Roqqett Blog

The Importance of Mandatory ASPSP in the Financial Sector

Explore the role, security, regulations, and future of mandatory ASPSPs in the financial sector.

Quick Summary


The advent of open banking has revolutionized the financial sector, promoting greater transparency, competition, and customer empowerment. At the heart of this transformation are Account Servicing Payment Service Providers (ASPSPs), which are primarily banks and other financial institutions that offer and maintain financial accounts with online access. ASPSPs are pivotal in enabling customers to share their account data with third-party providers (TPPs) and initiate payments on their behalf through published APIs. This article delves into the critical role of mandatory ASPSPs in the financial ecosystem, examining their security policies, regulatory requirements, implementation challenges, and the overall impact on customers and third-party providers.

Key Takeaways

  • ASPSPs are crucial to the open banking ecosystem, providing the necessary infrastructure for secure data sharing and payment initiation.
  • Strong customer authentication and transaction limits are vital security measures that ASPSPs must define and implement based on risk assessments.
  • Regulatory requirements mandate that ASPSPs provide fallback interfaces and comply with performance monitoring to ensure service continuity and reliability.
  • The implementation of mandatory ASPSPs faces challenges such as technical barriers, fraud risks, and the need for secure third-party intermediation.
  • The future of ASPSPs in the financial sector will be shaped by ongoing innovation, evolving regulatory landscapes, and emerging market trends.

Role of ASPSPs in Open Banking

Definition and Function

Account Servicing Payment Service Providers (ASPSPs) are typically banks and other similar financial institutions, such as building societies and payment companies, that offer and maintain financial accounts with online access for their customers. ASPSPs are critical components of open banking. They usually publish APIs so that customers can share their account data with TPPs, enabling them to initiate payments on their behalf.

Importance in Financial Ecosystem

Within the open banking domain, ASPSPs and third-party providers (TPPs) are strictly guided by open banking-specific regulations and other data guidelines. These regulations mandate that proper security measures and protocols are in place to protect customer data and ensure secure transactions.

APIs and Customer Data Sharing

To access payment accounts and statement details, as well as other account information held by banks and ASPSPs, traditional PSPs typically need to share and exchange certain data with those TPPs under PSD2. This ensures that ASPSPs are aware of the specific requirements with which they must comply, providing AISPs with the same information from designated payment accounts and associated payment services.

Security Policies and Risk Management

Strong Customer Authentication

Strong Customer Authentication (SCA) is a critical component in ensuring the security of financial transactions. It requires the use of two or more independent factors from the following categories: knowledge (something the user knows), possession (something the user has), and inherence (something the user is). This multi-factor authentication process significantly reduces the risk of unauthorized access and fraud.

Transaction Limits

Transaction limits are set to mitigate the risk of large-scale fraud. These limits can be applied per transaction, per day, or per month, and are often tailored to the risk profile of the customer. Implementing transaction limits helps in controlling the exposure to potential fraudulent activities.

Fraud Prevention

Fraud prevention mechanisms are essential for maintaining trust in the financial ecosystem. These mechanisms include real-time monitoring of transactions, anomaly detection systems, and customer notifications for suspicious activities. Financial institutions must also comply with regulatory requirements, such as the PSD2 security obligations, to ensure robust fraud prevention strategies.

Effective security policies and risk management are crucial for safeguarding customer data and maintaining the integrity of financial transactions.

Regulatory Requirements for ASPSPs

Fallback Interface

ASPSPs are required to provide a fallback interface to ensure continuity of service in case their primary interface fails. This is crucial for maintaining the same level of service and avoiding disruptions. Fallback interfaces must be robust and reliable to meet regulatory standards.

Exemptions and Compliance

Under the revised payment services directive (also known as PSD2), ASPSPs must comply with specific regulatory requirements. However, there are certain exemptions available. For instance, if an ASPSP can demonstrate that their dedicated interface meets the required standards, they may be exempt from providing a fallback interface. Compliance is monitored by governing authorities to ensure that ASPSPs maintain the required level of service.

Monitoring and Performance

ASPSPs are legally required to share data with TPPs under the rules of PSD2. This includes ensuring the security of data transfers and maintaining performance standards. Regular monitoring is conducted to ensure compliance with these requirements. Failure to maintain the required standards can result in penalties and loss of trust from customers and third-party providers.

Ensuring compliance with regulatory requirements is essential for ASPSPs to maintain trust and security in the financial ecosystem.

Challenges in Implementing Mandatory ASPSP

Technical Barriers

Implementing mandatory ASPSP (Account Servicing Payment Service Providers) comes with several technical barriers. Known specification issues with the latest versions of open banking specifications are detailed here. For each release, we have included a table that shows the issue and its impact. These barriers can include the need for ASPSPs to adapt to each other's interfaces and the information they include, which can vary significantly.

Fraud and Security Risks

ASPSPs must allow legitimate TPPs (Third-Party Providers) to access their accounts without any contracts or barriers. To protect their customer resources and infrastructure, ASPSPs must treat all unknown entities as potential malicious actors until they can verify the entity’s identity and validate their regulatory access. This is crucial to avoid potential threats such as denial of service (DoS), data loss, or privilege elevation. Solutions that keep the ASPSP secure while granting XS2A API access to authorized third parties are required.

Intermediation of Third Parties

In case the ASPSPs are non-compliant in their obligation to provide the adequate level of functionalities and support to the dedicated interface, it seems that the only way would be to engage in a legal battle with the ASPSPs. As most of the TPPs are fairly new and smaller companies while the ASPSPs in many cases are giants with vast resources, it is not reasonable to assume that the TPPs should file a lawsuit, or file a complaint to a governing authority, as soon as the ASPSPs are not compliant.

The ASPSP has to decide, based on its own risk assessment, which solutions it implements to ensure the authentication elements are provided independently.

Impact on Customers and Third-Party Providers

Customer Trust and Security

The introduction of the Revised Payment Service Directive (PSD2) has brought significant changes to the financial sector. Banks and customers can now benefit from third-party APIs to enhance their financial activities. However, this also means that banks must share sensitive data, such as a customer’s financial information, with third-party companies. Ensuring the security of this data is paramount to maintaining customer trust.

Encryption end to end needs to be looked at as a safe method as it removes the risk and hence the liability from the TPP, allowing a wider access to new entrants.

Access for TPPs

Third Party Providers (TPPs) must be encouraged to share any data they obtain from their sessions with Payment Service Users (PSUs) with Account Servicing Payment Service Providers (ASPSPs). This is crucial to avoid fragmentation of intelligence between several payment actors. The availability of data to a third party does not allow consumers to have a detailed understanding of what information they share and for how long.

Potential Threats and Mitigations

Compromise of third parties’ systems and processes, fraudulent third-party providers, and insider attacks of third parties cannot be excluded. Besides the risk of social engineering, risks may also result from fake certificates, outdated information in the relevant registers, centralized infrastructure, apps, and data security measures implemented by payees. Providing encrypted tokens does not affect the current customers’ experience as they can continue to transact in a safe and easy manner whilst keeping their credentials safe, in line with PSD2 (article 69.2).

Future of ASPSPs in the Financial Sector

Innovation and Development

The future of ASPSPs in the financial sector is poised for significant innovation and development. As the primary PSPs responsible for enabling access to customer accounts, ASPSPs will continue to play a crucial role in the open banking ecosystem. The next step involves a request for public input on how to further enhance these services, ensuring they meet the evolving needs of customers and third-party providers (TPPs).

Regulatory Changes

Regulatory changes will shape the future landscape of ASPSPs. These institutions must stay ahead of compliance requirements to maintain their pivotal role in the financial sector. The introduction of new regulations will necessitate continuous adaptation and improvement of their services, ensuring they remain secure and efficient.

Market Trends

Market trends indicate a growing demand for more integrated and seamless financial services. ASPSPs will need to adapt to these trends by offering more robust APIs and improving their customer data sharing capabilities. This will not only enhance customer experience but also foster greater collaboration with TPPs, driving the overall growth of the open banking ecosystem.

The future entity will take into consideration the interests of the open banking ecosystem as a whole and will maintain and develop the standards and practices necessary for its success.


The implementation of mandatory Account Servicing Payment Service Providers (ASPSPs) in the financial sector is a crucial step towards fostering a more secure, transparent, and efficient banking environment. ASPSPs, which include banks and other financial institutions, play a pivotal role in open banking by enabling customers to share their account data with third-party providers (TPPs) and initiate payments on their behalf. The responsibility of securing clients' assets and defining security policies, including strong customer authentication and transaction limits, lies with each ASPSP. Additionally, ASPSPs are required to provide fallback interfaces and ensure that legitimate TPPs can access accounts without unnecessary barriers. This regulatory framework aims to protect customer resources and infrastructure while mitigating potential threats such as fraud and unauthorized access. By investing in advanced fraud detection and prevention tools, ASPSPs contribute to maintaining trust and security in the financial sector. Overall, the mandatory inclusion of ASPSPs is essential for achieving the objectives of strong customer authentication, dynamic linking, and seamless access to account information, thereby enhancing the overall integrity and resilience of the financial ecosystem.

Frequently Asked Questions

What is an ASPSP?

An Account Servicing Payment Service Provider (ASPSP) is typically a bank or similar financial institution that offers and maintains financial accounts with online access for their customers. They are critical components of open banking, enabling customers to share their account data with Third-Party Providers (TPPs) and initiate payments.

Why is strong customer authentication important for ASPSPs?

Strong customer authentication is crucial for ASPSPs to secure their clients’ assets and ensure the integrity of financial transactions. Each ASPSP defines its security policies based on internal risk assessments, determining which transactions require strong customer authentication.

What are the regulatory requirements for ASPSPs regarding fallback interfaces?

ASPSPs are required to make a fallback interface available no later than six months after the market launch of a product or service. This requirement applies to accounts held by ASPSPs, excluding those held by small payment institutions and other specified entities.

How do ASPSPs manage fraud prevention?

ASPSPs invest in fraud detection and prevention tools to stay ahead of criminals. They use various measures, from monitoring payment cards to direct debits and credit transfers, to ensure trust and security in payment transactions.

What role do APIs play in the function of ASPSPs?

APIs are crucial for ASPSPs as they enable customers to share their account data with TPPs and initiate payments on their behalf. This data sharing is a fundamental aspect of open banking, fostering innovation and improved financial services.

What challenges do ASPSPs face in implementing mandatory requirements?

ASPSPs face several challenges, including technical barriers, fraud and security risks, and the need to manage third-party intermediation. These challenges necessitate robust security measures and compliance with regulatory standards to protect customer data and financial transactions.

Explore the Roqqett Range


Roqqett Mercury

Boost revenue and get instant settlements before shipping any orders with Roqqett Pay.


Roqqett Gemini

Boost loyalty and sales with a complete express checkout journey for your customers.

Get Roqqett

Apple AppStore CTA
Google Play Store CTA

Friction-free and Roqqett fast payments

Faster payments - increase revenue

Lower transaction fees - keep more of the money you make

Reduced fraud  - no card fraud and no chargebacks

Easier reconciliation

All with Instant Gross Settlement