Open banking TPPs: the third-party providers

PSD2 names three services a third party can provide on an account it does not hold. An account information service provider, AISP, reads balances and transactions; it is covered on account information services. A payment initiation service provider, PISP, starts a payment from the account; see payment initiation service. A card-based payment instrument issuer, CBPII, asks the bank whether funds are available for a card payment it issued.

A firm may hold one role or several. The customer authenticates at their own bank, so the TPP never sees or stores the online banking credentials, as Yapily, itself a licensed TPP, explains in its guide.

A TPP needs approval from a supervisor before it touches an account. In Germany an AISP registers with BaFin, and a PISP needs a payment institution license; both appear in BaFin's register and in the EBA's central register of payment institutions, and both can passport their service across the EEA. Becoming a TPP takes a business plan, a risk assessment and compliance manuals, and the authorization brings regular reporting and audits.

At the bank's interface the TPP identifies itself with a qualified eIDAS certificate that carries its license number, its supervisor and its roles, described on PSD2 certificates. Many firms do not become TPPs at all: they build on a licensed TPP's platform or use a technical service provider, which supplies bank connections but holds no license. The regulated activity then stays with the licensed partner.

Under PSD2 a bank, the account servicing payment service provider, has to give licensed TPPs access through a dedicated interface or its customer interface, without requiring a contract with the TPP, and has to treat their requests like the customer's own. Most German banks build that interface on the Berlin Group standard. Services beyond the legal minimum can be priced under the SPAA scheme.

PSD3 and the Payment Services Regulation keep the TPP model and add duties on both sides, among them a dashboard where customers see and withdraw the access they granted. The customer's confirmation at the bank is described on strong customer authentication.

Finance Loop is the meeting place for the TPPs, the bank API teams they connect to and the supervisors and compliance staff around both, in Germany, Austria and Switzerland. It connects the finance, IT and AI communities, with events in Frankfurt, Munich, Berlin and Hamburg.

Finance Loop is a strategic partner of the Digital Euro Association, whose Digital Euro Conference in Frankfurt covers digital money infrastructure next to open banking.

TPP stands for third-party provider: a licensed firm that accesses a customer's account at another bank, with consent, to read data or initiate payments. Under PSD2 a TPP is an AISP, a PISP, a CBPII or a combination.

An AISP reads account data and cannot move money. A PISP starts a payment from the customer's account. In Germany the AISP needs a BaFin registration, the PISP a payment institution license.

No. Under PSD2 a bank must let a licensed TPP use its interface without a contract. A contract only comes in for services beyond the legal minimum, for example premium APIs under the SPAA scheme.