What is an SCA Exemption for Game Purchases?

An SCA exemption for game purchases is a regulatory condition where a payment service provider may choose not to apply Strong Customer Authentication to a qualifying transaction. These exemptions can sometimes mean fewer checkout steps for certain online game purchases, while the payment remains covered by the PSD2 regulatory framework.

These exemptions are used in cases involving game publishers who offer digital products, in-game items, subscriptions, or similar content to customers in the European Economic Area.

SCA, or Strong Customer Authentication, refers to certain requirements used during electronic payments. Following PSD2 regulations, most payment service providers generally apply SCA when processing transactions online.

Put simply, the process uses at least two out of three possible types of information taken from distinct categories. These categories are:

• Knowledge, which covers things the user knows, such as a password or PIN
• Possession, referring to objects the user holds, like a device or card
• Inherence, based on permanent traits such as a fingerprint or facial characteristic

For remote payments, the authentication process also aligns the transaction amount with the intended recipient.

PSD2 Article 97 outlines a core requirement: payment providers usually need to use Strong Customer Authentication. For specifics about conditions and exemptions, the Regulatory Technical Standards on SCA and secure communication describe the individual scenarios in more detail.

Article 97 does not provide a set list of what constitutes exceptions in terms of non-authentication; rather, the RTS lays out the scenarios that may constitute such exemptions and factors to consider.

For online game purchases, SCA exemptions detailed in the Regulatory Technical Standards (RTS) can be used if a transaction meets specific requirements. Common examples relevant to game payments include:

• Low-value transactions: remote payments that fall within defined thresholds for individual value and cumulative usage.
• Transaction risk analysis (TRA): qualifying payments identified as sufficiently low risk, subject to transaction-value and fraud-rate requirements.
• Trusted beneficiaries: when a payer places a merchant on a trusted list with their payment service provider, some future payments made to that merchant may be assessed for this exemption in accordance with regulatory rules.
• Recurring transactions: once authentication is used for an initial payment in a fixed series to the same payee for the same amount, following payments in that group may qualify as recurring exemptions.

Additional exemptions may apply to business purchases, certain contactless transactions in person, unattended transport or parking terminals, but these situations generally do not relate to game checkouts.

The low-value SCA exemption can apply when a remote electronic payment comes in at €30 or less, making it possible for a transaction to go ahead without Strong Customer Authentication in certain circumstances.

Still, transaction amount isn’t the only determining factor. The exemption also considers total value across multiple exempted payments, along with a limit on the number of times in a row that SCA hasn’t been used – think of thresholds like €100 cumulatively or five consecutive transactions since last SCA.

When those set conditions are met, transactions can proceed more easily; but after those points are reached, SCA may need to be applied again.

It is essential for the game publisher to know that even when the transaction value is, for example, €5 or €20, the use of SCA will still be required at a certain point in time if the cardholder’s recent activity hits the limits.

The technical process varies based on the payment provider, acquirer, and card-processing system in use, so each situation might look a bit different.

A merchant or acquirer sends transaction details for the exemption they want to request. The payment service provider then checks whether the necessary regulatory requirements are in place.

For card-based payments, it is often the bank that issued the payment method to the paying party that will decide whether it is possible to complete the transaction without SCA being required.

Consequently, publishers must take care not to consider all of these payments as part of a single exemption category.

Recurring payments connect with SCA in a way that depends on several conditions. For example, when there’s a series of payments where the amount and payee stay unchanged after SCA has been completed at the beginning, future payments in that sequence can fall under the RTS exemption.

Merchant-initiated recurring transactions can follow a different scope analysis if they are genuinely initiated by the merchant under a previously agreed mandate and without active payer involvement.

So overall, it makes sense to look at each type of subscription, renewal, or recurring payment individually, as regulatory guidelines and procedures can vary depending on the payment setup.