Changes from plenary report to adopted text

4. Based on the request referred to in paragraph 3, the competent authority may for a time-limited period until the dedicated interface is restored to availability, authorise all payment initiation service providers and account information service providers to access payment accounts data via an interface that the account servicing payment service provider uses for authentication and communication with its users. The competent authority shall communicate its decision to the requesting account information service provider or payment initiation service provider and make it publicly available on its website. The competent authority shall instruct the account servicing payment service provider to restore the full functioning of the dedicated interface before the expiry of the temporary authorisation.

5. The competent authority shall take a decision without undue delay on any request introduced under paragraph 3. As long as the competent authority has not taken a decision on the request, the requesting payment initiation service provider or account information service provider may exceptionally access payment accounts data via an interface that the account servicing payment service provider uses for authentication and communication with its users. The requesting payment initiation service provider or account information service provider shall cease to do so when the dedicated interface is restored to availability, or when the competent authority adopts a decision not authorising such use, whichever is the sooner.

6. In cases where account servicing payment service providers are obliged to allow account information service providers or payment initiation service providers to access the interface that account servicing payment service providers use for authentication and communication with their users, account servicing payment service providers shall immediately make available any technical specifications needed by account information service providers or payment initiation service providers to adequately connect to the interface that the account servicing payment service provider uses for authentication and communication with its users.

7. When accessing the interface that the account servicing payment service provider uses for authentication and communication with its users, the account information service providers or payment initiation service providers shall meet all requirements laid down in Article 45(2). In particular, the account information service providers or payment initiation service providers shall always duly identify themselves with the account servicing payment services provider.

Derogation from having a dedicated interface for data access

1. By way of derogation from Article 35(1), on request of an account servicing payment service provider, the competent authority may exempt the requesting account servicing payment service provider from the obligation to have in place a dedicated interface and allow the account servicing payment service provider to either offer, as interface for secure data exchange, one of the interfaces that the account servicing payment service provider uses for authentication and communication with its payment services users or, where justified, not to offer any interface at all for secure data exchange.

2. The EBA shall develop draft regulatory technical standards which shall specify the criteria on the basis of which, in accordance with paragraph 1, an account servicing payment service provider may be exempted from the obligation to have in place a dedicated interface and be allowed either to provide, as interface for secure data exchange with account information service providers and payment initiation service providers, the interface that it makes available to its payment user for accessing its payment accounts online or, where appropriate, not to have any interface at all for secure data exchange.

The EBA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by [ OP please insert the date= one year after the date of entry into force of this Regulation]. Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Obligations on account servicing payment service providers regarding payment initiation services

The account servicing payment service provider shall perform the following actions to ensure the payer’s right to use the payment initiation service:

(a) communicate securely with payment initiation service providers;

(b) immediately after receipt of the payment order from a payment initiation service provider, provide or make available all information on the initiation of the payment transaction and all information accessible to the account servicing payment service provider regarding the execution of the payment transaction to the payment initiation service provider;

(c) treat payment orders transmitted through the services of a payment initiation service provider as if those payment orders were payment orders transmitted directly by the payer or the payee, in particular in terms of timing, priority or charges.

For the purposes of point (b), where some or all of the information referred to in that point is unavailable immediately after receipt of the payment order, the account servicing payment service provider shall ensure that any information, including but not limited to any payment status update, about the execution of the payment order is made available to the payment initiation service provider immediately after that information becomes available to the account servicing payment service provider.

Obligations of account servicing payment service providers regarding account information services

1. The account servicing payment service provider shall perform the following actions to ensure the payment service user’s right to use the account information service:

(a) communicate securely with the account information service provider;

(b) treat data requests transmitted through the services of an account information service provider as if the data were requested by the payment service user via the interface that the account servicing payment service provider makes available to its payment service users for directly accessing their payment account.

2. Account servicing payment service providers shall allow account information service providers to access information from designated payment accounts and associated payment transactions held by account servicing payment service providers for the purposes of performing the account information service whether or not the payment service user is actively requesting such information.

Data access management by payment service users

1. The account servicing payment service provider shall provide the payment service user with a dashboard, integrated into its user interface, to monitor and manage the permissions the payment service user has given for the purpose of account information services or payment initiation services covering multiple or recurrent payments.

2. The dashboard shall:

(a) provide the payment service user, to the extent that the information is in the possession of the account servicing payment service provider, with an overview of each ongoing permission given for the purposes of account information services or payment initiation services, including:

(i) the name of the account information service provider or payment initiation service provider to which access has been granted;

(ii) the customer account to which access has been granted;

(iii) the purpose of the permission;

(iv) the period of validity of the permission;

(v) the categories of data being shared;

(va) the dates on which the data was accessed.

(b) allow the payment service user to withdraw data access for all account information services or payment initiation service providers or for a given account information service or payment initiation service provider;

▐

(ca) allow payment services users to opt out from data sharing with third parties in a general way for all present and future data access permission requests;

(d) include a record of data access permissions that have been withdrawn or have expired, for a duration of two years;

(da) be consistent with the FIDA dashboards and allow data holders to manage data permissions stemming from both that Regulation and this Regulation through a single dashboard upon the request of the user.

2a. The EBA shall develop guidelines to specify the categories of data referred to in paragraph 2, point (a), so that the data are easily understandable for consumers.

2b. Where, pursuant to paragraph 2, point (b), a payment services user decides to withdraw data access, the account information service provider or payment initiation service provider concerned shall:

(a) no longer use the data;

(b) withdraw the data; and

(c) without undue delay erase all data received as a result of the data access permission granted by the payment services user.

3. The account servicing payment service provider shall ensure that the dashboard is easy to find in its user interface and that information displayed on the dashboard is clear, accurate and easily understandable for the payment service user.

4. The account servicing payment service provider and the account information service or payment initiation service provider to which permission has been granted shall cooperate to make information available to the payment service user via the dashboard in real-time. For the purposes of paragraph 2▐:

(a) The account servicing payment service provider shall inform the account information service or payment initiation service provider in real time of changes made to a permission concerning that provider made by a payment service user via the dashboard;

(b) An account information service or payment initiation service provider shall inform the account servicing payment service provider in real time of a new permission granted by a payment service user regarding a payment account provided by that account servicing payment service provider, including:

(i) the purpose of the permission granted by the payment service user, in a clear and comprehensible manner for the user;

(ii) the period of validity of the permission;

(iii) the categories of data concerned.