Regulatory Technical Standards: the detailed binding rules that specify how a piece of EU legislation must be applied in practice.
In open banking, the RTS on strong customer authentication and secure communication set out how SCA works, which exemptions exist, and what a bank's interface for third parties must do. They are drafted by the European Banking Authority and adopted by the Commission.
The distinction matters because the directive states the principle while the RTS determine what a provider actually has to build.
Strong Customer Authentication: the PSD2 requirement that electronic payments and account access be confirmed with at least two independent factors.
The three categories are:
Two factors must come from different categories, which is why a password plus a security question does not qualify. Certain low-value or recurring payments are exempt.
Payment Initiation Service: the regulated service, defined by PSD2, by which a third party initiates a payment on a customer's behalf, directly from their bank account.
Example: paying an online invoice straight from a bank account through a third-party application, rather than entering card details.
Providers: PISPs such as Tink, Token or TrueLayer.
The appeal is cost and speed: the payment travels on bank rails, so there is no card interchange fee, and the merchant sees the funds sooner.
A Payment Initiation Service Provider: a third party licensed to initiate a payment directly from a customer's bank account, with their consent.
The customer authorises the payment in their own banking app, and the funds move by bank transfer rather than through a card network. Because no card scheme sits in the middle, fees are generally lower.
PISPs require a full payment institution licence, a heavier regime than the registration applying to AISPs, because they move money rather than only reading data.
An Account Information Service Provider: a third party licensed to read a customer's bank account data, with their consent, but not to move money.
This is the licence behind account aggregation apps, budgeting tools and the automatic import of transactions into accounting software. Under PSD2 an AISP registers rather than holding a full payment institution licence, which is a lighter regime than that applying to PISPs.
A Third Party Provider: a company authorised under PSD2 to access bank accounts on a customer's behalf, without being the bank holding the account.
TPPs fall into two licensed categories, which a provider may hold either or both of:
TPPs are supervised and must be authorised by a national regulator before they can connect to banks.
The EU Payment Services Directive 2, in force since 2018, which created the legal basis for open banking in Europe.
It obliges banks to give licensed third parties access to payment accounts with the customer's consent, introduced the AISP and PISP licence categories, and imposed strong customer authentication on electronic payments.
PSD2 does not apply in Switzerland, which is not an EU member. Swiss banks open their interfaces by commercial agreement rather than legal obligation.
What comes next: PSD2 is being replaced by a package of two texts, the PSD3 directive and the directly applicable Payment Services Regulation (PSR). Co-legislators reached political agreement in November 2025 and the parliamentary committee approved the texts in May 2026, but formal adoption and publication were still pending, so PSD2 remains the operative framework. Application is expected around 21 months after publication.
The Single Euro Payments Area: an EU initiative that standardises euro-denominated bank transfers so that cross-border payments work like domestic ones.
It defines three main schemes:
SEPA covers more than 30 countries, including Switzerland, which participates for euro payments while keeping the Swiss franc outside the scheme.
