EBA · 2019_4795 Final Q&A

Validity of SCA

Regulation
Directive 2015/2366/EU (PSD2)
Article
97
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Industry association
Submitted
2019-06-19
Answered
2021-09-24
Answer provided by
ESAs (EBA, ESMA, EIOPA)
Browse PSD2 Register → More Q&As on this regulation →

Question

If  Strong customer suthentication (SCA) is required at the time of booking which is more than 90 days before the guest’s arrival, will hotels be able to process the payment at location with an expired authentication token? If not, can an SCA be renewed and who would be responsible for doing so?

Background

It appears from Regulation (EU) 2018/389 – RTS on strong customer authentication and secure communication, that SCA will only be valid for 90 days. In the hotel industry, it is not uncommon for a reservation to take place more than 90 days in advance of the guest’s arrival at the hotel, with reservations regularly being made more than a year in advance. With this type of payment, there is a specific time-frame foreseen in between booking a room and when the actual reservation takes place, to which the customer agrees in advance.

Answer

Article 97(1)(b) of Directive 2015/2366/EU (PSD2) prescribes that payment service providers (PSPs) shall apply strong customer authentication (SCA) where the payer initiates an electronic payment transaction. PSD2 and the Commission Delegated Regulation (EU) 2018/389 do not specify a timeframe for the validity of an SCA applied at the time when a payer initiates an electronic payment transaction. Accordingly, PSD2 and the Delegated Regulation do not restrict the possibility for SCA to be applied more than 90 days in advance of a future-dated payment transaction.

Original source: European Banking Authority, Q&A ID 2019_4795

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Merchant IDs and SCA

Answered 2021-11-05

Processing payments for hotel reservations

Answered 2021-03-12

Revocation / Invalidation of SCA proof before execution date

Answered 2021-12-17

Application of SCA when a PSU accesses payment transactions data older than on the last 90 days, without having access to sensitive payment data and for a period of 90 days after the last access using SCA

Answered 2018-11-09

Use of new technology for SCA

Answered 2021-04-23

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.