{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-09-24","gaps":[],"covered":["EBA Q&A 2019_4796 — Q&A — Intermediaries and Merchant-ID [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4796-intermediaries-and-merchant-id","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4796-intermediaries-and-merchant-id","title":"EBA Q&A 2019_4796 — Q&A — Intermediaries and Merchant-ID [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4796-intermediaries-and-merchant-id","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 24 September 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4796","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"6148bf38927c5101","change_date":null,"nearest_versions":["2021-09-24"],"first_text_date":null,"correction_applies":false,"versions":["2021-09-24"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4796-intermediaries-and-merchant-id/versions/2021-09-24","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4796-intermediaries-and-merchant-id/versions/2021-09-24/rev/6148bf38927c5101","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4796-intermediaries-and-merchant-id/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4796-intermediaries-and-merchant-id/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 24 Sep 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-09-24","question_submitted_on":"2019-06-19","locators":{"published_on":"EBA Q&A register entry 2019_4796, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4796, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4796","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4796-intermediaries-and-merchant-id.md","body_sha256":"f98a381c1d7369afaa6c7c9b3d4f8ebbb09bb1824dce2dd999609889316fe4ad"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4796 — Q&A — Intermediaries and Merchant-ID [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4796 — Q&A — Intermediaries and Merchant-ID [Final Q&A]\"\nanswer_id: EBA_QA_2019_4796\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 24 September 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4796\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 24 September 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4796\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2019_4796, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-09-24\"\n  question_submitted_on: \"2019-06-19\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4796, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4796, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 24 Sep 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 24 September 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4796)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4796 — Q&A — Intermediaries and Merchant-ID \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4796 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 24 September 2021; question submitted 19 June 2019 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Intermediaries and Merchant-ID**\n\n### Question\n\nIn the hotel industry, given that when a customer reserves a room, a payment is often not taken at this time, should an entity (intermediary, online travel agent or brand/hotel group) that collects payment details from a customer also facilitate strong customer authentication (SCA), regardless of when or by whom the actual payment transaction may be processed? If yes, should the customer be explicitly informed of the entities involved in order for their consent to be valid?\n\n### Background\n\nIn the hotel industry, there is a high degree of intermediation between the hotel (merchant) and guest (customer) through Online Travel Agents (OTAs such as Booking.com), franchisor booking channels (such as hotelbrand.com, or global distribution systems (such as Sabre). These intermediaries play a key role in our booking infrastructure. In some cases, intermediaries will take credit card details on the hotel's behalf, but they do not have the facilities, nor do they bear the risk for concluding payments – this instead remains in the hands of the individual hotels.\n\n***\n\n### Answer\n\nArticle 97(1)(b) of Directive 2015/2366/EU (PSD2) prescribes that payment service providers (PSPs) shall apply strong customer authentication (SCA) where the payer initiates an electronic payment transaction. Article 97(2) of PSD2 provides that for electronic remote payment transactions, PSPs shall apply SCA that includes elements which dynamically link the transaction to a specific amount and a specific payee.\n\nArticle 5(1)(a) of the Commission Delegated Regulation (EU) 2018/389 states that where PSPs apply SCA in accordance with Article 97(2) of PSD2, ‘the payer is made aware of the amount of the payment transaction and of the payee’.\n\nAccordingly, the payment service user should be aware of the payee (the hotel in the case described by the submitter). PSD2 and the Delegated Regulation do not specify how the interaction between the payee and parties (the intermediaries in the case described by the submitter) acting on its behalf should take place.\n\nFinally, the payer’s consent to execute a payment transaction shall be given in accordance with the requirements of PSD2, including Article 64(2) which specifies that the payer's consent to execute a payment transaction shall be given to the PSP, or via the payee or a payment initiation service provider.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4796)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}