← Payment Reference GuidesOpen Banking Reference
Open Banking & PSD2 Flows
How regulated third parties access bank accounts and initiate payments on a customer's behalf — the PSD2 roles, the consent and SCA flows, the FAPI security profile, and the regional API standards (UK Open Banking, Berlin Group, STET) that implement them.
The PSD2 actors
| Acronym | Role | What it does |
|---|---|---|
| ASPSP | Account Servicing PSP | The bank or PSP that holds the customer's account and exposes the regulated APIs. |
| TPP | Third-Party Provider | The regulated company accessing the account — an umbrella term for AISP/PISP/CBPII. |
| AISP | Account Information SP | Licensed to read account data with consent (aggregators, accounting, lending). |
| PISP | Payment Initiation SP | Licensed to initiate payments from the customer's account. |
| CBPII | Card-Based PII | Issues card instruments and asks the ASPSP to confirm available funds. |
| PSU | Payment Service User | The end customer (cardholder / account holder) granting consent. |
| NCA | National Competent Authority | The regulator (e.g. FCA in the UK, BaFin in Germany) that licenses TPPs. |
| QTSP | Qualified Trust SP | Issues the eIDAS certificates (QWAC / QSeal) TPPs use to identify themselves. |
eIDAS certificates
Under PSD2 a TPP proves its identity and licence to the ASPSP using eIDAS certificates that embed the TPP's authorisation number and roles:
- QWAC (Qualified Website Authentication Certificate) — used for mutual TLS between the TPP and the ASPSP, securing the transport channel.
- QSealC (Qualified Electronic Seal Certificate) — used to sign messages at the application layer, giving non-repudiation independent of the transport.
Related articles
Authentication3D Secure (EMV 3DS)Authentication flows, message types, ECI values, SCA exemptionsRead article IdentityEUDI Wallet & PaymentseIDAS 2.0 deadlines, the SD-JWT VC / mdoc / OID4VP stack, wallet-based PSD2 SCARead article Card RailsSettlement & ClearingClearing files, net settlement, dispute timelines, interchange economicsRead article Crypto Railsx402 Payment ProtocolHTTP 402 as a payment rail: quote/sign/verify/settle, PAYMENT-* headers, EIP-3009Read article