Access by AISPs when customer not present up to 4 times in a 24 hour period

Article 36(5)(b) of Commission Delegated Regulation (EU) 2018/389 states that Account Information Service Providers (AISPs) shall be able to access the payment service user’s (PSU) information “ where the payment service user does not actively request such information, no more than four times in a 24-hour period, unless a higher frequency is agreed between the account information service provider and the account servicing payment service provider, with the payment service user's consent ”. As stated in paragraph 28 of the EBA opinion on the implementation of the Commission Delegated Regulation (EU) 2018/389 (RTS on Strong customer authentication and secure communication), not being directly involved in a session means that “ the PSU was not in a session at the time of the request”, which means that the PSU was not “actively viewing the data or executing an action to refresh the data to be displayed ”. Consequently, a PSU actively requesting information is considered as in session, “ actively viewing the data or executing an action to refresh the data to be displayed. ” In addition, Article 36(1)(a) of this Delegated Regulation specifies that AISPs have access to the same data as customers would be able to access in relation to their designated payment accounts and associated payment transactions using their web interface or mobile (or tablet) app, provided that this information does not include sensitive payment data. Further, paragraph 20 of this EBA opinion states that the AISPs can access the maximum amount of data available to PSUs with regard to their payment account(s) held with a specific Account Service Payment Service Provider (ASPSP) regardless of the electronic channel (e.g. mobile application or web) used to access it. Consequently, four individual requests can be made within 24 hours. The information shared during each of the four requests may include: 1) more than one type of information and 2) all information an AISP may access in relation to a PSU’s payment account(s) information. During each request, each type of information may only be shared once and the information may be recovered either through one or several API calls depending on the design of the API and on the information sought. When applied each of the four requests may, for example, include both the account balance and associated payment transactions. This applies regardless of whether the Account Servicing Payment Services Provider (ASPSP) is offering a dedicated interface, or has adapted the customer interface, for the purpose of sharing such information.   *  The answer to this Q&A was corrected 28/11/2019 to address a processing issue that occurred during the publication.