EBA · 2018_4339 Rejected question

90 Day Access via Direct Access

Regulation
Directive 2015/2366/EU (PSD2)
Article
98
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Other
Submitted
2018-10-24
Browse PSD2 Register → More Q&As on this regulation →

Question

Should any solution which involves direct access, whether as a strategic solution to PSD2, or in relation to the obligation to provide a fallback interface, ensure that Account Information Service Providers (AISPs) can access the interface in the same manner as the dedicated interface, specifically on an ongoing basis and for a maximum of 90 days once the customer has provided consent and authenticated using strong customer authentication (SCA)?

Background

All the Application Programming Interface (API) standards being developed to support the RTS on strong customer authentication and secure communication dedicated interfaces support AISPs gaining access to account information for 90 days a time. Some Account Servicing Payment Service Providers (ASPSPs) seem to think they can avoid this obligation when access "direct access" rather than via a dedicated interface.
No answer published yet.

Original source: European Banking Authority, Q&A ID 2018_4339

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Eligibility of communication by AISPs with ASPSP throughout two access interfaces in parallel

Answered 2024-03-22

Access by AISPs when customer not present up to 4 times in a 24 hour period

Answered 2018-12-21

Application of the exemption under Article 10 RTS and EBICS T

Answered 2022-04-13

Application of SCA when a PSU accesses payment transactions data older than on the last 90 days, without having access to sensitive payment data and for a period of 90 days after the last access using SCA

Answered 2018-11-09

Change of TPP access rights for AIS consent by the PSU prior to authorisation

Answered 2022-10-14

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.