Authorisation rate in peak season: what to settle before Black Friday

Peak puts the most card value of the year through a payment set-up that stays frozen while it runs. What is not settled before Black Friday is measured until January.

For retail and ecommerce, peak runs from late October to early January, according to Adyen's peak season guidance, which also recommends no new features and no major upgrades right before it. Black Friday falls on 27 November 2026. A retailer that freezes code before peak runs it on the set-up that is live now.

What stays open after a code freeze is configuration and measurement. Exemption requests, retry rules, risk rules and terminal settings usually sit with the PSP or in its portal, not in the merchant's own release. This article covers what to settle on each of them before Black Friday, which scheme fees peak triggers, and what to measure until January, online and at the point of sale.

What one point of authorisation rate is worth in peak

Take a retailer that processes €20 million in card payments between Black Friday and the first week of January. Every percentage point of that value that is declined and not recovered is €200,000 in revenue. At a gross margin of 40%, that is €80,000 on EBITDA, from one point over six weeks. Part of the declined value comes back when the shopper pays with another card or method; the part that does not come back is the loss.

The same arithmetic applies to the set-up itself. An exemption request, a retry or a risk rule that costs a fraction of a point in September costs more in December, because the value it touches is higher. That is why the authorisation rate is the figure to settle before peak rather than after it.

Exemptions: what the TRA threshold allows, and what each request now costs

Under the regulatory technical standards on strong customer authentication, a PSP may skip SCA on a remote card payment after transaction risk analysis only while its card fraud rate stays at or below a reference rate: 0.13% for payments up to €100, 0.06% up to €250 and 0.01% up to €500. The same article requires that the real-time risk analysis finds no abnormal spending or behavioural pattern and no abnormal location of the payer, and those conditions are judged per transaction. The low-value exemption covers payments up to €30, provided that since the last SCA either the cumulative amount stays within €100 or no more than five consecutive payments have gone through without it.

A basket above the threshold your acquirer qualifies for goes to 3DS. Which exemptions your PSP requests, on which amounts and for which markets is a setting, and it is the setting with the most direct effect on how many peak orders meet a challenge.

Each request now carries a price. Since 12 October 2026 Mastercard charges the SCA exemption indicator in the EU and the UK in basis points instead of €0.02 per transaction: 5 bps domestic, 10 bps intraregional and 15 bps interregional, on approved and declined transactions alike, as set out in the Fall 2026 network update published by Braintree. On a €200 basket a domestic exemption flag costs €0.10. Before peak the question per exemption is whether it raises approval and conversion on your own traffic by more than it costs, also on the transactions the issuer declines anyway.

Retries: rules that hold in September create fees in December

A soft decline, such as insufficient funds or a temporary issuer fault, can be retried. A decline the issuer marks as do not try again cannot. Visa's own rules group decline codes into four categories: a Category 1 decline, where the issuer will never approve, may not be reattempted, and a Category 2 decline may be reattempted up to 15 times in 30 days, in Europe since 17 April 2021. Mastercard counts reattempts on the same card within 24 hours, and both schemes charge for reattempts beyond their limit and for any reattempt after a do-not-try-again response, as acquirers set out in their notices to merchants.

A retry rule is usually written once and then left alone. In peak the number of declines rises with the volume, and a rule that retries every decline, or retries at fixed intervals without reading the response code, produces those fees at peak volume. What to establish before Black Friday is which response codes your PSP retries, how often and at what interval, and whether a retry is ever sent on a do-not-try-again code.

Risk rules set on ordinary weeks

Fraud rules and velocity limits work on the traffic they were tuned on. In peak the same rules run on more orders per hour and on a different mix of orders than the one they were tuned on. An order blocked by your own risk rule shows up as a lost sale, not as an issuer decline, so it does not appear in the authorisation rate at all.

Before the freeze, the rules that block or send to manual review are set against what they did in last year's peak, where that data exists: the share of orders each rule stopped and the chargebacks it prevented. A rule that stopped many orders and few chargebacks is a cost in peak, and so is a manual review queue that cannot keep up with peak volume.

In the shop: offline acceptance, pre-authorisations and the terminal estate

At the point of sale the main risk in peak is availability. A terminal that loses its connection to the acquirer in a full shop either stops taking cards or approves offline within the limits set for it. Adyen's peak guidance names offline acceptance during network outages as a step to take before peak. Whether a terminal accepts offline, up to which amount and for which cards is a setting per terminal or per store, and a payment approved offline is sent to the issuer afterwards and can still be declined then. That setting is decided before peak, not during the first outage.

Pre-authorisations need attention in the shop and online. Since 1 October 2026 Mastercard charges in Europe on a pre-authorisation that is not cleared or fully reversed within 30 calendar days: 28 bps on amounts from €12.00 and €0.033 below, according to the same Braintree update. In peak that applies to orders authorised in full and shipped in part because an item ran out of stock, and to deposits and holds in the shop that are never released. A reversal of the unused amount in the order flow, set before the volume arrives, removes it.

The terminal estate itself is checked before the first busy Saturday: software up to date, spare terminals configured and tested, and the route to PSP support known to every store manager. For retailers that sell in both channels, the unified commerce set-up adds one more check: returns and refunds across channels after peak, refunded to the right card in the right channel.

What to measure from Black Friday to January

A single authorisation rate for the whole period says little. The useful figure is the rate by value, per day, against a baseline from September, split by scheme and issuer country, by soft and hard decline code, by 3DS outcome (frictionless, challenged and completed, challenged and abandoned) and, for retries, by the outcome of the retry. In the shop the same split per store and per terminal, plus the number of offline approvals and how many of those the issuer declined afterwards.

A drop that shows up for one issuer on one day points to an issuer or network event. A drop across issuers after a change in your own set-up points to the set-up. On the peak days themselves the rate is read per hour, because an outage of forty minutes at the PSP or at an issuer disappears in a daily average.

Costs that arrive after peak

Part of what peak costs arrives later. Chargebacks on peak orders come in over the following months. On an interchange++ invoice the scheme fees for exemption flags, uncleared pre-authorisations and excessive reattempts appear as their own lines; on blended pricing they are not shown separately. Checking those lines against the transactions behind them is what pass-through cost verification covers.

January: read peak back into the PSP relationship

Peak is the largest sample of the year of how issuers treat your transactions. Per issuer country, per decline code and per exemption, the data shows where approval was lost and where the PSP's configuration contributed to it. That is the basis for the next conversation with the PSP, on configuration first and, at renewal, on terms.

EcomStream runs that analysis and the follow-up with the PSP on the merchant's mandate, under Get more from your PSP. The payment set-up check below shows where a set-up has room before any of that starts.