{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2022-03-11","gaps":[],"covered":["EBA Q&A 2019_4712 — Q&A — AISPs and scope of application AML requirements [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4712-aisps-and-scope-of-application-aml-requirements","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4712-aisps-and-scope-of-application-aml-requirements","title":"EBA Q&A 2019_4712 — Q&A — AISPs and scope of application AML requirements [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4712-aisps-and-scope-of-application-aml-requirements","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 11 March 2022","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4712","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"4e3e69d699994061","change_date":null,"nearest_versions":["2022-03-11"],"first_text_date":null,"correction_applies":false,"versions":["2022-03-11"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4712-aisps-and-scope-of-application-aml-requirements/versions/2022-03-11","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4712-aisps-and-scope-of-application-aml-requirements/versions/2022-03-11/rev/4e3e69d699994061","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4712-aisps-and-scope-of-application-aml-requirements/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4712-aisps-and-scope-of-application-aml-requirements/relations","source_line":"Answer prepared by the European Commission, published in the EBA Q&A tool · not legislation · published 11 Mar 2022 [Final Q&A]","attribution":{"prepared_by":"European Commission","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2022-03-11","question_submitted_on":"2019-05-14","locators":{"published_on":"EBA Q&A register entry 2019_4712, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4712, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4712","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4712-aisps-and-scope-of-application-aml-requirements.md","body_sha256":"a31c5501ef76b453bb49558d4fbbcd435dc9170ffa3d5183499cfc87e2d847fd"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4712 — Q&A — AISPs and scope of application AML requirements [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4712 — Q&A — AISPs and scope of application AML requirements [Final Q&A]\"\nanswer_id: EBA_QA_2019_4712\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 33 PSD2\"\ndate: 11 March 2022\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4712\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 11 March 2022\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4712\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"European Commission\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the European Commission because it is a matter of interpretation of Union law.\"\n    locator: \"EBA Q&A register entry 2019_4712, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2022-03-11\"\n  question_submitted_on: \"2019-05-14\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4712, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4712, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer prepared by the European Commission, published in the EBA Q&A tool · not legislation · published 11 Mar 2022 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 11 March 2022 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4712)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4712 — Q&A — AISPs and scope of application AML requirements \\[Final Q&A\\] |\n| **Prepared by** | European Commission |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4712 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 11 March 2022; question submitted 14 May 2019 |\n| **Legal basis** | Article 33 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**AISPs and scope of application AML requirements**\n\n### Question\n\n1. To what extend do AISPs need to comply with the obligations in relation to anti-money laundering and terrorist financing under Directive (EU) 2015/849 of the European Parliament? 2. Is a requirement for AISPs on the basis of national law and national supervisory practices to submit to the competent supervisor a description of the internal control mechanisms with regard to AML regulations compliant with PSD2 and EBA’s Guidelines on Guidelines on authorisation and registration under PSD2?\n\n### Background\n\nOn the basis of Article 33 PSD2, Article 5(1)(k) does not apply to AISPs. This means that AISPs, for authorisation as a payment institution, do not need to submit a description of the internal control mechanisms with regard to AML regulations. See also EBA’s Guidelines on Guidelines on authorisation and registration under PSD2 (paragraph 2.2, point 25). In the Netherlands, the competent autority (i) takes the position that AML requirements apply to AISPs (see: https://www.toezicht.dnb.nl/3/50-237181.jsp) and (ii) requires that a description of internal contral mechanism with regard to such requirements is submitted as part of the license application.\n\n***\n\n### Answer\n\nAnswer to Q1 (prepared by the EBA): Point (2) of Article 2(1) of the Directive (EU) 2015/849 (AMLD) lists financial institutions as obliged entities. . Point (2)(a) of Article 3 of the AMLD defines the term financial institutions as follows: “...an undertaking other than a credit institution, which carries out one or more of the activities listed in points (2) to (12), (14) and (15) of Annex I to Directive 2013/36/EU of the European Parliament and of the Council {CRD), including the activities of currency exchange offices (bureaux de change). Point (4) of Annex I to CRD refers to: Payment services as defined in point (3) of Article 4 of Directive (EU) 2015/2366 of the European Parliament and of the Council (PSD2). Point (3) of Article 4 of the PSD2 defines payment services as any business activity set out in Annex I. Point (8) of Annex I to the PSD2 refers to Account information services (AISPs).” Thus, AISPs are obliged entities under the AMLD.\n\nPursuant to Article 8(3) of the AMLD ”Member States shall ensure that obliged entities have in place policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing identified at the level of the Union, the Member State and the obliged entity. Those policies, controls and procedures shall be proportionate to the nature and size of the obliged entities.” What such policies, controls and procedures shall include is specified in Article 8(4) of the AMLD.\n\nLike other obliged entities, AISPs are required therefore to comply with the AMLD’s requirements. AISPs do not benefit from exemptions under the AMLD but, like other obliged entities, can adjust their Anti Money Laundering/Countering the Financing of Terrorism (AML//CFT) systems and controls on a risk-sensitive basis.\n\nIn the EBA’s Guidelines on money laundering and terrorist financing (ML/TF) risk factors (EBA/GL/2021/02), the EBA sets out how AISPs can adjust their AML/CFT systems and controls in a risk-sensitive and proportionate way. Taking into account that the inherent ML/TF risk associated with these financial institutions is limited due to the fact that AISPs are not involved in the payment chain and do not hold payment service user’s funds, the Guidelines state that simplified due diligence measures are appropriate in most situations.\n\nAnswer to Q2 (prepared by the European Commission): Article 33(1) of Directive (EU) 2015/2366 (PSD2) states that persons providing only the payment service as referred to in point (8) of Annex I, namely AISPs, are to be exempt from the application of the procedure and conditions set out in Sections 1 and 2 PSD2, with the exception of, inter alia, Article 5(1), points (a), (b), (e) to (h), (j), (l), (n), (p) and (q), PSD2.\n\nAccording to Article 5(1), point (k), PSD2 the following is to be submitted to the competent authority: ‘for payment institutions subject to the obligations in relation to money laundering and terrorist financing under Directive (EU) 2015/849 of the European Parliament and of the Council \\[AMLD\\] and Regulation (EU) 2015/847 of the European Parliament and of the Council \\[ToFR\\]: a description of the internal control mechanisms which the applicant has established in order to comply with those obligations’.\n\nThus, AISPs are exempt from the application of Article 5(1), point (k), PSD2 and, as clarified in the EBA Guidelines on authorisation and registration under PSD2, EBA/GL/2017/09, do not have to submit to the competent authority a description of the internal control mechanisms established in order to comply with their obligations under AMLD and ToFR. Consequently, a national competent authority cannot ask for this information during the registration process based on the national provisions transposing Article 5(1), point (k), PSD2.\n\nThis is without prejudice to any request the competent authorities might raise based on other legal grounds, e.g. national law transposing AMLD or the ToFR and AISP obligations under these acts.\n\nDisclaimer for the answer to Q2:\n\nThe answers clarify provisions already contained in the applicable legislation. They do not extend in any way the rights and obligations deriving from such legislation nor do they introduce any additional requirements for the concerned operators and competent authorities. The answers are merely intended to assist natural or legal persons, including competent authorities and Union institutions and bodies in clarifying the application or implementation of the relevant legal provisions. Only the Court of Justice of the European Union is competent to authoritatively interpret Union law. The views expressed in the internal Commission Decision cannot prejudge the position that the European Commission might take before the Union and national courts.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4712)\n\n## Related Level 1 articles\n\n- [Article 33 — Account information service providers](../../../articles/33.md)\n"}