4 ms·

You have to be a company. You also have to be regulated as an AISP or PISP (Account Information/Payment Initiation Service Provider). So there are some hurdles

You have to be a company. You also have to be regulated as an AISP or PISP (Account Information/Payment Initiation Service Provider). So there are some hurdles.

insomniacity 9y ago
That is disappointing. I wonder if anyone is doing the legal analysis on what it would take to be a 'passthrough provider', who would simply wrap it up in an easier API with a simple TOS.
- chirau 9y ago
  Teller.io is doing this. You might want to look into what licenses they needed to get.
  - OJFord 9y ago
    No it isn't, at least, not yet - it asks for all the user login information including passwords and security numbers required for a normal login. Edit: And unfortunately, it doesn't seem even to have any intention of using it: https://twitter.com/stevegraham/status/951163378424217600 https://twitter.com/stevegraham/status/951163378424217600
    - ErrantX 9y ago
      Teller is interesting; I have some reservations (mostly around the attitude they portray, which is a bit unprofessional) but they have a good vision. The downside is they are encouraging you to share passwords, as you say, which isn't driving the right customer behaviour. More critically; in about 18 months the PSD2 Secure Customer Authentication guidance comes into force and this sort of approach (sharing credentials, which everyone basically refers to as "screen scraping" in its various forms) will be dis-favourer, to the extent that banks might have to go to great lengths to try and stop it. Teller might have to go forward fighting continual reverse engineering battles.
      - insomniacity 9y ago
        I think we've independently arrived at exactly the same point with our reservations. In particular I'm concerned that Teller will have a massive target painted on it's back, because it has those full login details - they could become systemically important to the UK banking system, and then perhaps the regulator should step in!
      - OJFord 9y ago
        It's already against the typical bank's terms of service for a user to provide them. Not to mention a silly thing to do. But the average user seems just blindly trusts these things - tools like 'You Need a Budget' ask for the same.
        sjtgraham 9y ago
        Founder here. This is incorrect. It is no longer against the terms of service of any European bank as of today thanks to PSD2.
        Silhouette 9y ago
        It can no longer be against the terms of service of financial service providers to prohibit sharing the credentials used to access your accounts on their systems?
        sjtgraham 9y ago
        Yes, every UK bank had to write to their customers updating their terms allowing such activity end of last year.
        Silhouette 9y ago
        I have accounts with several banks and other financial services, and I have received various updates to terms in connection with PSD2 over the past few months. However, I don't recall any of them saying it was now OK to share things like passwords or PINs. Are we talking at cross-purposes here? Encouraging non-experts to share security credentials that give unrestricted access to their accounts with third parties is so obviously dangerous that I find it hard to believe that (a) the financial providers are now required by law to do it, and (b) not a single one of the updates I received from mine drew attention to this in any way that I noticed and recall now. Surely the entire point of the new access paths under PSD2 is that the financial providers don't have to endorse the dangerous practice, and can instead provide an alternative way to achieve similar results but with much better control and regulation to protect all involved?
    - sjtgraham 9y ago
      We actually don’t do this where we we have an option to, i.e. with Barclays and Nationwide. Regardless, users giving credentials to 3rd parties is not against the terms of any bank in the EU and it’s contrary to EU law for them to make it so. Banks are also on the hook for liability in the first instance and must immediately make good any customer loss, although they can pursue the 3rd party.
  - scraplab 9y ago
    Teller isn't part of the PSD2/Open Banking world. They've reversed engineered all the bank's private APIs for their mobile apps, in part because they believe the banks will hobble and cripple the Open Banking APIs because it's in competition with their business model.
- ErrantX 9y ago
  I think that will come. It will take a bit of time for comfort to set in (both with the consumer and the banks) but I definitely see this as the first step. (edit; in addition the psd2 legislatiob, and specifically the technical guidance, does touch on concepts like 4th party, relaying parties and technical partners - so the exoectation of the regulator is that this will emerge)
  - sambe 9y ago
    I'm struggling with the enterprise-y terminology. It sounds like: * your bank is an "ASPSP" * the second party is you * the company (third party) is the AISP So each individual company that needs to access your information is an AISP (or PISP for initiating payments)? Your accountant might be an AISP and your water company a PISP? And FCA requirements are (https://www.fca.org.uk/firms/new-regulated-payment-services-ais-pis https://www.fca.org.uk/firms/new-regulated-payment-services-...): "For businesses that only carry on account information services, there is an option to become a ‘registered account information service provider’. These providers have no capital requirements and need to meet fewer conditions than authorised firms. Businesses that provide payment initiation services must be authorised and must have a minimum of €50,000 in initial capital (or higher if they provide certain other payment services). Both AISPs and PISPs have to hold professional indemnity insurance (PII). The EBA has developed Guidelines on PII (link is external)." Correct? This doesn't specifically rule out being a relay, but I guess there is more detail/restrictions in another document. See also: https://www.out-law.com/en/articles/2017/june/fca-urged-to-account-for-all-business-models-in-its-approach-to-psd2/ https://www.out-law.com/en/articles/2017/june/fca-urged-to-a...
    - ErrantX 9y ago
      Yes that is an accurate summary.
- Angostura 9y ago
  IT's not disapointing if you ever want consumers to actually trust the system. Even I'm not convinced about opting in yet.
- rahimnathwani 9y ago
  There are a bunch of companies doing exactly this, usually with some value-added service on top (e.g. categorisation).

You have to be a company. You also have to be regulated as an AISP or PISP (Account Information/Payment Initiation Service Provider). So there are some hurdles.

insomniacity 9y ago

That is disappointing. I wonder if anyone is doing the legal analysis on what it would take to be a 'passthrough provider', who would simply wrap it up in an easier API with a simple TOS.

chirau 9y ago
Teller.io is doing this. You might want to look into what licenses they needed to get.
- OJFord 9y ago
  No it isn't, at least, not yet - it asks for all the user login information including passwords and security numbers required for a normal login. Edit: And unfortunately, it doesn't seem even to have any intention of using it: https://twitter.com/stevegraham/status/951163378424217600 https://twitter.com/stevegraham/status/951163378424217600
  - ErrantX 9y ago
    Teller is interesting; I have some reservations (mostly around the attitude they portray, which is a bit unprofessional) but they have a good vision. The downside is they are encouraging you to share passwords, as you say, which isn't driving the right customer behaviour. More critically; in about 18 months the PSD2 Secure Customer Authentication guidance comes into force and this sort of approach (sharing credentials, which everyone basically refers to as "screen scraping" in its various forms) will be dis-favourer, to the extent that banks might have to go to great lengths to try and stop it. Teller might have to go forward fighting continual reverse engineering battles.
    - insomniacity 9y ago
      I think we've independently arrived at exactly the same point with our reservations. In particular I'm concerned that Teller will have a massive target painted on it's back, because it has those full login details - they could become systemically important to the UK banking system, and then perhaps the regulator should step in!
    - OJFord 9y ago
      It's already against the typical bank's terms of service for a user to provide them. Not to mention a silly thing to do. But the average user seems just blindly trusts these things - tools like 'You Need a Budget' ask for the same.
      - sjtgraham 9y ago
        Founder here. This is incorrect. It is no longer against the terms of service of any European bank as of today thanks to PSD2.
        Silhouette 9y ago
        It can no longer be against the terms of service of financial service providers to prohibit sharing the credentials used to access your accounts on their systems?
        sjtgraham 9y ago
        Yes, every UK bank had to write to their customers updating their terms allowing such activity end of last year.
        Silhouette 9y ago
        I have accounts with several banks and other financial services, and I have received various updates to terms in connection with PSD2 over the past few months. However, I don't recall any of them saying it was now OK to share things like passwords or PINs. Are we talking at cross-purposes here? Encouraging non-experts to share security credentials that give unrestricted access to their accounts with third parties is so obviously dangerous that I find it hard to believe that (a) the financial providers are now required by law to do it, and (b) not a single one of the updates I received from mine drew attention to this in any way that I noticed and recall now. Surely the entire point of the new access paths under PSD2 is that the financial providers don't have to endorse the dangerous practice, and can instead provide an alternative way to achieve similar results but with much better control and regulation to protect all involved?
  - sjtgraham 9y ago
    We actually don’t do this where we we have an option to, i.e. with Barclays and Nationwide. Regardless, users giving credentials to 3rd parties is not against the terms of any bank in the EU and it’s contrary to EU law for them to make it so. Banks are also on the hook for liability in the first instance and must immediately make good any customer loss, although they can pursue the 3rd party.
- scraplab 9y ago
  Teller isn't part of the PSD2/Open Banking world. They've reversed engineered all the bank's private APIs for their mobile apps, in part because they believe the banks will hobble and cripple the Open Banking APIs because it's in competition with their business model.
ErrantX 9y ago
I think that will come. It will take a bit of time for comfort to set in (both with the consumer and the banks) but I definitely see this as the first step. (edit; in addition the psd2 legislatiob, and specifically the technical guidance, does touch on concepts like 4th party, relaying parties and technical partners - so the exoectation of the regulator is that this will emerge)
- sambe 9y ago
  I'm struggling with the enterprise-y terminology. It sounds like: * your bank is an "ASPSP" * the second party is you * the company (third party) is the AISP So each individual company that needs to access your information is an AISP (or PISP for initiating payments)? Your accountant might be an AISP and your water company a PISP? And FCA requirements are (https://www.fca.org.uk/firms/new-regulated-payment-services-ais-pis https://www.fca.org.uk/firms/new-regulated-payment-services-...): "For businesses that only carry on account information services, there is an option to become a ‘registered account information service provider’. These providers have no capital requirements and need to meet fewer conditions than authorised firms. Businesses that provide payment initiation services must be authorised and must have a minimum of €50,000 in initial capital (or higher if they provide certain other payment services). Both AISPs and PISPs have to hold professional indemnity insurance (PII). The EBA has developed Guidelines on PII (link is external)." Correct? This doesn't specifically rule out being a relay, but I guess there is more detail/restrictions in another document. See also: https://www.out-law.com/en/articles/2017/june/fca-urged-to-account-for-all-business-models-in-its-approach-to-psd2/ https://www.out-law.com/en/articles/2017/june/fca-urged-to-a...
  - ErrantX 9y ago
    Yes that is an accurate summary.
Angostura 9y ago
IT's not disapointing if you ever want consumers to actually trust the system. Even I'm not convinced about opting in yet.
rahimnathwani 9y ago
There are a bunch of companies doing exactly this, usually with some value-added service on top (e.g. categorisation).