Transaction Risk Analysis, or TRA, is an exemption from Strong Customer Authentication under PSD2 and its successor PSD3. It lets a payment service provider skip the extra authentication step on a lower value transaction when the provider’s own real time fraud rate sits below defined thresholds. The higher the value a firm wants to exempt, the lower its fraud rate has to be, which ties the right to a smoother checkout directly to how well the provider controls fraud.
Why it matters
Every authentication step a shopper has to complete costs some conversion, so TRA is one of the main levers a merchant and its provider use to keep checkout smooth without breaking the rules. A transaction that qualifies for the exemption flows through without a challenge, which matters most for the low value, high volume payments that dominate subscription and digital commerce. The catch is that the exemption belongs to the provider’s fraud performance rather than the merchant’s wish, so it can be withdrawn as fraud rises. That makes fraud control and conversion two sides of the same number under PSD2 and PSD3.