3 ms·

The problem is that your appliance/container will not be allowed to access the AISP-only APIs provided by the banks, unless your client themselves become an AIS

The problem is that your appliance/container will not be allowed to access the AISP-only APIs provided by the banks, unless your client themselves become an AISP. Not an issue if you're doing screen-scraping though, I agree (although in that case, do you even care about AISP certifications? You can so scraping-as-a-service and in fact there is an entire industry around this already).

GorgeRonde 8y ago
> The problem is that your appliance/container will not be allowed to access the AISP-only APIs provided by the banks, unless your client themselves become an AISP. Makes sense, at least on a technical level. Ditto if I try to place myself as proxy between a business and is PSP. But let me express doubts by referring to the PSD2[1] itself. TL;DR -> I'm not sure offering my product as a container disqualifies it from being a service from a legal standpoint. > Negative scope This Directive shall apply to none of the following: ... services provided by technical service providers, which support the provision of payment services, without them entering at any time into possession of the funds to be transferred, including processing and storage of data, trust and privacy protection services, data and entity authentication, information technology (IT) and communication network provision, provision and maintenance of terminals and devices used for payment services; Yet the definition of a payment service (last page of the document[1]), seems to indeed indicate such a container would be a payment service. > ANNEX PAYMENT SERVICES (DEFINITION 3 IN ARTICLE 4) ... Execution of payment transactions where the consent of the payer to execute a payment transaction is given by means of any telecommunication, digital or IT device and the payment is made to the telecommunication, IT system or network operator, acting only as an intermediary between the payment service user and the supplier of the goods and services. Here is how I understand this: - if I'm offering a database hosting service that happens to be used in a payment system, I'm not tied to the PSD2 (too low level). - however if I manage this data at the semantic level of a payment system, I'm a payment service not matter how far I try to get from what a "service" technically is. Now, here is what doesn't hold with this feeble interpretation: Under these terms, an open-source client to a european PSP (there are many on GitHub) should be regulated by the PSD2... Where do you draw the line ? [1]: PSD2 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32007L0064 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...

GorgeRonde 8y ago

> The problem is that your appliance/container will not be allowed to access the AISP-only APIs provided by the banks, unless your client themselves become an AISP. Makes sense, at least on a technical level. Ditto if I try to place myself as proxy between a business and is PSP. But let me express doubts by referring to the PSD2[1] itself. TL;DR -> I'm not sure offering my product as a container disqualifies it from being a service from a legal standpoint. > Negative scope This Directive shall apply to none of the following: ... services provided by technical service providers, which support the provision of payment services, without them entering at any time into possession of the funds to be transferred, including processing and storage of data, trust and privacy protection services, data and entity authentication, information technology (IT) and communication network provision, provision and maintenance of terminals and devices used for payment services; Yet the definition of a payment service (last page of the document[1]), seems to indeed indicate such a container would be a payment service. > ANNEX PAYMENT SERVICES (DEFINITION 3 IN ARTICLE 4) ... Execution of payment transactions where the consent of the payer to execute a payment transaction is given by means of any telecommunication, digital or IT device and the payment is made to the telecommunication, IT system or network operator, acting only as an intermediary between the payment service user and the supplier of the goods and services. Here is how I understand this: - if I'm offering a database hosting service that happens to be used in a payment system, I'm not tied to the PSD2 (too low level). - however if I manage this data at the semantic level of a payment system, I'm a payment service not matter how far I try to get from what a "service" technically is. Now, here is what doesn't hold with this feeble interpretation: Under these terms, an open-source client to a european PSP (there are many on GitHub) should be regulated by the PSD2... Where do you draw the line ? [1]: PSD2 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32007L0064 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...