Q&A on PSD2 Services 7 and 8 for Banks Authorizing Third Parties

Q&A

Read aloud

Question 1:

If an account holder authorises through their bank a third party such as an accounting firm to initiate payments, does such a service qualify as PSD2 service 7? In providing such services, is the bank allowed to use the API developed for use under the PSD2?

Published: 16 July 2019

Answer 1:

No, if an account holder requests their bank to authorise a third party such as an accounting firm to initiate payments through a dedicated channel, this does not qualify as service 7. This is because PSD2 service 7 involves an account holder requesting a third party to initiate a payment from their bank account on their behalf. There is no need for the account holder to request their bank to authorise the third party. The bank may use a dedicated technical link if an account holder requests their bank to authorize a third party to initiate paymenst. But it is also allowed to use the API developed for use under the PSD2 for that aim.

Again, the regular requirements for sound and ethical operational management obviously apply, and the bank must safeguard a secure connection with the third party. Unlike activities requiring a licence under PSD2 service 7, a bank itself must weigh the interests involved in considering whether it wishes to provide these services to third parties that are not subject to a licence requirement.

Question 2:

If a bank's customers requests their bank to share their payment data with a third party such as an accounting firm, do such services qualify as activities requiring a licence under PSD2 service 8? In providing such services, is the bank allowed to use the API developed for use under the PSD2?

Answer 2:

No, sharing payment data with a third party at the request of a bank's customer does not qualify as service 8. This is because account information services subject to a licence requirement referred to as PSD2 service 8 involve an account holder requesting a third party to retrieve and process data from their bank on their behalf without the account holder informing the bank about this or instructing it to do so. Such third parties must be licensed as payment institutions by DNB.

The bank may choose its own method of communicating with the third party to share the payment data at the customer's request. It may use a dedicated technical link for that aim under its own responsibility. But it is also allowed to use the API developed for use under the PSD2.

The regular requirements for sound and ethical operational management apply, which is why the bank must safeguard a secure connection with the third party. Unlike activities requiring a licence under PSD2 service 8, a bank itself must weigh the interests involved in considering whether it wishes to provide these services to third parties that are not subject to a licence requirement.

Discover related articles

Q&A

Payment services

Banks

Electronic money institutions

Exchange transaction

Payment institutions

Share:

Share on LinkedIn

Share on X

Share on Facebook

Share via Email

Interesting articles

Fine for CCV Group B.V. for lack of SIRA

21 July 2026

Enforcement measures

De Nederlandsche Bank (DNB) discloses its decision of 9 July 2020 to impose an administrative fine on CCV Group B.V. (CCV). DNB also discloses its decisions on CCV’s objection of 13 April 2022 and CCV’s subsequent appeal and higher appeal.

Read more Fine for CCV Group B.V. for lack of SIRA

Enforcement measures

21 July 2026

Prudential rules do not hinder bank financing for EU priorities

17 July 2026

News item supervision

Europe faces historic investment challenges, in which banks will play an important financing role. Prudential requirements strengthen banks’ resilience, without posing a major obstacle to their financing. Unlocking more private finance requires better risk-sharing and deeper financial integration.

Read more Prudential rules do not hinder bank financing for EU priorities

News item supervision

17 July 2026

DNB Inhouse Day for the Dutch banking sector: financial crime supervision

16 July 2026

News item supervision

Following last year’s successful event, De Nederlandsche Bank (DNB) will again host an Inhouse Day for AML/CFT professionals in the Dutch banking sector. The event is designed to encourage dialogue and provide further insight into DNB’s AML/CFT supervision.

Read more DNB Inhouse Day for the Dutch banking sector: financial crime supervision

News item supervision

16 July 2026

Administrative fine imposed on CCV for inadequate customer due diligence

13 July 2026

Enforcement measures

De Nederlandsche Bank (DNB) imposed an administrative fine of €2.65 million on payment institution CCV Netherlands B.V. (CCV). We have imposed the fine because CCV failed to adequately and continuously monitor transactions.

Read more Administrative fine imposed on CCV for inadequate customer due diligence

Enforcement measures

13 July 2026

Necessary cookies

To ensure the proper operation of the website, De Nederlandsche Bank (DNB) uses functional cookies and analytics cookies, and has taken measures to ensure that these cookies have little or no impact on the privacy of website users.

Optional cookies

Some pages include embedded content from external websites. These websites may use proprietary (tracking) cookies. This allows third parties to track visitor statistics, show personalised content and display targeted ads, for example.

You can make your choice about allowing these optional cookies both when you first visit the website and when you navigate to a page with embedded content.