SPAA: the price tag on an open banking API

PSD2 gives a licensed third party the right to read a payment account and to initiate a payment from it, without paying the bank. That baseline is deliberately thin. It covers a single immediate payment and a view of the account, and nothing else. A provider that wants to confirm funds and reserve them, defer a payment to a date, set up a direct debit mandate or pull changing amounts under a standing consent is asking for something PSD2 never required.

SPAA is the frame for exactly those services. Its stated aim is to drive open payments in the EU in a way that unlocks value while distributing value and risk fairly between participants, which is scheme language for the thing banks complained about: under PSD2 they built the infrastructure and third parties monetized it. Making the premium layer commercial is the attempt to fix that incentive.

The rulebook names two roles. An asset holder is the account-servicing payment service provider, in practice the bank that holds the account and exposes the asset. An asset broker is the party that uses it, typically a payment initiation or account information service provider. The words are chosen to make the commercial relationship explicit: one side owns something, the other side buys access to it.

Both sides have duties under the scheme, which is what distinguishes it from a bilateral contract. An asset holder that joins commits to make the agreed assets available to any participating broker on the scheme terms, at a defined quality, with defined availability. A broker commits to the scheme's rules on consent, use and liability. Without that, every bank-provider pair would negotiate separately, which is the fragmentation SPAA exists to prevent.

An asset is a service the asset holder exposes. The first version of the rulebook includes one-off payments, future-dated payments and dynamic recurring payments, the SEPA counterpart to the UK's variable recurring payments, as Tink summarized on publication. Data assets cover richer account information than the PSD2 view.

Because a scheme in which every asset is optional delivers nothing predictable, the SPAA group defined a minimum viable product: a subset of the services every participating asset holder has to support. That MVP is what lets a broker build one integration and expect it to work at every participating bank. For the asset beyond the MVP, availability is the asset holder's commercial choice.

SPAA sets a default remuneration model: the fee an asset holder may charge a broker for an asset, applying unless the two agree something else bilaterally. A default matters more than it sounds. Without one, a small broker has no leverage against a large bank and no basis for a business case, and a bank has no reference point for pricing a service nobody has priced before.

For a bank the calculation is uncomfortable in both directions. Charging for an API turns a cost center into a revenue line, which is the argument for joining. Not charging keeps third parties dependent on the free PSD2 baseline, which keeps them limited, which is the argument for waiting. A bank that waits also risks the alternative: if FIDA arrives and compels data sharing with a regulated compensation rule, the commercial freedom disappears.

Three instruments touch the same question and only one is a law. PSD3 and the Payment Services Regulation keep the basic access free and leave premium services to the market, which is what creates room for SPAA. FIDA would extend mandatory data access well beyond payment accounts and would regulate compensation, through membership of financial data sharing schemes.

SPAA is the industry getting there first, voluntarily. If it works, the market has a functioning commercial scheme before the legislator prescribes one, and FIDA schemes can build on it. If it does not, the legislator writes the terms. That is the real stake behind an otherwise technical rulebook, and it is why the adoption numbers matter more than the specification.

Participation opened in September 2023 and the scheme took effect at the end of November 2023. Adoption has been cautious, and the reason is structural: every service in the first version is optional for the asset holder, unlike the UK, where the competition authority ordered the largest banks to deliver. A voluntary scheme needs enough banks to make a broker's integration worthwhile, and enough brokers to make a bank's build worth funding.

The EPC has run pilot work to break that deadlock and publishes the register of participants. For a German bank the question in practice is not whether SPAA is good but whether its own corporate and retail customers are asking for the services it would unlock, which is the same question that decides variable recurring payments here.

SPAA, the SEPA Payment Account Access scheme, is a set of rules, practices and standards from the European Payments Council for exchanging payment account data and initiating payments through premium APIs beyond the free PSD2 baseline. It defines two roles, the asset holder that exposes a service and the asset broker that uses it, and it sets a default fee model for that access.

No. SPAA is a voluntary scheme, and in its first version every service is optional for the asset holder that joins. That is the main difference from the UK, where the Competition and Markets Authority ordered the nine largest banks to deliver open banking functions. The compulsory element in Europe would come from FIDA, which is still in the legislative process.