--- title: "EBA Q&A 2019_4795 — Q&A — Validity of SCA [Final Q&A]" shortTitle: "EBA Q&A 2019_4795 — Q&A — Validity of SCA [Final Q&A]" answer_id: EBA_QA_2019_4795 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97 PSD2" date: 24 September 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4795 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 24 September 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4795" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2019_4795, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-09-24" question_submitted_on: "2019-06-19" locators: published_on: "EBA Q&A register entry 2019_4795, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2019_4795, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 24 Sep 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 24 September 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4795)* | | | |---|---| | **Full title** | EBA Q&A 2019_4795 — Q&A — Validity of SCA \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2019_4795 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 24 September 2021; question submitted 19 June 2019 | | **Legal basis** | Article 97 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Validity of SCA** ### Question If Strong customer suthentication (SCA) is required at the time of booking which is more than 90 days before the guest’s arrival, will hotels be able to process the payment at location with an expired authentication token? If not, can an SCA be renewed and who would be responsible for doing so? ### Background It appears from Regulation (EU) 2018/389 – RTS on strong customer authentication and secure communication, that SCA will only be valid for 90 days. In the hotel industry, it is not uncommon for a reservation to take place more than 90 days in advance of the guest’s arrival at the hotel, with reservations regularly being made more than a year in advance. With this type of payment, there is a specific time-frame foreseen in between booking a room and when the actual reservation takes place, to which the customer agrees in advance. *** ### Answer Article 97(1)(b) of Directive 2015/2366/EU (PSD2) prescribes that payment service providers (PSPs) shall apply strong customer authentication (SCA) where the payer initiates an electronic payment transaction. PSD2 and the Commission Delegated Regulation (EU) 2018/389 do not specify a timeframe for the validity of an SCA applied at the time when a payer initiates an electronic payment transaction. Accordingly, PSD2 and the Delegated Regulation do not restrict the possibility for SCA to be applied more than 90 days in advance of a future-dated payment transaction. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4795) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)