- Question ID
-
2019_4823
- Legal act
- Directive 2015/2366/EU (PSD2)
- Topic
- Strong customer authentication and common and secure communication (incl. access)
- Article
-
98
- COM Delegated or Implementing Acts/RTS/ITS/GLs/Recommendations
- Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
- Article/Paragraph
-
Article 30 / Paragraph 4
- Type of submitter
-
Credit institution
- Subject matter
-
3 month notification period on interface changes to ASPSPs’ interfaces
- Question
-
Do account servicing payment service providers (ASPSPs) need to adhere to a 3 month notification period for all interface changes, or only for breaking interface changes, as specified in the RTS on on strong customer authentication (SCA) and secure communication (CSC) Article 30 Paragraph 4?
- Background on the question
-
RTS Article 30(4) requires that any changes to the technical specification of the interface is made available in advance as soon as possible and not less than 3 months before the change is implemented. The RTS does not differentiate between minor non-breaking interface changes and breaking changes.
- Submission date
- Final publishing date
-
- Final answer
-
Article 30(3) of the Commission Delegated Regulation (EU) 2018/389 requires account servicing payment service providers (ASPSPs) to document the technical specification of their interfaces, specifying a set of routines, protocols, and tools needed by payment initiation service providers, account information service providers (AISP) and payment service providers issuing card-based payment instruments, collectively referred to as Third Party Providers (TPPs), for allowing their software and applications to interoperate with the systems of the ASPSP.
Further, Article 30(4) of the Delegated Regulation requires that ASPSPs should, “in addition to [the obligation in] paragraph 3”, make available to TPPs “any change to the technical specification of their interface” as soon as possible and not less than 3 months before the change is implemented, except for emergency situations. Article 30(4) should be read together with Article 30(3).
It follows from the above that the 3 month period in Article 30(4) applies – except for emergency situations – to any change to the technical specifications of the ASPSPs’ interfaces that affects the capability of TPPs’ software and applications to interoperate with the systems of the ASPSP or TPPs’ ability to continue offering their services via the ASPSP. In line with Article 30(4), ASPSPs should make available these changes “as soon as possible and not less than 3 months before the change is implemented”. Minor changes to the interface that do not affect TPPs’ capability to interoperate with the ASPSP’s systems, nor continue to offer their services through the ASPSP, should be made available to TPPs as soon as possible but not necessarily within the three month period before they are implemented.
- Status
-
Final Q&A
- Answer prepared by
-
Answer prepared by the EBA.
Disclaimer
The Q&A refers to the provisions in force on the day of their publication. The EBA does not systematically review published Q&As following the amendment of legislative acts. Users of the Q&A tool should therefore check the date of publication of the Q&A and whether the provisions referred to in the answer remain the same.