INTRODUCTION

In Lessons 3.1–3.6, we built the maximum security stack—mandatory SCA, dynamic linking, and mTLS for every request. However, PSD2’s Strong Customer Authentication (SCA), while cryptographically robust, introduces significant user friction. Requiring a hardware token or biometric scan for every €5 coffee purchase would cripple the payment ecosystem and drive users back to cash.

To balance security and usability, the EBA’s RTS on SCA (Articles 10–18) introduces a set of SCA Exemptions. These are not “loopholes”; they are mathematically defined risk thresholds where the probability of fraud is statistically negligible compared to the cost of authentication friction.

The ASPSP must implement a Risk-Based Authentication (RBA) engine. This is a real‑time, probabilistic decision model that evaluates the transaction’s risk score based on historical data, device fingerprinting, and behavioral biometrics. If the risk score falls below a defined threshold, the ASPSP may downgrade the authentication requirement (e.g., requiring only a single factor or no SCA at all).

This lesson formalizes the mathematics of RBA. We derive the Bayesian Risk Score (P(Fraud | Features)), analyze the Receiver Operating Characteristic (ROC) curve to optimize the False Positive Rate (FPR) vs. False Negative Rate (FNR), and calculate the Expected Cost Function to determine the optimal SCA threshold. We will also decompose the latency budget of the RBA engine, proving that even with 15 distinct risk signals, the total computation time stays under 5ms—well within the 850ms UK p95 SLA.

---

LEARNING OBJECTIVES

1. Categorize the PSD2 SCA Exemptions Algebraically—defining the six exemption types (Low‑Value, Trusted Beneficiaries, Recurring, Corporate, Contactless, and Transaction Risk Analysis) as logical predicates E(x) ∈ {True, False} based on transaction features.

2. Derive the Bayesian Risk Score—constructing the conditional probability P(Fraud | D, V, A, G) where D is device fingerprint entropy, V is transaction velocity, A is amount, and G is geolocation, and proving the posterior is proportional to the prior times the likelihood ratio.

3. Calculate the Optimal SCA Threshold—using the Cost‑Sensitive Decision Theory formula: Minimize E[Cost] = P(Fraud) × L_FN + (1 - P(Fraud)) × L_FP, and deriving the threshold where the marginal cost of a false negative equals the marginal cost of a false positive.

4. Quantify the RBA Engine Latency—decomposing the end‑to‑end latency of a risk evaluation (feature extraction, model inference, and rule checking) using Big‑O notation, and proving that a Random Forest or XGBoost inference is O(depth * trees) and executes in under 2ms on commodity hardware.

5. Design the Exemption Cascade Logic—formalizing the decision tree that first checks hard exemptions (Low‑Value, Trusted Beneficiary) before invoking the expensive RBA model, ensuring that 80% of transactions bypass the risk engine entirely.

---

PART 1: THE PSD2 EXEMPTION TAXONOMY — Set Theory and Predicate Logic

The RTS on SCA defines six explicit exemptions. We model each as a function E_i(x) that returns True if the transaction qualifies for an exemption.

Let x = {Amount, Payee_ID, Frequency, Device_ID, PSU_History, Corporate_Flag}.

Set Membership: If Amount ≤ 30 and Cumulative_Amount ≤ 100, the transaction is exempt from SCA regardless of other signals. This is a hard‑coded rule, not a machine learning decision. The ASPSP evaluates these hard exemptions first.

---

PART 2: THE BAYESIAN RISK SCORE — The Conditional Probability of Fraud

If hard exemptions do not apply, the ASPSP invokes the RBA model. Let F be the event that the transaction is fraudulent. Let X be the vector of features (device entropy, velocity, amount, geolocation). The RBA engine computes:

P(F | X) = P(Fraud | Device, Velocity, Amount, Geo)

Using Bayes’ Theorem:

P(F | X) = [P(X | F) × P(F)] / P(X)

Where:

• P(F) is the base fraud rate (typically 0.1% for online banking).

• P(X | F) is the likelihood of observing feature vector X given a fraudulent transaction.

• P(X) is the marginal probability of observing X.

The Odds Formulation (Logistic Regression):
To avoid floating‑point underflow, the industry standard is the log‑odds formulation:

Log_Odds = ln(P(F|X) / (1 - P(F|X))) = β₀ + β₁·Amount + β₂·Velocity + β₃·Device_Entropy + β₄·Geo_Distance + ...

The probability is then:
P(F|X) = 1 / (1 + e^(-Log_Odds)).

The coefficients β are trained offline using historical fraud data.

Example Calculation:

• Amount = €500 (high), Velocity = 3 transactions in 10 mins (unusual), Device_Entropy = 0.9 (high entropy, likely a VM).

• The logistic regression outputs Log_Odds = 2.5.

• P(Fraud | X) = 1 / (1 + e^(-2.5)) = 1 / (1 + 0.082) = 0.924 (92.4%).

• The ASPSP will require SCA because the probability exceeds the threshold α.

---

PART 3: THE OPTIMAL SCA THRESHOLD — Minimizing Expected Cost

The ASPSP must choose a threshold α. If P(F|X) ≥ α, block or force SCA. If P(F|X) < α, allow the exemption.

The Cost Function:
Let C_FN be the cost of a False Negative (fraud occurs because SCA was skipped). Let C_FP be the cost of a False Positive (SCA is required for a legitimate user, causing friction and potential basket abandonment).

The expected cost for a given threshold α is:
E[Cost(α)] = P(Fraud) × P(Score < α | Fraud) × C_FN + (1 - P(Fraud)) × P(Score ≥ α | Legit) × C_FP

To minimize E[Cost], we set the derivative with respect to α to zero. The optimal threshold occurs when the marginal cost of the two errors is equal:

C_FN × P(Score | Fraud) = C_FP × P(Score | Legit)

Rearranging yields the optimal decision boundary:

Threshold = (C_FN / C_FP) × (P(Fraud) / (1 - P(Fraud)))

If C_FN (cost of fraud) is massive (e.g., €10,000), and C_FP (cost of friction) is small (e.g., €0.50), the threshold shifts left—meaning the ASPSP requires SCA for even low‑risk transactions, because the potential loss dwarfs the user friction. In practice, EBA guidance suggests α = 0.01 (1%) as a good equilibrium for most retail banking scenarios.

---

PART 4: LATENCY BUDGET OF THE RBA ENGINE

The RBA engine must not become the bottleneck. The total evaluation time is the sum of:

1. Feature Extraction: Computing velocity, geolocation distance, device entropy (database lookups).

   • Complexity: O(1) DB queries. Latency: 2ms (Redis pipeline).

2. Model Inference: Evaluating the logistic regression / XGBoost model.

   • XGBoost Complexity: O(Depth × Trees). For 100 trees, depth 6, this is 600 operations.

   • Latency: 1.5ms (CPU‑based inference).

3. Rule Cascade: Checking the hard exemptions before the model.

   • Latency: 0.5ms (in‑memory).

Total RBA Evaluation Latency (p95) = 2ms + 1.5ms + 0.5ms = 4ms.
This is far below the 50ms threshold for a “fast” API call, confirming that RBA is computationally lightweight.

---

CLOSING — THE ECONOMICS OF SECURITY

SCA Exemptions and RBA represent the ultimate economic optimization of security. By mathematically balancing the cost of friction against the probability of fraud, the ASPSP maximizes the TPP’s conversion rate while maintaining regulatory compliance.

If the ASPSP sets the threshold too low (too much SCA), users abandon the transaction—reducing revenue. If the threshold is too high (too little SCA), fraud rates increase—eroding PSU trust and incurring regulatory fines. The certified practitioner must continuously monitor the ROC curve and adjust the β coefficients and α threshold to adapt to evolving fraud patterns.

Transition to Lesson 3.8: We have now built every single component of the Authentication and Consent pipeline—OAuth, FAPI, Consent Lifecycle, mTLS, Introspection, RBA, and Exemptions. In Lesson 3.8, the Module 3 Capstone, we will assemble these components into a single, end‑to‑end security flow, calculate the Total Attack Surface Probability, and provide the official security audit evidence required by regulators.