<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-03-05","gaps":[],"covered":["EBA Q&A 2019_4631 — Q&A — TPP access only with PSU involvement [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4631-tpp-access-only-with-psu-involvement","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4631-tpp-access-only-with-psu-involvement","title":"EBA Q&A 2019_4631 — Q&A — TPP access only with PSU involvement [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4631-tpp-access-only-with-psu-involvement","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 5 March 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4631","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"0c1e49baf90826eb","change_date":null,"nearest_versions":["2021-03-05"],"first_text_date":null,"correction_applies":false,"versions":["2021-03-05"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4631-tpp-access-only-with-psu-involvement/versions/2021-03-05","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4631-tpp-access-only-with-psu-involvement/versions/2021-03-05/rev/0c1e49baf90826eb","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4631-tpp-access-only-with-psu-involvement/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4631-tpp-access-only-with-psu-involvement/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 5 Mar 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-03-05","question_submitted_on":"2019-03-27","locators":{"published_on":"EBA Q&A register entry 2019_4631, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4631, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2019_4631 — Q&A — TPP access only with PSU involvement [Final Q&A]"
shortTitle: "EBA Q&A 2019_4631 — Q&A — TPP access only with PSU involvement [Final Q&A]"
answer_id: EBA_QA_2019_4631
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 98 PSD2"
date: 5 March 2021
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4631
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 5 March 2021"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4631"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2019_4631, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2021-03-05"
  question_submitted_on: "2019-03-27"
  locators:
    published_on: "EBA Q&A register entry 2019_4631, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2019_4631, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 5 Mar 2021 [Final Q&A]**

*Final Q&A · EBA Q&A register, 5 March 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4631)*

| | |
|---|---|
| **Full title** | EBA Q&A 2019_4631 — Q&A — TPP access only with PSU involvement \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2019_4631 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 5 March 2021; question submitted 27 March 2019 |
| **Legal basis** | Article 98 PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**TPP access only with PSU involvement**

### Question

Can a Payment Service User (PSU) allow a Third party provider (TPP) the access to his account only if he is involved?

### Background

Article 36(5)(b) of Regulation (EU) 2018/389 – RTS on strong customer authentication and secure communication states that the TPP may access account information of the PSU a maximum of four times within 24 hours. This applies with the explicit consent of the user.

Does this article also state that a PSU can prohibit the TPP from accessing the account independently meaning without the "presence" of the PSU? This means that the TPP has permission to access the account information of the PSU but this only applies if the PSU actively requests this information at TPPs application.

***

### Answer

Article 36(5)(a) and (b) of the Commission Delegated Regulation (EU) 2018/389 provides that account information service providers (AISPs) shall be able to access information from designated payment accounts and associated payment transactions held by account servicing payment service providers (ASPSPs) for the purposes of performing the account information service in either of the following circumstances:

(a) whenever the Payment Service User (PSU) is actively requesting such information;

(b) where the PSU does not actively request such information, no more than four times in a 24-hour period, unless a higher frequency is agreed between the AISP and the ASPSP, with the PSU's consent.

This is, however, without prejudice to the obligation set out in Article 67(2)(a) of Directive 2015/2366/EU (PSD2) according to which AISPs shall provide services only where based on the PSU’s explicit consent. The PSD2 does not restrict the PSU from setting the conditions in which the AISP can access the account information, including the possibility for the PSU to restrict the AISP to access information only whenever the PSU is actively requesting such information.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4631)

## Related Level 1 articles

- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)