EBA · 2019_4823 Final Q&A

3 month notification period on interface changes to ASPSPs’ interfaces

Regulation
Directive 2015/2366/EU (PSD2)
Article
98
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Credit institution
Submitted
2019-07-09
Answered
2019-10-11
Answer provided by
ESAs (EBA, ESMA, EIOPA)

Question

Do account servicing payment service providers (ASPSPs) need to adhere to a 3 month notification period for all interface changes, or only for breaking interface changes, as specified in the RTS on on strong customer authentication (SCA) and secure communication (CSC) Article 30 Paragraph 4?

Background

RTS Article 30(4) requires that any changes to the technical specification of the interface is made available in advance as soon as possible and not less than 3 months before the change is implemented. The RTS does not differentiate between minor non-breaking interface changes and breaking changes.

Answer

Article 30(3) of the Commission Delegated Regulation (EU) 2018/389 requires account servicing payment service providers (ASPSPs) to document the technical specification of their interfaces, specifying a set of routines, protocols, and tools needed by payment initiation service providers, account information service providers (AISP) and payment service providers issuing card-based payment instruments, collectively referred to as Third Party Providers (TPPs), for allowing their software and applications to interoperate with the systems of the ASPSP. Further, Article 30(4) of the Delegated Regulation requires that ASPSPs should, “in addition to [the obligation in] paragraph 3”,  make available to TPPs “any change to the technical specification of their interface” as soon as possible and not less than 3 months before the change is implemented, except for emergency situations. Article 30(4) should be read together with Article 30(3). It follows from the above that the 3 month period in Article 30(4) applies – except for emergency situations – to any change to the technical specifications of the ASPSPs’ interfaces that affects the capability of TPPs’ software and applications to interoperate with the systems of the ASPSP or TPPs’ ability to continue offering their services via the ASPSP. In line with Article 30(4), ASPSPs should make available these changes “as soon as possible and not less than 3 months before the change is implemented”. Minor changes to the interface that do not affect TPPs’ capability to interoperate with the ASPSP’s systems, nor continue to offer their services through the ASPSP, should be made available to TPPs as soon as possible but not necessarily within the three month period before they are implemented.

Original source: European Banking Authority, Q&A ID 2019_4823

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

More Q&As on this topic

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

14-day free trial. No credit card required.