DORA: A New Challenge for Account Information Service Providers (AISPs)

In the evolving landscape of European financial regulation, the Digital Operational Resilience Regulation (DORA) has emerged as a turning point for various stakeholders within the financial sector. Among those most affected are Account Information Service Providers (AISPs), entities that deserve particular attention due to the specific nature of their activities and the inherent risks involved.

We also present this collaboration in video format, which you can view below, in case you prefer that medium:

What Are Account Information Service Providers (AISPs)?

It is important to first understand the distinction between “payment institutions” and “entities providing account information services.”

Entities previously referred to as “Payment Initiation Service Providers” (PISPs) are now designated as “Account Information Service Providers” (AISPs). These entities are restricted to the provision of account information services and, as such, benefit from a partial exemption from the regulatory framework applicable to full payment institutions. Consequently, the exclusive and limited scope of activities permitted to such entities is clearly delineated. The law allows AISPs to engage only in business activities other than payment services, as well as operational or ancillary services directly related to their core function.

Before delving into DORA’s impact, it is essential to understand precisely what AISPs are. These providers, as defined in Article 33(1) of Directive (EU) 2015/2366 (PSD2), are entities offering online services that provide consolidated information regarding one or more payment accounts held by a user with one or more payment service providers.

Examples of AISPs include:

1. Personal finance management applications that aggregate data from multiple bank accounts.
2. Accounting platforms for businesses that integrate real-time banking data.
3. Financial product comparison services that use account data to offer tailored recommendations.

Si te ha interesado este artículo no dudes en leer:

DORA: key contractual clauses for access, inspection and audit of ICT providers

Learn how the DORA Regulation establishes access, inspection, and audit rights in ICT service contracts to ensure digital operational resilience in the financial sector.

The Impact of DORA on AISPs

DORA affects AISPs in a particularly significant manner for several reasons:

1. Explicit Inclusion: Unlike previous regulations, DORA explicitly includes AISPs within its scope. This means these entities must comply with all digital operational resilience requirements set forth in the Regulation.
2. ICT Risk Management: Given their handling of sensitive financial data, AISPs are required to implement robust ICT risk management frameworks. This includes adopting a three-lines-of-defence model and conducting regular internal audits.
3. Governance and Strategy: While distinctions are made for microenterprises, the majority of AISPs will need to establish more complex governance mechanisms. This entails setting up dedicated management functions to oversee contracts with third-party ICT service providers and to address crisis management planning.
4. Enhanced Supervision: The competent authority designated pursuant to Article 22 of Directive (EU) 2015/2366 will be responsible for supervising AISP compliance with DORA. This may result in increased regulatory scrutiny.
5. Resilience Testing: AISPs will be subject to periodic digital resilience testing to assess their preparedness for ICT-related incidents.

Final Considerations

The inclusion of AISPs within the scope of DORA reflects their growing significance in the digital financial ecosystem. While compliance with these new regulations may pose an initial challenge, particularly for smaller entities, it also presents an opportunity to build user trust and enhance operational resilience.

AISPs should view DORA not merely as a set of regulatory obligations, but as a framework for improving ICT risk management and governance practices. Those who proactively implement these measures will be better positioned to succeed in an increasingly digital and regulated financial environment.

Ultimately, DORA aims to foster a more resilient and secure European financial sector. For AISPs, adapting to these new requirements is not only a legal obligation but also an investment in their future and the trust of their clients.

If you enjoyed this article, you may also be interested in reading the following:

DORA and the Risk of Third-Party Concentration in ICT: A Sustainable Balance?

Related tool, free to use: the AI Act compliance tools.

Don’t be left in doubt, get in touch. We’ll be happy to help and offer you solutions.