Actor

AISP

Account Information Service Provider

An authorised provider that reads your bank accounts — balances and transactions — with your consent. It views, it never initiates a payment.

Definition

An AISP (Account Information Service Provider) is an authorised provider that reads your bank accounts — balances and transactions — with your consent, in order to present them somewhere else.

It looks, it does not act: no payment or change is possible on your accounts.

AISP vs PISP: don't confuse them

Two distinct PSD2 roles, often combined in a single app but with different authorisations:

  • AISP — read-only: it consults your accounts to display, aggregate and analyse.
  • PISP — payment initiation: it triggers a credit transfer from your account, without going through the card.

An AISP that also wants to trigger transfers must obtain the PISP authorisation separately.

What an AISP can do

  • Aggregate several accounts from several banks into a single view.
  • Present history, balances and transaction categorisation.
  • Refresh the data within the limits of consent (regular renewal required by the PSD2 RTS).

What an AISP cannot do

  • Initiate a payment from your account: that is the PISP's role.
  • Access the data without the PSU's explicit consent, nor beyond the consented scope.
  • Operate without an authorisation (in France, ACPR / PSP register) or without the technical safeguards — eIDAS certificates, mTLS — required by the banks.

In the PSD2 ecosystem

The AISP is a TPP (third-party provider) just like the PISP or the CBPII, but with a scope strictly limited to reading. The PSU gives their consent, the ASPSP exposes the data through secure APIs, and the AISP connects to them within the regulated framework.

Concrete examples

  • Individual — aggregation and budgeting: Bankin', Linxo or Lydia connect to all your banks to show a unified budget, categorise spending and warn you of an overdraft. They read, they don't move the money.
  • Business — invoicing and accounting: Pennylane, Qonto or Indy automatically retrieve the bank entries to reconcile them with invoices, feed the accounting and prepare VAT. No more manual CSV exports.
  • Lender — credit scoring: Algoan or Bridge analyse the account history to assess creditworthiness in a few seconds, complementing (or replacing) payslips.

See also: STET handbook

Sources

Go deeper

From the blog

Longer reads to go beyond the definition.

August 24, 2026
security

QWAC vs QSealC: who does what, and why you've got the wrong layer — Read more

The QWAC is read by the TLS layer, once, at the handshake. The QSealC is read by the application layer, on every request. Where each private key lives, what STET requires, and how to read a 'certificate error'.

April 7, 2026
technical

Technical architecture of a PSD2 API: what to know before writing the first line of code — Read more

A technical overview of PSD2 for CTOs, developers and technical PMs: API standards, security (mTLS, eIDAS certificates), OAuth2, SCA flows, consent management, implementation pitfalls.

April 6, 2026
regulation

Understanding PSD2: what it changes for your customers and your business — Read more

Everything an executive, a product manager or a business team needs to understand about PSD2. Players, consent, opportunities, without technical jargon.