Account information services licence requirements in cases involving outsourcing or multiple parties

Q&A

Read aloud

Question:

In cases where multiple parties are involved in providing an account information service, what are the criteria that determine which of these parties are subject to the licence requirement?

Published: 12 November 2019

Answer:

The sub-questions below indicate when a licensing requirement does and does not apply if account information services are provided by collaborating parties.

Question 1:

In cases where multiple parties are involved in providing an account information service, what are the criteria that determine which of these parties are subject to the licence requirement?

Answer 1:

A licence requirement applies if a party enters into a contract or agreement with an account holder for providing an account information service.

If a licensed account information service provider outsources its retrieval of payment data from an account-servicing payment service provider to a third party, then a contract or agreement will be presumed to have been concluded with the payment service user for providing account information service via the licensed account information service provider. The same applies if this party has access to or may have access to the personal payment data of the user of the payment service, or if it has a relevant security token giving access to such data. This means that the third party is also subject to a licence requirement.

Explanatory notes

Performing a PSD2 account information service upon request consists of two key elements: 1) retrieving the payment service user's payment data from the user's account-servicing payment service provider (generally a bank); and 2) providing consolidated account information to the payment service user (or to a third party, subject to a request by the payment service user. Also see Question 3). The majority of account information service providers are engaged in activities falling under both key elements. These activities can also be performed by two different parties working in collaboration.

The licence requirement applies to both parties under certain conditions.

The party with whom the payment service user concludes an agreement or contract for account information services is designated as the party ultimately performing the payment service on behalf of the payment service user, even if this party outsources data retrieval to a third party. This party is therefore subject to a licence requirement.

If the party that retrieves the payment data on behalf of a licensed account information service provider has access to the personal payment data of the user of the payment service, or if it has a relevant security token giving access to such data, then this party is also subject to a licence requirement. This is because this party concludes a contract or agreement for the provision of account information via the licensed account information service provider. A party may only retrieve payment details autonomously if a contract or agreement has been concluded with the payment service user. The rules that apply to access to current accounts are a core element of PSD2, which is why this party is individually subject to a licence requirement.

Question 2:

May an account information service provider outsource the retrieval of payment details from a bank to an unlicensed party?

Answer 2:

The answer is yes, but only if the party retrieving the data has no access to the account holder's personal payment details or a security token providing such access. This party only provides the link to the API of the account-servicing payment service provider. It merely transmits the data of the account-servicing payment service provider to the account information service provider. A party such as this has no autonomous access to the current account. It provides a service of a purely technical nature. In this case, the account information service provider is subject to the relevant outsourcing rules pursuant to the Financial Supervision Act. These rules include provisions applying to the account information service provider or the payment initiation service provider with regard to the security of sensitive payment data. The provisions of the General Data Protection Regulation also apply to the account information service provider and the technical service provider.

Question 3:

Is an account information service provider required to be the only processor of retrieved payment data, or may a third, unlicensed party engage in such processing?

Answer 3:

Under certain circumstances, a third, unlicensed party may engage in the actual processing of the retrieved payment data.

The law defines an account information service as an online service for providing consolidated information on one or more current accounts held by a payment service user with one or more other payment service providers . Data is considered to be consolidated account information if the original information is retrieved from one or more current accounts by the account information service provider from the account-servicing payment service provider for a specific period of time. The account information (consisting of more-or-less raw data) can be provided to the payment service user, who may also provide the account information service provider with consent in accordance with the GDPR to transmit the information to a third party.

The legal definition of account information service does not specify the recipient of consolidated account information 1 .

This third party may engage in the actual processing (categorisation etc.) of retrieved payment data. In this case, the third party will fall outside the scope of PSD2 and will not be subject to a licence requirement. However, the payment service user must have concluded a contract or agreement for account information services with the other account information service provider that retrieves relatively 'raw’ data for a specific period of time at the request of the payment service user.

Footnotes

[1] Also see EBA Q&A 4098 Clarification on whether a particular business model type constitutes the provision of an account information service as defined by Article 4 (16) of PSD2 .

Discover related articles

Q&A

Payment services

Banks

Payment institutions

Share:

Share on LinkedIn

Share on X

Share on Facebook

Share via Email

Interesting articles

Prudential rules do not hinder bank financing for EU priorities

17 July 2026

News item supervision

Europe faces historic investment challenges, in which banks will play an important financing role. Prudential requirements strengthen banks’ resilience, without posing a major obstacle to their financing. Unlocking more private finance requires better risk-sharing and deeper financial integration.

Read more Prudential rules do not hinder bank financing for EU priorities

News item supervision

17 July 2026

DNB Inhouse Day for the Dutch banking sector: financial crime supervision

16 July 2026

News item supervision

Following last year’s successful event, De Nederlandsche Bank (DNB) will again host an Inhouse Day for AML/CFT professionals in the Dutch banking sector. The event is designed to encourage dialogue and provide further insight into DNB’s AML/CFT supervision.

Read more DNB Inhouse Day for the Dutch banking sector: financial crime supervision

News item supervision

16 July 2026

Fine for ABN AMRO Bank N.V. for inadequate customer due diligence for high-risk customers

09 July 2026

Enforcement measures

De Nederlandsche Bank (DNB) imposed an administrative fine of €8.5 million on ABN AMRO Bank N.V. (ABN AMRO) on 6 July 2026 due to serious shortcomings in its anti-money laundering controls in the period from September 2023 through September 2024.

Read more Fine for ABN AMRO Bank N.V. for inadequate customer due diligence for high-risk customers

Enforcement measures

09 July 2026

De Nederlandsche Bank publishes ‘Integrity Supervision in Focus 2026’

25 June 2026

News item supervision

In the third edition of ‘Integrity Supervision in Focus’ (ISF), we share the key insights from our integrity supervision.

Read more De Nederlandsche Bank publishes ‘Integrity Supervision in Focus 2026’

News item supervision

25 June 2026

Necessary cookies

To ensure the proper operation of the website, De Nederlandsche Bank (DNB) uses functional cookies and analytics cookies, and has taken measures to ensure that these cookies have little or no impact on the privacy of website users.

Optional cookies

Some pages include embedded content from external websites. These websites may use proprietary (tracking) cookies. This allows third parties to track visitor statistics, show personalised content and display targeted ads, for example.

You can make your choice about allowing these optional cookies both when you first visit the website and when you navigate to a page with embedded content.