Account Information Services Research Articles

Account Information and Payment Initiation Services and the Related AML Obligations in the Law of the European Union

The Second Payment Services Directive introduced new services into the European Union legal system—Payment Initiation and Account Information Services. These services are based on payment accounts already opened and maintained for customers by the Account Servicing Payment Service Provider (bank, payment institution, electronic money institution). The Account Services Payment Service provider performs AML/CFT verification of the account holder and applies customer due diligence measures to the account holder, such as identifying beneficial owners, obtaining information on the purpose and intended nature of the business relationship, and ongoing monitoring of the business relationship. Payment Initiation and Account Information services are therefore provided to a previously verified client and based on the payment account currently maintained for him. European Union law does not clearly specify whether a Third-Party Service Provider offering Payment Initiation or Account Information Services is obliged to re-apply financial security measures to customers. The aim of this article was to perform a legal analysis of the regulations and soft law acts in force in the European Union and to answer the question. The purposive (teleological) and linguistic–logical (grammatical) methods of interpretation of regulations were used for the analysis. The structure of the legal system of the European Union as a civil law (code law) system was taken into account. This article shows that in the current legal situation, there is no doubt that Third-Party Service Providers are obliged entities in terms of AML/CFT law and are obliged to apply the AML/CFT to customers using Payment Initiation and Account Information services. However, the degree to which customer due diligence measures have to be applied varies depending on the adopted model of providing Payment Initiation and Account Information services. Third-Party Service Providers will be obliged to apply financial security measures in cases where the relationship between the customer and the service providers will have a continuing character. In the case of occasional provision of services, when the transaction value does not exceed a certain threshold, the supplier may only perform simplified customer verification. In particular, this applies to Payment Initiation service models, where the Payment Initiation Service Provider works for merchants, enabling them to accept payments for goods and services sold. In such a model, the Service Provider has a continuous relationship with the merchant but only performs an occasional transaction for the user. The analysis also allowed for the conclusion that European Union law, including that in the draft phase, does not regulate in a sufficiently precise manner when a given model of Account Services and Payment Initiation Services may be treated as based on an occasional transaction. This made it possible to formulate a de lege ferenda request to include this issue in the proposal for an EU Regulation on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing.

The interplay between the second payment services directive, the national Romanian law on the payment services and GDPR

The second Payment Services Directive [Payment Services Directive (Directive 2015/2366/EU of the European Parliament and of the Council of the 23rd of December 2015, hereinafter ‘PSD2’] provided new rules for the market for payment services, including rules that allow new payment service providers to obtain access to payment accounts of data subjects for the purposes of providing the said services. The PSD2 rules regarding the payment services providers were transposed in the Romanian national law in 2019 by means of Law no. 209/2019 on the payment services (hereinafter ‘Law no. 209/2019’), and National Bank of Romania Regulation no. 4/2019 regarding payment institutions and specialized suppliers in account information services (hereinafter ‘Regulation no. 4/2019’). Regarding data protection, in accordance with Article 94 para. (1) of the PSD2 and art. 217 of Law no. 209/2019, any processing of personal data, including the provision of information about the processing shall be carried out in accordance with the GDPR and with Regulation (EU) No. 2018/1725. However, in addition to that, both PSD2 and Law no. 209/2019 provide for certain specific rules regarding consent, security, sensitive payment data, and silent party data, among others. Therefore, the paper will analyse the interplay and overlap in the regulatory regimes regarding the legal basis for processing data, the conditions for explicit consent, the processing of silent party data, the processing of special categories of data and sensitive payment data, and the way the payment service providers shall ensure data minimization, security, and transparency.

Perceived Risk as a Determinant of Propensity to Adopt Account Information Services under the EU Payment Services Directive 2

Globalisation, technological advances, liberalisation of financial markets, and changing consumer behaviour are transforming banking profoundly. Under the EU Payment Services Directive 2 (PSD2), incumbent banks must open up their data, processes, and business functionalities to customers and third parties including rivals. It is critical to understand consumer behaviour post-PSD2, and the potential impact of PSD2 on the functioning of the retail banking and financial services market. In this preliminary study of 244 consumers from six European countries, we explore the role of social influence, facilitating conditions, perceived risk, and effort and performance expectancy in order to unravel the determinants of consumers’ acceptance of account information services (AIS) as provisioned under PSD2, which provide consolidated bank account information for consumers with multiple bank accounts across multiple banking institutions. Our findings suggest that the competing influences of (a) positive perceptions such as social influence, facilitating conditions, and performance expectancy, and (b) negative perceptions related to risk, sway consumers’ intentions to adopt AIS.

THE OPPORTUNITIES AND BENEFITS OF OPEN BANKING IMPLEMENTATION

The technological innovations help improve and develop online payments, including digital wallets, P2P payments, and e-commerce payments through existing e-banking infrastructure. Privacy issues prevent data owners to share them outside their institutions for fear of fraud and abuse. Open banking can help maximize customer benefits through data sharing and deeper collaboration between financial institutions. All companies providing payment services in the European Economic Area must comply with the PSD2 account access requirements. PD2 regulates that third-party PSPs have the right to access a payment account held with banks to provide account information services and / or payment initiation services. To do this, banks must provide a secure and open interface for third-party payment systems for account access, reporting and payment initiation. In light of the update of the European Commission's Payment Services Directive, which aims to improve competition and boost economic activity by facilitating and encouraging bank account holders to send their account data in a controlled and secure manner, there is a problem with customers' lack of awareness, benefits and security. Time of operations on the principles of open banking. This study is devoted to the study of the concept of Open Banking, its economic nature, prerequisites, opportunities and risks of implementation as a new way to use payment services, introduced by the directive. The research contributes to the development of open banking technology and solves the problem raised in the work - the trust of customers in it, which determines the success of its implementation and development of such a business model.

Innovation in open banking: Lessons from the recent wave of payment institutions that have been authorised to provide payment initiation and account information services

The Revised Payment Services Directive (PSD2) came into force in all EU member states in 2018. One stated aim of this legislation was to create room for innovations in technology and business models in order to give account holders more choices and more direct control regarding access to their account information and ways of initiating payment transactions. Although an evolving array of new services and service providers has emerged over the past few years, the market remains in an early phase of experimentation. Nevertheless, information about the range of newly licensed service providers in the EU, and their business models, provides some insights into how the market is evolving and how it is reacting to recent regulatory and market infrastructure changes introduced through the PSD2 and open banking architecture. This paper reviews the population of payment institutions that have recently obtained authorisation to provide payment initiation or account information services in the EEA. It examines the (1) geographic reach, (2) company origins and investors, and (3) business function of these new actors to provide early insights into the changing economics of banking and payments.

Consumer Willingness to Share Payments Data: Trust for Sale?

The revised Payment Services Directive (PSD2) has opened the possibility for third parties to accessconsumers’ payment account in order to use their payments data. Such third-party access to data is a novum in network regulation. Its success depends on consumer preferences concerning the usage of this data. We study these preferences using a representative panel of Dutch consumers. In particular, we consider how consumer willingness to allow access to payments data depends on: (i) the type of data user: consumers’ own bank, another bank, or a BigTech; (ii) financial incentives; and (iii) trust in the data user. We research attitudes in case of a financial overview, a mortgage loan and a personal loan and obtain the following results. First, willingness to allow access is highest if the user is the consumer’s own bank. This holds irrespective of the type of service and the financial product. Second, the propensity to use account information services is driven by consumers’ trust in the providers of these services. Third, an explicit financial reward can tempt people to accept offers from other providers. BigTechs need to offer stronger incentives than other banks, because people trust them the least.

'I Access Your Data You Access Mine'. Setting a Reciprocity Clause for the ‘Access to Account Rule’ in the Payment Services Market

Article 36 of the EU Payment Services Directive 2 No. 2015/2366 (hereinafter also referred to as PSD2) awards digital operators, so-called third-party payment providers (TPPs), the right to freely access users’ payment accounts data (known as the XS2A rule), typically retained by incumbent banks to provide payment initiating services (PIS) or account information services (AIS). The stated goal of the XS2A rule is to help an infant industry grow: that of Fintech payment services. However, mounting evidence suggests that unlike Fintech startups, big techs may benefit from the norm, putting a much stronger challenge to established banks. The latter indeed have less access to data about consumers’ behavior (preferences, habits and conducts), less analytics capacity, and thus are placed in a competitive disadvantage by the XS2A, compared to their big tech rivals. According to many, that may result in competition harm and consumer welfare reduction in the medium and long run. The article revisits the rationales for introducing the XS2A rule by critically assessing its asserted goals (Part 1). It then suggests (Part 2) that to level the playing field among the market players involved and increase its overall proportionality, the norm be revisited. In the relationship between big tech and the banks, we propose to complement the XS2A rule with a “reciprocity clause”. Instead of free access to customers’ account data, big tech would pay by counter-providing access to the behavioral data in their possession pertaining to the same customers concerned by the XS2A, and upon their consent. Data thus transmitted would only be available upon condition of reuse to increase the efficiency of the payment service provision. Reciprocity would greatly enhance data circulation among market participants, while fostering competition among them, creating incentives for more innovation and strengthening the overall proportionality of the XS2A rule.

Regulation of information flows as Central Bank functions? Implications from the treatment of Account Aggregators by the Reserve Bank of India

This paper seeks to understand the role of the Indian Central Bank in regulating information flows through Account Aggregators. These are licensed entities exclusively dedicated to collecting, retrieving and sharing customers’ financial information with other financial entities with the customers’ consent. By regulating Account Aggregators as non-bank providers, the Reserve Bank of India (RBI) has opened up many foundational questions for Central Banking regulation. This paper investigates the issues that emerge for regulatory consideration, by tracing the evolution of the RBI’s regulatory approach to Account Aggregators. It then considers the regulatory approach taken by the Kingdom of Bahrain and the European Union (EU) to regulate “account information services” pursuant to broader Open Banking mandates. The analysis is used to respond to the central question driving this enquiry: Should Central Banks regulate and enable the flow of personal information? In doing so, the paper addresses the RBI’s approach in the Master Directions on Non-Banking Financial Company - Account Aggregator, 2016. We propose specific changes to anchor the Master Directions to the Central Bank’s core mandate and objectives, and to harmonise it with the broader regulatory rubric for data protection in India.

Consumer Propensity to Adopt PSD2 Services: Trust for Sale?

We study consumers’ attitudes towards sharing payments data with incumbent and new providers of payment and account information services, and using their services. This is important, in order to understand the possible impact of the revised Payment Services Directive (PSD2) on the functioning of the retail payments market. We do so using a representative panel of Dutch consumers. We obtain a number of results. First, consumers’ propensity to give consent for payments data usage is highest if the data user is their own bank. Only a minority would give consent to the usage of payments data to make a financial overview with personalised offers. Second, an explicit financial reward can tempt more people to use this service and to demand the service from a BigTech instead of one’s own bank.

The security of access to accounts under the PSD2

The revised Payment Services Directive (‘PSD2’) has been adopted to stimulate the development of an integrated internal market for payment services. In particular, it facilitates payment initiation services and account information services by granting the providers of these services access to the accounts of the payment service users. At the same time, the recitals state that the PSD2 guarantees a high level of consumer protection, security of payment transactions and protection against fraud.This paper answers the following question: To what extent does the access to accounts of the payment initiation service providers and account information service providers balance the development of the market for payment services with the security of the payment account and the privacy of the user? An analysis of the PSD2 shows that the development of the market for payment services has a higher priority. Security and privacy are ultimately subordinate.First, the PSD2 does not adequately protect the personal data of the users. The definition of ‘account information service’ is broad and covers a wide range of services. This allows the payment service providers to circumvent the limitations of the access to accounts.Next, the payment service providers have a ‘fall back option’ that allows ‘screen scraping’ if the dedicated interface is not functioning properly. Although this access is constrained by several safeguards, the fall back option gives the payment services provider unlimited access to the account of the user.Finally, the payment service providers have considerable freedom to arrange their authentication process as they see fit. The banks seem to be required to trust this process. The PSD2 and regulatory technical standards do not demand that a bank is able to verify the authentication or the integrity of the payment order.

Data, Innovation and Transatlantic Competition in Finance: The Case of the Access to Account Rule

Technological innovation is transforming the structure of the retail banking sector. Traditional business models are facing a rapid disruption process led by the emergence of FinTech companies which provide innovative digitally-enabled banking and financial services. In order to offer payment initiation services and account information services, third party providers need to access customer accounts, since information on the availability of funds on the consumer’s payment account is a key element. The paper focuses on two major trends that underpin this new business environment, which is known as Open Banking. First, the EU has taken the lead in the transition by providing, within the revised Payment Service Directive (PSD2), a sector-specific portability regime (the access to account rule) expressly aimed at fostering competition. Indeed, one of the key points of the PSD2 is that new market players should be granted access to account data. Second, in such a context standardization plays a crucial role with regards to the implementation process and the overall effectiveness of this new pro-competitive mechanism. Regulators in other countries have recently expressed interest in developing frameworks that put consumers in control of their account data. Additionally, they have encouraged standardization initiatives aimed at defining shared, open application programming interfaces (APIs). Will regulators in the U.S. follow suit?

Information services in counseling and locus of control toward communication between parents and children’s

The aim of this research is to know how much contribution given by information services in counseling and locus of control toward communication between parents and children. This research is a quantitative research using survey. This research was conducted in Komunitas Bunda Condet. The sample for this study came to 44 people taken by saturated sample distribution technique. Data were collected through a questionnaire. Data was analyzed by using multiple regression test with the help of SPSS 22 for windows. The results showed that information services and locus of control contribute to communication between parents and children. These results prove that communication quality can be improved by taking into account information services and locus of control.

PSD2: The digital transformation accelerator for banks

The revised Payment Services Directive (PSD2) is not ‘just another regulation’ requiring a mere operational and compliance approach, but an accelerator of the already on-going change in the fabric of the — digitisation prone — financial industry. The PSD2 provisions on ‘Access to account’ for Payment Initiation and Account Information Services (‘XS2A’) will accelerate this by forcing banks to open up consumer payment accounts for appropriately licensed, innovative (bank and non-bank fintech) service providers. A pivotal element to this concept of opening up payment accounts is the development of Application Programming Interfaces (APIs) by banks. Fintech players are seeking to capitalise on the emerging API landscape and to capture customer and developer mindshare as well as payment and non-payment (data rich service) revenues long taken for granted by incumbent financial institutions. The key challenge for leaders of incumbent financial institutions is to ensure PSD2 XS2A compliance, while at the same time retaining customer relevance and maximising addressable market and revenue potential across a rich transaction services portfolio. APIs could redefine the financial services distribution game of banks. Some financial institutions see PSD2 XS2A and APIs as an opportunity to work closer with emerging fintech companies. Others see it as a threat to their business. This has led to different strategic choices for banking leaders. The authors have identified four generic strategic options (ie, Comply, Compete, Expand, and Transform), fitting the wider spectrum of leader attitudes towards PSD2 XS2A and adoption of APIs as a business strategy. All options come with strategic, tactical, and operational considerations and will be elaborated upon in this paper. Making the ‘right’ strategic decision will require banking executives to (re-)consider their future ambition, desired position in the value chain, the accompanying transaction portfolio, and impact on the operating model.

The emergence of new payment service providers and their impact on the regulatory and market environment

In July 2013, the European Commission issued the proposal for a revised Payment Services Directive (PSD2). With the proposed PSD2, the Commission introduces the notion of ‘third party payment service provider (TPP)’. These are described in PSD2 as payment service providers (PSPs) pursuing business activities that are based on access to payment accounts provided by a PSP who is not the ‘account servicing’ PSP, in the form of (a) payment initiation services and/or (b) account information services. The European Payments Council (EPC) believes that substantial amendments to the proposed new set of rules related to the activity of TPPs will have to be agreed in the further dialogue between the European Union (EU) co-legislators, ie the European Parliament and the Council of the EU, to ensure the security of bank customers’ funds and data with payment account access services under the forthcoming PSD2. Moreover, an interim solution would be required to address the current lack of a legal framework regarding the licensing of TPPs until PSD2 is fully implemented in EU member states. The EPC reiterates: ‘Convenience is a priority; security is indispensable. Promoting payment innovation to the benefit of both payers and payees requires combining the two.’

A circle of influence: Are all the stakeholders included?

Traditionally, certified public accountants (CPAs) have served a unique role in the world of commerce and the profession of accounting. They perform an attest function and thereby serve as the chief providers of relevant, high quality accounting information to the decision making public. CPAs are licensed practitioners, who as expert independent accountants express opinions about an entity'sfinancial statements. Their license provides them with the exclusive right to perform this attest function. This monoploy relies on the concept of independence that is the normative standard of accountancy. It is this perceived independence of auditors which provides credibility, reliability and trust in the financial accounting information upon which stakeholders depend to make informed decisions. Now, however, we see the environment in which CPAs operate undergoing rapid change. Both the globalization of business operations and technological advances have radically changed how and where accountants work and the speed at which things happen. The very nature of accounting information services is evolving; moving from a concentration on audits to an increasing reliance on consulting and assurance services. New ethical issues have been raised by this confluence of changes in the accounting environment. Noteworthy is that the application of the principle of independence by CPAs has been called into question by no other than the SEC. Are those stakeholders who depend upon the independence of CPAs at risk? The influence of insiders has significantly increased as accounting firms perform multiple tasks for the same clients. This paper discusses the different groups who can potentially impair the independence of auditors and the steps that are being taken to enhance the "independence" of the auditors.