Do account servicing payment service providers (ASPSPs) need to adhere to a 3 month notification period for all interface changes, or only for breaking interface changes, as specified in the RTS on on strong customer authentication (SCA) and secure communication (CSC) Article 30 Paragraph 4?
RTS Article 30(4) requires that any changes to the technical specification of the interface is made available in advance as soon as possible and not less than 3 months before the change is implemented. The RTS does not differentiate between minor non-breaking interface changes and breaking changes.
Article 30(3) of the Commission Delegated Regulation (EU) 2018/389 requires account servicing payment service providers (ASPSPs) to document the technical specification of their interfaces, specifying a set of routines, protocols, and tools needed by payment initiation service providers, account information service providers (AISP) and payment service providers issuing card-based payment instruments, collectively referred to as Third Party Providers (TPPs), for allowing their software and applications to interoperate with the systems of the ASPSP.
Further, Article 30(4) of the Delegated Regulation requires that ASPSPs should, “in addition to [the obligation in] paragraph 3”, make available to TPPs “any change to the technical specification of their interface” as soon as possible and not less than 3 months before the change is implemented, except for emergency situations. Article 30(4) should be read together with Article 30(3).
It follows from the above that the 3 month period in Article 30(4) applies – except for emergency situations – to any change to the technical specifications of the ASPSPs’ interfaces that affects the capability of TPPs’ software and applications to interoperate with the systems of the ASPSP or TPPs’ ability to continue offering their services via the ASPSP. In line with Article 30(4), ASPSPs should make available these changes “as soon as possible and not less than 3 months before the change is implemented”. Minor changes to the interface that do not affect TPPs’ capability to interoperate with the ASPSP’s systems, nor continue to offer their services through the ASPSP, should be made available to TPPs as soon as possible but not necessarily within the three month period before they are implemented.