Unattended terminals and Transaction Risk Analysis (TRA) exemption and related Payment Service Providers (PSP)’s liabilities rules

Provided that both the payer’s Payment Service Provider (PSP) and the payee’s PSP can apply the strong customer authentication (SCA) exemption, without prejudice to the last say of the payer’s PSP, can a payment made at highway toll booths be treated as the one performed at the unattended terminals for transport fares?

According to point 40 of the EBA Opinion, it is clear that the possibility of using the TRA exemption is attributed not only to the payer’s PSP (issuer) but also to the payee’s PSP (acquirer). In addition, the table 2 of the same point and the asterisk note "The payer’s PSP always makes the ultimate decision on whether or not to accept or apply an exemption; the payer’s PSP may wish to revert to applying SCA to execute the transaction if technically feasible or decline the initiation of the transaction." confirm this reading. Moreover, this general principle is stated in the liability rules set out in Article 74.2 of the PSD2, where it is written that "Where the payee or the payment service provider of the payee fails to accept strong customer authentication, it shall refund the financial damage caused to the payer’s payment service provider.".However, the same wording was not maintained at point 39 of the EBA Opinion, creating doubts about the above mentioned possibility. Stating that, both the payer’s PSP (issuer) and the payee’s PSP (acquirer), each for their own sphere of competence, can apply the SCA exemption without prejudice to the fact that the payer’s PSP has the ultimate decision, results in the four following choices available to the payer’s PSP: a) accept the exemption applied by the payee’s PSP, or b) apply the exemption if the payee’s PSP does not apply it, or c) revert to SCA, if the payee’s PSP has applied the exemption, or d) reject the exempted transaction. In particular, this should be applied especially with regard to those payment transactions that are carried out at unattended terminals for transport and parking, where the payer’s PSP cannot enter into the merits of the exemption. In this case it is the payee’s PSP (and not the payer’s PSP) who attributes to the merchant the category of 'transport' and of 'parking', thus allowing the payee to take advantage of the exemption. If the unattended terminal is offline, the payer's PSP can never choose decisions b) or c) above, but can only accept the exemption applied by the payee's PSP – decision a) - in order to support the general public interest for operational (e.g. to avoid queues and potential accidents at toll booths) or for security reasons (e.g. the risk of shoulder surfing). Moreover, in this regard, it should be noted that the RTS on SCA & CSC (the final draft dated 23rd February 2017) at the Recital 8 considers relevant this type of exemptions by stating that "It is also appropriate to establish an exemption for the case of electronic payment transactions initiated at unattended terminals where the use of strong customer authentication may not always be desirable due to operational reasons (e.g. to avoid queues and potential accidents at toll gates) or safety or security risks (for instance the risk of shoulder surfing).