for fraud when an exemption from SCA is applied. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4702) ## Related Level 1 articles - [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)