← Payment Reference GuidesOpen Banking Reference
Open Banking & PSD2 Flows
How regulated third parties access bank accounts and initiate payments on a customer's behalf — the PSD2 roles, the consent and SCA flows, the FAPI security profile, and the regional API standards (UK Open Banking, Berlin Group, STET) that implement them.
The PSD2 actors
| Acronym | Role | What it does |
|---|---|---|
| ASPSP | Account Servicing PSP | The bank or PSP that holds the customer's account and exposes the regulated APIs. |
| TPP | Third-Party Provider | The regulated company accessing the account — an umbrella term for AISP/PISP/CBPII. |
| AISP | Account Information SP | Licensed to read account data with consent (aggregators, accounting, lending). |
| PISP | Payment Initiation SP | Licensed to initiate payments from the customer's account. |
| CBPII | Card-Based PII | Issues card instruments and asks the ASPSP to confirm available funds. |
| PSU | Payment Service User | The end customer (cardholder / account holder) granting consent. |
| NCA | National Competent Authority | The regulator (e.g. FCA in the UK, BaFin in Germany) that licenses TPPs. |
| QTSP | Qualified Trust SP | Issues the eIDAS certificates (QWAC / QSeal) TPPs use to identify themselves. |
eIDAS certificates
Under PSD2 a TPP proves its identity and licence to the ASPSP using eIDAS certificates that embed the TPP's authorisation number and roles:
- QWAC (Qualified Website Authentication Certificate) — used for mutual TLS between the TPP and the ASPSP, securing the transport channel.
- QSealC (Qualified Electronic Seal Certificate) — used to sign messages at the application layer, giving non-repudiation independent of the transport.
Next steps
ToolIBAN ValidatorValidate IBANs against the SWIFT IBAN Registry (89 countries): length, BBAN structure and MOD 97-10 check digits; extracts country, check digits and BBAN.Open the tool ToolVerification of Payee SimulatorPlay the Responding PSP in the EPC Verification Of Payee scheme: payee name + IBAN versus the name on file → MTCH / CMTC / NMTC / NOAP, with every normalisation and similarity step explained.Open the tool ToolISO 20022 ValidatorValidate pain.001, pacs.008, pacs.002, pacs.004 returns, camt.053 and camt.054: mandatory elements, data types, IBAN/BIC, totals, return reasons and statement balances, plus CBPR+ and SEPA rules.Open the tool FlowOpen banking consent and payment flowsSee the animated message flow, step by step, between every party involved.Watch the flow
Related articles
Authentication3D Secure (EMV 3DS)Authentication flows, message types, ECI values, SCA exemptionsRead article IdentityEUDI Wallet & PaymentseIDAS 2.0 deadlines, the SD-JWT VC / mdoc / OID4VP stack, wallet-based PSD2 SCARead article Card RailsSettlement & ClearingClearing files, net settlement, dispute timelines, interchange economicsRead article Crypto Railsx402 Payment ProtocolHTTP 402 as a payment rail: quote/sign/verify/settle, PAYMENT-* headers, EIP-3009Read article