← Payment Reference GuidesOpen Banking Reference
Open Banking & PSD2 Flows
How regulated third parties access bank accounts and initiate payments on a customer's behalf — the PSD2 roles, the consent and SCA flows, the FAPI security profile, and the regional API standards (UK Open Banking, Berlin Group, STET) that implement them.
The PSD2 actors
| Acronym | Role | What it does |
|---|---|---|
| ASPSP | Account Servicing PSP | The bank or PSP that holds the customer's account and exposes the regulated APIs. |
| TPP | Third-Party Provider | The regulated company accessing the account — an umbrella term for AISP/PISP/CBPII. |
| AISP | Account Information SP | Licensed to read account data with consent (aggregators, accounting, lending). |
| PISP | Payment Initiation SP | Licensed to initiate payments from the customer's account. |
| CBPII | Card-Based PII | Issues card instruments and asks the ASPSP to confirm available funds. |
| PSU | Payment Service User | The end customer (cardholder / account holder) granting consent. |
| NCA | National Competent Authority | The regulator (e.g. FCA in the UK, BaFin in Germany) that licenses TPPs. |
| QTSP | Qualified Trust SP | Issues the eIDAS certificates (QWAC / QSeal) TPPs use to identify themselves. |
eIDAS certificates
Under PSD2 a TPP proves its identity and licence to the ASPSP using eIDAS certificates that embed the TPP's authorisation number and roles:
- QWAC (Qualified Website Authentication Certificate) — used for mutual TLS between the TPP and the ASPSP, securing the transport channel.
- QSealC (Qualified Electronic Seal Certificate) — used to sign messages at the application layer, giving non-repudiation independent of the transport.