Account Servicing Payment Service Provider (ASPSP)

An account servicing payment service provider (ASPSP) is a payment service provider that provides and maintains a payment account for a customer. In practice it is the bank, building society, electronic money institution or payment institution where the customer's current account, e-money account or other payment account is held. The term comes from European payments law and is used mainly in the context of open banking.

The concept was defined by the second Payment Services Directive, PSD2, which requires ASPSPs to let regulated third parties, with the customer's consent, read account data and start payments. The third parties are the account information service provider (AISP), the payment initiation service provider (PISP) and the card-based payment instrument issuer. The same terminology was kept in UK law after Brexit and is supervised there by the Financial Conduct Authority.

PSD2 was adopted in 2015 and applied from January 2018. It defines the ASPSP and sets out its access duties in separate articles for payment initiation, account information and confirmation of available funds. Detailed technical rules sit in the regulatory technical standards on strong customer authentication and common and secure communication, a Commission Delegated Regulation that applied from September 2019. These standards say how the ASPSP must identify third parties, authenticate customers and exchange data securely. The European Banking Authority issues guidelines and opinions on how the rules should be read, and national authorities supervise each ASPSP.

• Provide an access interface. The ASPSP must offer at least one interface through which authorised third parties can communicate with it securely. Most do this with a dedicated interface built on APIs, though the law also allows an adapted version of the customer-facing website.
• Treat third-party requests fairly. Payment orders sent through a PISP must be handled without discrimination compared with those the customer sends directly, in terms of timing, priority and charges.
• Apply strong customer authentication. The ASPSP authenticates its own customer, and third parties may rely on the procedures the ASPSP provides.
• Answer funds checks. On request from a card-based payment instrument issuer with consent, the ASPSP must give a yes or no funds confirmation.
• No contract required. Third parties do not need a contract with the ASPSP; being authorised or registered is enough.

An ASPSP that relies on a dedicated interface must, unless exempted by its national authority, keep a fallback mechanism so that third parties can still reach accounts, for example through the online banking site, if the dedicated interface fails. To win an exemption, the ASPSP has to show that its interface meets the same availability and performance standards as its own customer channels, has been tested by the market and is widely used. ASPSPs publish statistics on uptime and response times, and support third parties with sandbox test environments and technical documentation for their open banking APIs.

An ASPSP may refuse a third party access to an account only for objectively justified and duly evidenced reasons linked to unauthorised or fraudulent access. When it does so it must normally tell the customer and report the incident to its competent authority, which reviews the decision. It cannot block access simply because it competes with the third party or dislikes its business model. It also cannot require the customer to give it additional consent beyond that given to the third party, nor ask the third party to register separately for each bank.

The ASPSP sits at the centre of the open banking chain. Every account information API call and every bank payment started by a fintech ends at an ASPSP, so the quality of its interface strongly shapes the customer experience. In the UK, the Competition and Markets Authority required the nine largest current account providers to build common standards, which pushed the market ahead faster than in much of the EU. Elsewhere, ASPSPs choose among competing specifications, which leaves third parties to deal with differences or rely on aggregators.

European reforms proposed by the European Commission in 2023, a revised directive and a new Payment Services Regulation, aim to tighten interface performance rules, introduce permission dashboards for customers and reduce barriers that ASPSPs place in the way of third-party service providers. Critics among banks argue that they bear the cost of building and running these interfaces without being able to charge for basic access, while fintech firms say uneven ASPSP implementation is still the main obstacle to wider use of open banking.

• European Banking Authority