OB-IF-016PSR 45(2)Dedicated interface

TPP duties on the customer interface

What the text fixes

When only the Article 39 interface is available, the TPP identifies itself, sends the dashboard information, relies on the ASPSP's authentication, processes data only for the service requested and logs the data accessed, with logs deleted after three years.

Article: PSR 45(2)Provisional numbering of the April 2026 compromise (Council doc. 8221/26). The final numbering will be added when the Official Journal publishes the text, without changing the id.
Who is bound: AISP, PISP
Who it is for: Compliance, Operations
Application: 21 months after entry into force, the general application date (Article 112).
Level 2: No EBA mandate covers this obligation.
Origin: RTS 2018/389, Art. 33(5)

STET 1.6.3

Out of spec

This case assumes there is no dedicated API.

Sources

Checked on October 4, 2026

The entry as JSON

{
  "id": "OB-IF-016",
  "article": "PSR 45(2)",
  "alsoIn": [],
  "articleFinal": null,
  "actors": [
    "aisp",
    "pisp"
  ],
  "roles": [
    "compliance",
    "infra"
  ],
  "appliesAt": "T+21",
  "title": {
    "fr": "Obligations du TPP sur l'interface client",
    "en": "TPP duties on the customer interface",
    "es": "Obligaciones del TPP en la interfaz de cliente",
    "pt-br": "Obrigações do TPP na interface do cliente"
  },
  "level1": {
    "fr": "Quand seule l'interface de l'article 39 est accessible, le TPP s'identifie, transmet les informations du tableau de bord, s'appuie sur l'authentification de l'ASPSP, ne traite les données que pour le service demandé et journalise les données consultées, avec des logs supprimés au bout de trois ans.",
    "en": "When only the Article 39 interface is available, the TPP identifies itself, sends the dashboard information, relies on the ASPSP's authentication, processes data only for the service requested and logs the data accessed, with logs deleted after three years.",
    "es": "Cuando solo está accesible la interfaz del artículo 39, el TPP se identifica, transmite la información del panel, se apoya en la autenticación del ASPSP, trata los datos solo para el servicio solicitado y registra los datos consultados, con logs que se borran a los tres años.",
    "pt-br": "Quando só a interface do artigo 39 está acessível, o TPP se identifica, envia as informações do painel, usa a autenticação do ASPSP, trata os dados apenas para o serviço solicitado e registra os dados acessados, com logs apagados após três anos."
  },
  "level2": null,
  "origin": [
    {
      "act": "rts-2018-389",
      "articles": "33(5)"
    }
  ],
  "stet": {
    "1.6.3": {
      "status": "out-of-scope",
      "note": {
        "fr": "Ce cas suppose qu'il n'y a pas d'API dédiée.",
        "en": "This case assumes there is no dedicated API.",
        "es": "Este caso supone que no hay API dedicada.",
        "pt-br": "Esse caso supõe que não há API dedicada."
      },
      "pages": []
    }
  },
  "verification": null,
  "sources": [
    {
      "document": "8221/26",
      "page": 265
    },
    {
      "document": "8221/26",
      "page": 266
    }
  ],
  "verifiedAt": "2026-10-04"
}

All obligations Markdown version