Changes from report parliamentary committee draft to plenary report

Added2. Account servicing payment service providers shall ensure that the dedicated interface referred to in Article 35(1) allows both account information service providers and payment initiation service providers to:

Added(a) identify themselves towards the account servicing payment service provider;

Added(b) instruct the account servicing payment service provider to start the authentication based on the permission of the payment service user given to the account information service provider or the payment initiation service providers in accordance with Article 49(2);

Added(c) make use, in a non-discriminatory manner, of any authentication exemptions applied by the account servicing payment service provider;

Added(d) see, prior to initiation of the payment, at least, the unique identifier of the account, the associated names or other identifiers of the account holder and the currencies and the account balance as available to the payment service user.

Added3. Account servicing payment service providers shall allow account information service providers to communicate securely, via the dedicated interface, to request and receive information on one or more designated payment accounts and associated payment transactions.

Added4. Account servicing payment service providers shall ensure that the dedicated interface allows payment initiation service providers, at a minimum, to:

Added(a) place and revoke a standing payment order or a direct debit;

Added(b) initiate a single payment;

Added(c) initiate and revoke a future dated payment;

Added(d) initiate payments to multiple beneficiaries;

Added(e) initiate payments, regardless of whether the payee is on the payer’s beneficiaries list;

Added(f) communicate securely to place a payment order from the payer's payment account and receive all information on the initiation of the payment transaction and all information accessible to the account servicing payment service provider regarding the execution of the payment transaction;

Added(g) verify the name of the account holder before the payment is initiated and regardless of whether the name of the account holder is available via the direct interface;

Added(h) initiate a payment with one single strong customer authentication, provided the payment initiation service provider has provided the account servicing payment service provider with all of the following:

Added(i) the payer’s unique identifier,

Added(ii) the payee’s legal and commercial name and ‘unique identifier’,

Added(iii) a transaction reference,

Added(iv) the payment amount and the currency of the payment, based on which the single strong customer authentication is triggered.

Added(ha) in cases where the account servicing payment service provider offers multiple authentication options, choose which authentication method is to be presented to the payer, taking into account the least cumbersome choice for the payer;

Added(hb) refuse to initiate a payment transaction on justified grounds.

Added5. Account servicing payment service providers shall ensure that the dedicated interface provides to payment initiation service providers:

Added(a) the immediate confirmation, upon request, in a simple ‘yes’ or ‘no’ format, of whether the amount necessary for the execution of a payment transaction is available on the payment account of the payer;

Added(b) the confirmation from the account servicing payment service provider as soon as possible, and not longer than 30 seconds after the authorisation by the payer that the payment has been or will be executed on the basis of the information available to the account servicing payment service provider, taking into account any pre-existing payment orders that might affect the full execution of the payment order being placed.

AddedThe information referred to in point (b) shall not be shared with the payment initiation service provider but may be used by the account servicing payment service provider in order to provide confirmation of the execution of the operation.

AddedWhere the account servicing payment service provider carries out any controls which might impact the execution of the payment, those controls shall take place prior to the confirmation of payment.

AddedData access for third parties

Added1. Without prejudice to Article 36, account servicing payment service providers shall ensure that their dedicated interface referred to in Article 35(1) offers at all times at least the same level of availability and performance, including technical and IT support, as the interfaces that account servicing payment service providers make available to the payment service user for directly accessing its payment account online.

Added2. Account servicing payment service providers shall provide account information services providers with ▐the ▐information from designated payment accounts and associated payment transactions made available to the payment service user when directly requesting access to the account information, provided that this information does not include sensitive payment data.

Added3. Account servicing payment service providers shall provide payment initiation service providers with ▐the ▐information necessary for the initiation and execution of the payment transaction provided or made available to the payment service user when the transaction is initiated directly by the payment service user. That information shall be provided immediately after receipt of the payment order and any update to that information, including to the payment status, shall be pushed to the payment initiation service provider via the dedicated interface in real-time on an ongoing basis until the payment is executed or rejected.

Added3a. In accordance with Article 16 of Regulation (EU) No 1093/2010, the EBA, while consulting the European Data Protection Board, shall develop guidelines on the implementation of this Article for payment initiation services and account information services.

AddedContingency measures for an unavailable dedicated interface

Added1. Account servicing payment service providers shall take all measures in their power to prevent unavailability and underperformance of the dedicated interface. Unavailability shall be presumed to have arisen when five consecutive requests for access to information for the provision of payment initiation services or account information services receive no response from the account servicing payment service provider’s dedicated interface within 30 seconds.

Added2. In case of unavailability of the dedicated interface, account servicing payment service providers shall inform payment service providers making use of the dedicated interface of measures taken to restore the interface and of the time estimated necessary for the problem to be resolved. During the period of unavailability, account servicing payment service providers shall offer to account information and payment initiation service providers without undue delay an effective alternative solution, such as the use of the interface that the account servicing payment service provider uses for authentication and communication with its users, to access payment account data.

Added3. Where the dedicated interface is unavailable and the account servicing payment service provider has not offered a rapid and effective alternative solution referred to in paragraph 2, payment initiation service providers or account information service providers may request their competent authority, providing all necessary information and evidence, to allow them to use the interface that the account servicing payment service provider uses for authentication and communication with its users for payment account data access.

Added4. Based on the request referred to in paragraph 3, the competent authority may for a time-limited period until the dedicated interface is restored to availability, authorise all payment initiation service providers and account information service providers to access payment accounts data via an interface that the account servicing payment service provider uses for authentication and communication with its users. The competent authority shall communicate its decision to the requesting account information service provider or payment initiation service provider and make it publicly available on its website. The competent authority shall instruct the account servicing payment service provider to restore the full functioning of the dedicated interface before the expiry of the temporary authorisation.

Added5. The competent authority shall take a decision without undue delay on any request introduced under paragraph 3. As long as the competent authority has not taken a decision on the request, the requesting payment initiation service provider or account information service provider may exceptionally access payment accounts data via an interface that the account servicing payment service provider uses for authentication and communication with its users. The requesting payment initiation service provider or account information service provider shall cease to do so when the dedicated interface is restored to availability, or when the competent authority adopts a decision not authorising such use, whichever is the sooner.

Added6. In cases where account servicing payment service providers are obliged to allow account information service providers or payment initiation service providers to access the interface that account servicing payment service providers use for authentication and communication with their users, account servicing payment service providers shall immediately make available any technical specifications needed by account information service providers or payment initiation service providers to adequately connect to the interface that the account servicing payment service provider uses for authentication and communication with its users.

Added7. When accessing the interface that the account servicing payment service provider uses for authentication and communication with its users, the account information service providers or payment initiation service providers shall meet all requirements laid down in Article 45(2). In particular, the account information service providers or payment initiation service providers shall always duly identify themselves with the account servicing payment services provider.

AddedDerogation from having a dedicated interface for data access

Added1. By way of derogation from Article 35(1), on request of an account servicing payment service provider, the competent authority may exempt the requesting account servicing payment service provider from the obligation to have in place a dedicated interface and allow the account servicing payment service provider to either offer, as interface for secure data exchange, one of the interfaces that the account servicing payment service provider uses for authentication and communication with its payment services users or, where justified, not to offer any interface at all for secure data exchange.

Added2. The EBA shall develop draft regulatory technical standards which shall specify the criteria on the basis of which, in accordance with paragraph 1, an account servicing payment service provider may be exempted from the obligation to have in place a dedicated interface and be allowed either to provide, as interface for secure data exchange with account information service providers and payment initiation service providers, the interface that it makes available to its payment user for accessing its payment accounts online or, where appropriate, not to have any interface at all for secure data exchange.

AddedThe EBA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by [ OP please insert the date= one year after the date of entry into force of this Regulation]. Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

AddedRights and obligations of account servicing payment services providers

AddedObligations on account servicing payment service providers regarding payment initiation services

AddedThe account servicing payment service provider shall perform the following actions to ensure the payer’s right to use the payment initiation service:

Added(a) communicate securely with payment initiation service providers;

Added(b) immediately after receipt of the payment order from a payment initiation service provider, provide or make available all information on the initiation of the payment transaction and all information accessible to the account servicing payment service provider regarding the execution of the payment transaction to the payment initiation service provider;

Added(c) treat payment orders transmitted through the services of a payment initiation service provider as if those payment orders were payment orders transmitted directly by the payer or the payee, in particular in terms of timing, priority or charges.

AddedFor the purposes of point (b), where some or all of the information referred to in that point is unavailable immediately after receipt of the payment order, the account servicing payment service provider shall ensure that any information, including but not limited to any payment status update, about the execution of the payment order is made available to the payment initiation service provider immediately after that information becomes available to the account servicing payment service provider.

AddedObligations of account servicing payment service providers regarding account information services

Added1. The account servicing payment service provider shall perform the following actions to ensure the payment service user’s right to use the account information service:

Added(a) communicate securely with the account information service provider;

Added(b) treat data requests transmitted through the services of an account information service provider as if the data were requested by the payment service user via the interface that the account servicing payment service provider makes available to its payment service users for directly accessing their payment account.

Added2. Account servicing payment service providers shall allow account information service providers to access information from designated payment accounts and associated payment transactions held by account servicing payment service providers for the purposes of performing the account information service whether or not the payment service user is actively requesting such information.

AddedRestriction of access to payment accounts by account information service providers and payment initiation service providers

Added1. An account servicing payment service provider may deny an account information service provider or a payment initiation service provider access to a payment account for objectively justified and duly evidenced reasons. Those reasons shall relate to unauthorised, as per Article 49(3), or fraudulent access to the payment account by that account information service provider or that payment initiation service provider, including the unauthorised or fraudulent initiation of a payment transaction. In such cases, the account servicing payment service provider shall inform the payment services user that access to the payment account is denied and provide the reasons therefor. That information shall, where possible, be provided to the payment services user before access is denied and at the latest immediately thereafter, unless providing such information would compromise objectively justified security reasons or is prohibited by other relevant Union or national law.

Added2. In the cases referred to in paragraph 1, the account servicing payment service provider shall immediately report the incident relating to the account information service provider or the payment initiation service provider to the competent authority. The information shall include the relevant details of the case and the reasons for taking action. The competent authority shall assess the case and shall, if necessary, take appropriate measures.

AddedData access management by payment service users

Added1. The account servicing payment service provider shall provide the payment service user with a dashboard, integrated into its user interface, to monitor and manage the permissions the payment service user has given for the purpose of account information services or payment initiation services covering multiple or recurrent payments.