Question ID:
2019_4823
Legal Act:
Directive 2015/2366/EU (PSD2)
Topic:
Strong customer authentication and common and secure communication (incl. access)
Article:
98
COM Delegated or Implementing Acts/RTS/ITS/GLs:
Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
Article/Paragraph:
Article 30 / Paragraph 4
Type of submitter:
Credit institution
Subject Matter:
3 month notification period on interface changes to ASPSPs’ interfaces
Question:

Do account servicing payment service providers (ASPSPs) need to adhere to a 3 month notification period for all interface changes, or only for breaking interface changes, as specified in the RTS on on strong customer authentication (SCA) and secure communication (CSC) Article 30 Paragraph 4?

Background on the question:

RTS Article 30(4) requires that any changes to the technical specification of the interface is made available in advance as soon as possible and not less than 3 months before the change is implemented. The RTS does not differentiate between minor non-breaking interface changes and breaking changes.

Date of submission:
09/07/2019
Published as Final Q&A:
11/10/2019
EBA Answer:

Article 30(3) of the Commission Delegated Regulation (EU) 2018/389 requires account servicing payment service providers (ASPSPs) to document the technical specification of their interfaces, specifying a set of routines, protocols, and tools needed by payment initiation service providers, account information service providers (AISP) and payment service providers issuing card-based payment instruments, collectively referred to as Third Party Providers (TPPs), for allowing their software and applications to interoperate with the systems of the ASPSP.

Further, Article 30(4) of the Delegated Regulation requires that ASPSPs should, “in addition to [the obligation in] paragraph 3”,  make available to TPPs “any change to the technical specification of their interface” as soon as possible and not less than 3 months before the change is implemented, except for emergency situations. Article 30(4) should be read together with Article 30(3).

It follows from the above that the 3 month period in Article 30(4) applies – except for emergency situations – to any change to the technical specifications of the ASPSPs’ interfaces that affects the capability of TPPs’ software and applications to interoperate with the systems of the ASPSP or TPPs’ ability to continue offering their services via the ASPSP. In line with Article 30(4), ASPSPs should make available these changes “as soon as possible and not less than 3 months before the change is implemented”. Minor changes to the interface that do not affect TPPs’ capability to interoperate with the ASPSP’s systems, nor continue to offer their services through the ASPSP, should be made available to TPPs as soon as possible but not necessarily within the three month period before they are implemented. 

Status:
Final Q&A