<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-11-05","gaps":[],"covered":["EBA Q&A 2019_4797 — Q&A — Merchant IDs and SCA [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4797-merchant-ids-and-sca","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4797-merchant-ids-and-sca","title":"EBA Q&A 2019_4797 — Q&A — Merchant IDs and SCA [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4797-merchant-ids-and-sca","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 5 November 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4797","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"1a394180defdcdca","change_date":null,"nearest_versions":["2021-11-05"],"first_text_date":null,"correction_applies":false,"versions":["2021-11-05"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4797-merchant-ids-and-sca/versions/2021-11-05","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4797-merchant-ids-and-sca/versions/2021-11-05/rev/1a394180defdcdca","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4797-merchant-ids-and-sca/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4797-merchant-ids-and-sca/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 5 Nov 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-11-05","question_submitted_on":"2019-06-19","locators":{"published_on":"EBA Q&A register entry 2019_4797, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4797, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2019_4797 — Q&A — Merchant IDs and SCA [Final Q&A]"
shortTitle: "EBA Q&A 2019_4797 — Q&A — Merchant IDs and SCA [Final Q&A]"
answer_id: EBA_QA_2019_4797
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 97 PSD2"
date: 5 November 2021
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4797
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 5 November 2021"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4797"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2019_4797, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2021-11-05"
  question_submitted_on: "2019-06-19"
  locators:
    published_on: "EBA Q&A register entry 2019_4797, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2019_4797, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 5 Nov 2021 [Final Q&A]**

*Final Q&A · EBA Q&A register, 5 November 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4797)*

| | |
|---|---|
| **Full title** | EBA Q&A 2019_4797 — Q&A — Merchant IDs and SCA \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2019_4797 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 5 November 2021; question submitted 19 June 2019 |
| **Legal basis** | Article 97 PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Merchant IDs and SCA**

### Question

In the situation where Strong Consumer Authentication (SCA) was completed at the time of completing a hotel booking by an Online Travel Agent (OTA) or hotelbrand.com under their Merchant ID but the actual payment will take place at the time of arrival: will the SCA authentication token remain valid for the hotel (merchant) making the charges and its respective Merchant ID?

### Background

In the hotel industry, there is a high degree of intermediation between the hotel (merchant) and guest (customer) through Online Travel Agents (OTAs such as Booking.com), franchisor booking channels (such as hotelbrand.com, or global distribution systems (such as Sabre). At the same time, these channels may have a diversity of Merchant-IDs (MIDs) different than that of the hotel.

***

### Answer

Article 97(1)(b) of Directive 2015/2366/EU (PSD2) prescribes that payment service providers (PSPs) shall apply strong customer authentication (SCA) where the payer initiates an electronic payment transaction.

Q&A 2019\_4795 clarified that ‘PSD2 and the Delegated Regulation (EU) 2018/389 do not specify a timeframe for the validity of SCA applied at the time when a payer initiates an electronic payment transaction’.

Accordingly, the SCA applied at the time of the booking shall allow the future-dated payment transaction to be executed.

Article 97(2) of PSD2 states that for electronic remote payment transactions, PSPs shall apply SCA that includes elements which dynamically link the transaction to a specific amount and a specific payee.

Article 5(1)(a) and (c) of the Commission Delegated Regulation (EU) 2018/389 states that where PSPs apply SCA in accordance with Article 97(2) of PSD2, ‘the payer is made aware of the amount of the payment transaction and of the payee’ and ‘the authentication code accepted by the payment service provider corresponds to the original specific amount of the payment transaction and to the identity of the payee agreed to by the payer’.

Accordingly, the payment information displayed to the payer during the authentication shall include the payee (the hotel in the case described by the submitter). The authentication code shall be specific to the same payee, agreed to by the payer. If the payee and the specific amount do not change, the authentication code shall remain valid.

PSD2 and the Delegated Regulation do not require the payer to be made aware of third parties that are different from the payee, including intermediaries acting on behalf of the payee.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4797)

## Related Level 1 articles

- [Article 97 — Authentication](../../../articles/97.md)