Annex I to Directive (EU) 2015/2366 (account information services)

Guideline 1: General principles

1.1 This set of guidelines applies to applicants for registration as account information service providers (AISPs). This refers to applicants that intend to provide only account information services (AIS). Should the applicant intend to provide additional services to those of AIS they should apply for authorisation and refer to the guidelines set out in section 4.1 for payment institutions (PIs).

1.2 The information provided by applicants should be true, complete, accurate and up to date. All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail required to be compliant should be proportionate to the

riskiness of the particular service(s) that the applicant intends to provide. In any event, in accordance with Directive EU 2015/2366, the directors and the persons responsible for the management of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.

1.3 When submitting the information required, the applicant should avoid making references to specific sections of internal procedures/documents. Instead, the applicant should extract the relevant sections and provide these to the competent authority (CA).

1.4 Should the CAs require clarifications on the information that has been submitted, the applicant should provide such clarification without delay.

1.5 All data requested under these guidelines for registration as account information service providers (AISPs) are needed for the assessment of the application and will be treated by the competent authority in accordance with the professional secrecy obligations set out in PSD2, without prejudice to applicable Union law and national requirements and procedures on the exercise of the right to access, rectify, cancel or oppose. Guideline 2: Identification details

2.1 If the applicant is a natural person, the identification details to be provided by the applicant should contain the following information:

• a) name, address, nationality and date and place of birth;
• b) a copy of the identity card or equivalent piece of identification;
• c) an updated curriculum vitae;
• d) a criminal record check not older than 3 months;
• e) the name(s) of the person(s) in charge of dealing with the application file and authorisation procedure, and their contact details.

2.2 If the applicant is a legal person, the identification details to be provided by the applicant should contain the following information:

• a) the applicant’s corporate name and, if different, trade name;
• b) an indication of whether the applicant is already incorporated or in process of incorporation;
• c) the applicant’s national identification number, if applicable;
• d) the applicant’s legal status and (draft) articles of association and/or constitutional documents evidencing the applicant’s legal status;
• e) the address of the applicant’s head office and registered office;
• f) the applicant’s electronic address and website, if available;
• g) the name of the person(s) in charge of dealing with the application file and authorisation procedure, and their contact details;
• h) an indication of whether or not the applicant has ever been, or is currently being, regulated by a competent authority in the financial services sector;
• i) the register certificate of incorporation or, if applicable, negative certificate of a mercantile register that certifies that the name applied by the company is available;
• j) evidence of the payment of any fees or of the deposit of funds to file an application for

national law. Guideline 3: Programme of operations

3.1. The programme of operations to be provided by the applicant should contain the following information:

• a) a description of the account information service that is intended to be provided, including an explanation of how the applicant determined that the activity fits the definition of account information services as defined in Article 4(16) of Directive (EU) 2015/2366 (PSD2);
• b) a declaration of the applicant that they will not enter at any time into possession of funds;
• c) a description of the provision of the account information service including:
• i. draft contracts between all the parties involved, if applicable;
• ii. terms and conditions of the provision of the account information services;
• iii. processing times;
• d) the estimated number of different premises from which the applicant intends to provide the services, if applicable;
• e) a description of any ancillary services to the account information service, if applicable;
• f) a declaration of whether or not the applicant intends to provide account information services in another EU Member State or another country once registered;
• g) an indication of whether the applicant intends, for the next three years, to provide, or already provides, business activities other than account information services as referred to in Article 18 of Directive 2015/2366, including a description of the type and expected volume of the activities;
• h) the information specified in EBA Guidelines on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantee under Article 5(4) of Directive (EU) 2015/2366 (EBA/GL/2017/08) where the applicant intends to provide only service 8 (AIS).

Guideline 4: Business plan

4.1. The business plan to be provided by the applicant should contain:

• a) a marketing plan consisting of:
• i. an analysis of the company’s competitive position;
• ii. a description of account information service users in the account information market segment concerned, marketing materials and distribution channels;
• b) certified annual accounts for the previous three years, if available, or a summary of the financial situation for those applicants that have not yet produced annual accounts;
• c) a forecast budget calculation for the first three financial years that demonstrates that the applicant is able to employ appropriate and proportionate systems, resources and procedures that allow the applicant to operate soundly; it should include:
• i. an income statement and balance-sheet forecast, including target scenarios and stress scenarios as well as their base assumptions, such as number of clients, pricing and expected increase in profitability threshold;
• ii. explanations of the main lines of income and expenses, the financial debts and the capital assets;
• iii. a diagram and detailed breakdown of the estimated cash flows for the next three years.

Guideline 5: Structural organisation

applicant’s undertaking should contain the following information:

• a) an overall forecast of the staff numbers for the next three years;
• b) a description of the relevant operational outsourcing arrangements consisting of:
• i. the identity and geographical location of the outsourcing provider;
• ii. the identities of the persons within the AISP that are responsible for each of the outsourced activities;
• iii. a detailed description of the outsourced activities and its main characteristics;
• c) a copy of draft outsourcing agreements;
• d) if applicable, a description of the use of branches and agents, including:
• i. a mapping of the off-site and on-site checks that the applicant intends to perform of branches and agents;
• ii. the IT systems, processes and infrastructure that are used by the applicant’s agents to perform activities on behalf of the applicant;
• iii. in the case of agents, the selection policy, monitoring procedures and agents’ training and, where available, the draft terms of engagement;
• e) a list of all natural or legal persons that have close links with the applicant AISP, indicating their identity and the nature of those links.

5.2. If the applicant is a legal person, the description of the structural organisation of its undertaking should contain the following information:

• a) a detailed organisational chart, showing each division, department or similar structural separation, including the name of the person(s) responsible, in particular those in charge of internal control functions; the chart should be accompanied by a description of the functions and responsibilities of each division, department or similar structural separation;
• b) an overall forecast of the staff numbers for the next three years;
• c) a description of the relevant outsourcing arrangements consisting of:
• i. the identity and geographical location of the outsourcing provider;
• ii. the identities of the persons within the AISP that are responsible for each of the outsourced activities;
• iii. a detailed description of the outsourced activities and its main characteristics;
• d) a copy of draft outsourcing agreements;
• e) if applicable, a description of the use of branches and agents, including:
• i. a mapping of the off-site and on-site checks that the applicant intends to perform of branches and agents;
• ii. The IT systems, processes and infrastructures that are used by the applicant’s agents to perform activities on behalf of the applicant;
• iii. in the case of agents, the selection policy, monitoring procedures and agents’ training and, where available, the draft terms of engagement;
• f) a list of all natural or legal persons that have close links with the applicant, indicating their identities and the nature of those links. Guideline 6: Governance arrangements and internal control mechanisms

6.1. The applicant should provide a description of the governance arrangement and internal control mechanisms consisting of:

• a) a mapping of the risks identified by the applicant, including the type of risks and the procedures the applicant will put in place to assess and prevent such risks;
• b) the different procedures intended to carry out periodical and permanent controls, including the frequency, and the human resources allocated;
• c) the accounting procedures by which the applicant will record and report its financial information;
• d) the identity of the person(s) responsible for the internal control functions, including for the periodic, permanent and compliance controls, as well as an up-to-date curriculum vitae;
• e) the identity of any auditor that is not a statutory auditor pursuant to Directive 2006/43/EC;
• f) the composition of the management body and, if applicable, any other oversight body or committee;
• g) a description of the way outsourced functions are monitored and controlled so as to avoid an impairment in the quality of the applicant’s internal controls;
• h) a description of the way any agents and branches are monitored and controlled within the framework of the applicant’s internal controls;
• i) where the applicant is the subsidiary of a regulated entity in another EU Member State, a description of the group governance.

Guideline 7: Procedure for monitoring, handling and following up on security incidents and security-related customer complaints

7.1. The applicant should provide a description of the procedure in place to monitor, handle and follow up on security incidents and security-related customer complaints to be provided by the applicant, which should contain:

• a) organisational measures and tools for the prevention of fraud;
• b) details of the individuals and bodies responsible for assisting customers in cases of fraud, technical issues and/or claim management;
• c) reporting lines in cases of fraud;
• d) the contact point for customers, including a name and email address;
• e) the procedures for the reporting of incidents, including the communication of these reports to internal or external bodies, including the notification of major incidents to national competent authorities under Article 96 of PSD2 and in line with EBA guidelines on incident reporting under the referred Article.
• f) the monitoring tools used and the follow-up measures and procedures in place to mitigate security risks.

Guideline 8: Process in place to file, monitor, track and restrict access to sensitive payment data

8.1. The applicant should provide a description of the process in place to file, monitor, track, and restrict access to sensitive payment data consisting of:

• a) a description of the flow of data classified as sensitive payment data in the context of the AISP’s business model;
• b) the procedures in place to authorise access to the sensitive payment data;
• c) a description of the monitoring tool;
• d) the access right policy, detailing access to all relevant infrastructure components and systems, including databases and back-up infrastructures;
• e) a description of how the collected data are filed;
• f) the expected internal and/or external use of the collected data, including by counterparties;
• g) the IT system and technical security measures that have been implemented, including encryption and/or tokenisation;
• h) identification of the individual(s), bodies and/or committee(s) with access to the sensitive payment data;
• i) an explanation of how breaches will be detected and addressed;
• j) an annual internal control programme in relation to the safety of the IT systems. Guideline 9: Business continuity arrangements

9.1. The applicant should provide a description of the business continuity arrangements consisting of the following information:

• a) a business impact analysis, including the business processes and recovery objectives, such as recovery time objectives, recovery point objectives and protected assets;
• b) the identification of the back-up site, access to IT infrastructure, and the key software and data to recover from a disaster or disruption;
• c) an explanation of how the applicant will deal with significant continuity events and disruptions, such as the failure of key systems; the loss of key data; the inaccessibility of the premises; and the loss of key persons;
• d) the frequency with which the applicant intends to test the business continuity and disaster recovery plans, including how the results of the testing will be recorded.

Guideline 10: Security policy document

10.1. The applicant should provide a security policy document containing the following information:

• a) a detailed risk assessment of the payment service(s) the applicant intends to provide, which should include risks of fraud and the security control and mitigation measures taken to adequately protect payment service users against the risks identified;
• b) a description of the IT systems, which should include:
• i. the architecture of the systems and their network elements;
• ii. the business IT systems supporting the business activities provided, such as the applicant’s website, the risk and fraud management engine, and customer accounting;
• iii. the support IT systems used for the organisation and administration of the AISP,

relationship management, e-mail servers and internal file servers;

• iv. information on whether or not those systems are already used by the AISP or its group, and the estimated date of implementation, if applicable;
• c) the type of authorised connections from outside, such as with partners, service providers, entities of the group and employees working remotely, including the rationale for such connections;
• d) for each of the connections listed under point c), the logical security measures and mechanisms in place, specifying the control the payment institution will have over such access as well as the nature and frequency of each control, such as technical versus organisational; preventative versus detective; real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation

confidentiality of communication, intrusion detection, antivirus systems and logs;

• e) the logical security measures and mechanisms that govern the internal access to IT systems, which should include:
• i. the technical and organisational nature and frequency of each measure, such as whether it is preventative or detective and whether or not it is carried out in real time;
• ii. how the issue of client environment segregation is dealt with in cases where the applicant’s IT resources are shared;
• f) the physical security measures and mechanisms of the premises and the data centre of the applicant, such as access controls and environmental security;
• g) the security of the payment processes, which should include:
• i. the customer authentication procedure used for both consultative and transactional access;
• ii. an explanation of how safe delivery to the legitimate payment service user and the integrity of authentication factors, such as hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal;
• iii. a description of the systems and procedures that the applicant has in place for transaction analysis and the identification of suspicious or unusual transactions.
• h) a detailed risk assessment in relation to its payment services, including fraud, with a link to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed;
• i) a list of the main written procedures in relation to the applicant’s IT systems or, for procedures that have not yet been formalised, an estimated date for their finalisation.

Guideline 11: Identity and suitability assessment of directors and persons responsible for the management of the account information service provider

11.1. For the purposes of the identity and suitability assessment of directors and persons responsible for the management of the account information service provider, the applicant should provide the following information:

• a) personal details, which should include:
• i. the full name, gender, place and date of birth, address and nationality, and personal identification number or copy of ID card or equivalent;
• ii. details of the position for which the assessment is sought, and whether or not the management body position is executive or non-executive; this should also include the following details:

• b) where applicable, information on the suitability assessment carried out by the applicant, which should include details of the result of any assessment of the suitability of the individual performed by the institution, such as relevant board minutes or suitability assessment reports or other documents;
• c) evidence of knowledge, skills and experience, which should include a curriculum vitae containing details of education and professional experience, including academic qualifications, other relevant training, the name and nature of all organisations for which the individual works or has worked, and the nature and duration of the functions performed, in particular highlighting any activities within the scope of the position sought;
• d) evidence of reputation, honesty and integrity, which should include:
• i. criminal records and relevant information on criminal investigations and proceedings, relevant civil and administrative cases, and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures, notably through an official certificate or any objectively reliable source of information concerning the absence of criminal conviction, investigations and proceedings, such as third-party investigations, testimonies made by a lawyer or a notary established in the European Union;
• ii. a statement as to whether or not criminal proceedings are pending or the person or any organisation managed by him or her has been involved as a debtor in insolvency proceedings or comparable proceedings;
• iii. information concerning the following:

Guideline 12: Professional indemnity insurance or a comparable guarantee

12.1. As evidence of a professional indemnity insurance or comparable guarantee that is compliant with the EBA Guidelines on Professional Indemnity Insurance (EBA/GL/2017/08) and Articles 5(2)and 5(3) of PSD2 the applicant should provide the following information:

• a) an insurance contract or other equivalent document confirming the existence of professional indemnity insurance or a comparable guarantee, with a cover amount that is compliant with the referred EBA Guideline showing the coverage of the relevant liabilities;
• b) documentation of how the applicant has calculated the minimum amount in a way that is compliant with the referred EBA Guidelines, including all applicable components of the formula specified therein.

1. Forbhreathnú

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

3. Caighdeáin ghaolmhara

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/