EBA · 2025_7604 Rejected question

Obstacle assessment of requiring multiple manual checkboxes for a single AIS consent

Regulation
Directive 2015/2366/EU (PSD2)
Article
Article: 98, para. Paragraph: 1
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Other
Submitted
2025-10-17
Browse PSD2 Register → More Q&As on this regulation →

Question

Does the practice of an ASPSP requiring a PSU to manually tick multiple, separate checkboxes for different categories of account data in order to grant a single consent for an Account Information Service (AIS) constitute an obstacle under Article 32(3) of the RTS, by adding unnecessary steps and friction to the user journey?

Background

Article 32(3) of the RTS prohibits the creation of obstacles. Paragraph 15 of the EBA Opinion on obstacles (EBA/OP/2020/10) specifies that the authentication journey should not create "unnecessary friction or add unnecessary steps". When a PSU provides consent to an Account Information Service Provider (AISP) for access to their payment account information, this is typically a single, holistic act of consent for the scope of the AISP's service. However, some ASPSPs, during the redirection journey, present the PSU with a consent screen that breaks this single consent down into multiple, separate checkboxes. The PSU is then required to manually tick each box (e.g., one for 'account details', another for 'account balance', and a third for 'transaction history') to proceed. This practice creates confusion, as the PSU has already provided their consent to the AISP. It also adds several manual steps to the process. It is unclear if this design pattern, which dissects a single user intent into multiple required actions, is compliant with the RTS.
No answer published yet.

Original source: European Banking Authority, Q&A ID 2025_7604

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Change of TPP access rights for AIS consent by the PSU prior to authorisation

Answered 2022-10-14

Authentication process of the PSU with the ASPSP in a combined AIS and PIS journey in a redirection approach

Answered 2025-10-03

Account Data required by a ASPSP to execute a payment order via a PISP

Answered 2021-03-05

Obstacle to the provision of payment initiation and account information services

Answered 2021-04-23

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.