EMV 3-D Secure (3DS) - Payment Authentication Protocol V.4: V.4 Challenge preference, challenge mandate and exemptions

The 3DS Requestor Challenge Indicator is a list of one or two values in order of preference that must not contradict each other: 01 no preference (the reading when absent), 02 no challenge requested, 03 challenge preferred, 04 challenge mandated, 05 no challenge because transaction risk analysis was done, 06 no challenge, data sharing only, 07 no challenge because strong customer authentication was already performed, 08 no challenge, use the Trust List exemption, 09 challenge with a Trust List prompt, 10 no challenge, low value exemption, 11 no challenge, secure corporate payment exemption, 12 challenge with a device binding prompt, 13 challenge requested by the issuer, 14 challenge for merchant-initiated transactions. The ACS takes it into account with its own assessment. Per protocol version, the card range data's ACS Information Indicator says what the ACS supports: 01 authentication available, 02 attempts, 03 decoupled, 04 Trust List, 05 device binding, 06 WebAuthn, 07 SPC, 08 to 11 the transaction risk analysis, Trust List, low value and secure corporate payment exemptions. The ACS reports any exemption it applied in the Transaction Challenge Exemption (05, 08, 10, 11, or 79 none) and, when the status is C or D, says in the ACS Challenge Mandated Indicator whether a local or regional mandate requires the challenge.