# ASPSP

> Account Servicing Payment Service Provider

This is the bank. It holds your accounts and, since PSD2, is obliged to expose their data and payment functions to the TPPs you authorise.

_Category: acteur_

---

## Definition

The **ASPSP** (_Account Servicing Payment Service Provider_) is the bank: the institution that holds the PSU's account.

Since PSD2, it is obliged to expose this data and certain payment functions to the authorised TPPs that the customer authorises.

## ASPSP vs TPP: who does what

- **ASPSP** — holds the account and the money. It is the one that provides the data and executes the payments.
- **TPP** — connects to the account via API to read it (AISP) or initiate a payment (PISP). It holds nothing.

The ASPSP remains responsible for the account; the TPP is just a service intermediary on top.

## Its PSD2 obligations

- Expose a dedicated API (or a fallback) allowing TPPs to consult accounts and initiate payments.
- Guarantee access of equal quality to that of its own channels (mobile, web).
- Authenticate the PSU through SCA to authorise TPP access.
- Recognise the eIDAS certificates (QWAC / QSealC) of authorised TPPs.
- Not charge TPPs for this regulated access.

## What an ASPSP cannot do

- Refuse a properly authorised and technically compliant TPP.
- Discriminate by imposing on TPPs heavier constraints than on its own equivalent services.
- Require a commercial contract for the PSD2 AIS / PIS / CBPII scope.
- Block access without a documented reason (proven fraud, unauthorised access), under penalty of ACPR sanction.

## In the PSD2 ecosystem

The ASPSP is the foundation: without its API, no TPP can operate. The PSU gives it a mandate, the TPP connects to it, the ASPSP executes.

```mermaid
flowchart TB
    PSU["PSU — account holder"]

    subgraph ASPSP["ASPSP — the bank"]
        direction TB
        COMPTES["PSU's accounts\n(balances, operations, IBAN)"]
        API["PSD2 API\n• AIS — reading\n• PIS — payment initiation\n• CBPII — funds verification"]
        SCA["Strong authentication\n(SCA / eIDAS)"]
    end

    subgraph TPP["Authorised TPPs"]
        AISP["AISP"]
        PISP["PISP"]
        CBPII["CBPII"]
    end

    PSU -->|"Holds the account at"| ASPSP
    PSU -->|"Authenticates via SCA"| SCA
    AISP -->|"Reads the data"| API
    PISP -->|"Initiates a payment"| API
    CBPII -->|"Checks availability"| API
```

## Concrete examples

- **Traditional banks**: BNP Paribas, Crédit Agricole, Société Générale, LCL and BPCE all expose their PSD2 APIs (often via STET in France, Berlin Group elsewhere).
- **Neobanks and online banks**: Boursorama, Revolut, N26 and Hello Bank are also ASPSPs, with an API quality often above average.
- **Business banks / banking fintechs**: Qonto, Shine and Memo Bank expose their APIs so that Pennylane or Indy can retrieve their customers' entries.
- **API quality**: the ACPR and the Open Banking Implementation Entity (UK) publish availability indicators — useful for choosing a bank when building a fintech product.

## Sources

- [Directive (EU) 2015/2366 on payment services in the internal market (PSD2)](https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX:32015L2366) — EUR-Lex, 2015-11-25
- [Commission Delegated Regulation (EU) 2018/389 — RTS on SCA and communication (XS2A)](https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX:32018R0389) — EUR-Lex, 2018-03-13

---

Source: https://openfinanceguide.com/en/glossary/aspsp