Apply the PSD2 SCA corporate exemption (Article 17) for card-not-present B2B payments via lodged or virtual corporate cards

Steps

1. Confirm the payment is initiated by a legal person (business), not a consumer, through a dedicated corporate payment process such as a lodged/virtual card program or a host-to-host machine-to-machine channel.
2. Work with your acquirer/issuer to document that the dedicated process delivers security equivalent to standard SCA, since the relevant national competent authority must be satisfied of this before the exemption applies.
3. Ensure the underlying operational and security risk assessment for the corporate program explicitly covers the exemption, including a description of the service and an equivalence statement.
4. Exclude ineligible scenarios: physical corporate cards used by employees for ad hoc purchases on public consumer-facing checkout pages don't qualify — only closed-loop, access-controlled corporate travel/procurement systems do.
5. Flag qualifying transactions appropriately in the authorization message so the issuer can recognize and honor the exemption rather than triggering a 3DS challenge.
6. Monitor decline/step-up rates on these transactions and be ready to fall back to full SCA if an issuer doesn't recognize your corporate-exemption claim.