Open banking TPP
An open banking third-party provider, or TPP, is a regulated company that provides services using a customer's payment account at another bank. An account information provider retrieves information such as balances and transactions, while a payment initiation provider starts a payment at the customer's request. These activities use bank interfaces and require the customer's consent.
TPPs make services such as multibanking apps and pay-by-bank checkouts possible without becoming the bank that holds the account. The provider connects the customer-facing service to the account, while the account remains with the customer's existing bank. Registration or authorization requirements depend on the provider's role and the jurisdiction in which the service is offered.
Three kinds of TPP
PSD2 names three services a third party can provide on an account it does not hold. An account information service provider, AISP, reads balances and transactions; it is covered on account information services. A payment initiation service provider, PISP, starts a payment from the account; see payment initiation service. A card-based payment instrument issuer, CBPII, asks the bank whether funds are available for a card payment it issued.
A firm may hold one role or several. The customer authenticates at their own bank, so the TPP never sees or stores the online banking credentials, as Yapily, itself a licensed TPP, explains in its guide.
License, register and certificate
A TPP needs approval from a supervisor before it touches an account. In Germany an AISP registers with BaFin, and a PISP needs a payment institution license; both appear in the BaFin register and in the central EBA register of payment institutions, and both can passport their service across the EEA. Becoming a TPP takes a business plan, a risk assessment and compliance manuals, and the authorization brings regular reporting and audits.
At the bank's interface the TPP identifies itself with a qualified eIDAS certificate that carries its license number, its supervisor and its roles, described on PSD2 certificates. Many firms do not become TPPs at all: they build on a licensed TPP's platform or use a technical service provider, which supplies bank connections but holds no license. The regulated activity then stays with the licensed partner.
Bank duties toward third-party providers
Under PSD2 a bank, the account servicing payment service provider, has to give licensed TPPs access through a dedicated interface or its customer interface, without requiring a contract with the TPP, and has to treat their requests like the customer's own. Most German banks build that interface on the Berlin Group standard. Services beyond the legal minimum can be priced under the SPAA scheme.
PSD3 and the Payment Services Regulation keep the TPP model and add duties on both sides, among them a dashboard where customers see and withdraw the access they granted. The customer's confirmation at the bank is described on strong customer authentication.
Upcoming events on payments and open banking
Finance Loop and open banking TPPs
Finance Loop is the meeting place for the TPPs, the bank API teams they connect to and the supervisors and compliance staff around both, in Germany, Austria and Switzerland. Finance Loop connects the finance, IT and AI communities, with events in Frankfurt, Munich, Berlin and Hamburg.
Finance Loop is a partner of the Digital Euro Association, whose Digital Euro Conference in Frankfurt covers digital money infrastructure next to open banking.
What does TPP stand for in open banking?
TPP stands for third-party provider: a licensed firm that accesses a customer's account at another bank, with consent, to read data or initiate payments. Under PSD2 a TPP is an AISP, a PISP, a CBPII or a combination.
What is the difference between an AISP and a PISP?
An AISP reads account data and cannot move money. A PISP starts a payment from the customer's account. In Germany the AISP needs a BaFin registration, the PISP a payment institution license.
Does a TPP need a contract with the bank?
Under PSD2 a bank must let a licensed TPP use its interface without a contract. A contract only comes in for services beyond the legal minimum, for example premium APIs under the SPAA scheme.
Open banking TPPs and Finance Loop
Finance Loop covers third-party providers in its Payments & Digital Money track, together with account information, payment initiation and PSD3. TPPs meet the banks whose interfaces they use at Finance Loop events.
Finance Loop is a professional network supporting the institutional use of emerging technologies in finance, such as AI, digital payments, cloud and blockchain solutions. Finance Loop helps its members build skills and personal networks in these fields: Investment & Digital Assets, Payments & Digital Money, Digital Infrastructure & Sovereignty, and Risk & Compliance.