Implement a PSD2 payment initiation with a trusted beneficiary SCA exemption for recurring business payments

Steps

1. Check that the target ASPSP supports the Trusted Beneficiary (whitelisting) SCA exemption; not all ASPSPs implement optional exemptions — review the ASPSP's developer documentation or Berlin Group compliance profile
2. On first payment to a new beneficiary, initiate a standard PIS payment with full SCA; at the authentication step, present the user with an option to add this payee to their trusted beneficiaries list (whitelist) at the ASPSP
3. If the ASPSP supports whitelist registration via API, send the beneficiary account details with the exemption_indicator field set to TRUSTED_BENEFICIARY in the payment initiation request; the ASPSP may require a separate whitelist-registration step before the first payment
4. On subsequent payments to the same beneficiary, include the exemption type TRUSTED_BENEFICIARY in your SCA exemption claim in the payment initiation request body; the ASPSP will skip SCA if the beneficiary is on the user's whitelist
5. Handle exemption refusal: the ASPSP may decline the exemption and respond with a 401 SCA-required status; implement fallback to a full SCA redirect in this case without surfacing a confusing error to the user
6. Maintain a local record of beneficiaries for which trusted-beneficiary status has been confirmed so you can optimise future payment flows; do not assume whitelist status persists indefinitely — users can remove entries from their whitelist at the ASPSP