AustraliaNow Live
·Australian banks now supported via CDR.Browse AU banks
BankSync

PSD2, explained in plain language

What the European open banking directive actually does, who the AISPs are, how 180-day consents and SCA work, and which regulator supervises your country.

Start free trialBrowse coverage by country →

  1. Your bank

    Holds the data

    Asks you to authenticate with two factors (SCA).

  2. Licensed AISP

    Salt Edge

    Holds the PSD2 permissions, supervised by a national authority.

  3. The service you use

    BankSync

    Never touches your credentials. Read-only by law.

  4. Where it lands

    Your sheet or database

    Read-only rows, on the schedule you pick.

You approve on your bank's own pages under Strong Customer Authentication. Most EEA banks then issue a consent of up to 180 days.

PSD2 / Open Banking, in short.

Regulator
European Banking Authority (EBA)
How it works
The Revised Payment Services Directive (PSD2) mandates regulated open banking access across the EU and EEA. BankSync connects through licensed AISPs authorised under PSD2 across the union.
Connection
Connections are made through licensed AISPs authorised under PSD2.
References
PSD2 regulationEBA register

One directive, thirty markets.

PSD2 turned bank data access from a scraping grey zone into a regulated right. Every bank in the EU and EEA must operate secure APIs, and only licensed providers may use them. Consent is granted on your bank's own pages under Strong Customer Authentication, scoped to account information, and revocable at any time.

Banks, AISPs, and national regulators

The directive is EU law, but supervision is national: each country's competent authority licenses and oversees the providers operating there, with the European Banking Authority keeping the central register. BankSync connects through Salt Edge, a licensed AISP, which holds the regulatory permissions so you do not have to.

Consents of up to 180 days

Since the 2023 amendment to the SCA technical standards, banks may issue account information consents lasting up to 180 days, and most EEA banks now do. Each bank sets its own window. BankSync tracks the expiry per connection and prompts you to renew with a quick re-authentication before data flow stops.

Use PSD2 data over an API

Read your own European transactions and balances as JSON over REST or MCP, through the same licensed AISP connection. See the open banking API →

National competent authorities.

The regulator responsible for PSD2 supervision in each country BankSync covers. Each country name links to its coverage page.

Austria
FMA (Austrian Financial Market Authority)
Belgium
National Bank of Belgium (NBB)
Bulgaria
Bulgarian National Bank (BNB)
Croatia
Croatian National Bank (Hrvatska narodna banka, HNB)
Cyprus
Central Bank of Cyprus
Czechia
Czech National Bank (Česká národní banka, CNB)
Denmark
Danish Financial Supervisory Authority (Finanstilsynet)
Estonia
Finantsinspektsioon (Estonian Financial Supervision and Resolution Authority)
Finland
Financial Supervisory Authority (Finanssivalvonta, FIN-FSA)
France
ACPR (Autorité de contrôle prudentiel et de résolution)
Germany
BaFin (Federal Financial Supervisory Authority)
Greece
Bank of Greece
Hungary
Magyar Nemzeti Bank (Central Bank of Hungary, MNB)
Iceland
Central Bank of Iceland (Seðlabanki Íslands)
Ireland
Central Bank of Ireland
Italy
Banca d'Italia (Bank of Italy)
Latvia
Latvijas Banka (Bank of Latvia; absorbed the FCMC as PSD2 competent authority in 2023)
Liechtenstein
Financial Market Authority Liechtenstein (FMA)
Lithuania
Bank of Lithuania (Lietuvos bankas)
Luxembourg
CSSF (Commission de Surveillance du Secteur Financier)
Malta
Malta Financial Services Authority (MFSA)
Netherlands
DNB (De Nederlandsche Bank)
Norway
Financial Supervisory Authority of Norway (Finanstilsynet)
Poland
Polish Financial Supervision Authority (Komisja Nadzoru Finansowego, KNF)
Portugal
Banco de Portugal (Bank of Portugal)
Romania
National Bank of Romania (Banca Națională a României, BNR)
Slovakia
National Bank of Slovakia (Národná banka Slovenska, NBS)
Slovenia
Bank of Slovenia (Banka Slovenije)
Spain
Banco de España (Bank of Spain)
Sweden
Swedish Financial Supervisory Authority (Finansinspektionen)

Questions, answered.

What is PSD2?

The revised Payment Services Directive is the EU law that requires banks across the EEA to give regulated third parties secure access to payment account data when the account holder consents. It created the legal category of Account Information Service Providers (AISPs) and mandated the APIs banks now operate.

What is an AISP?

An Account Information Service Provider is a company licensed under PSD2 to read account data with your consent. BankSync connects through Salt Edge, a licensed AISP, so credentials never touch BankSync and access is read-only by law.

How long does PSD2 consent last?

Consent duration is set per bank. Since the 2023 update to the SCA regulatory technical standards, most EEA banks issue consents of up to 180 days before a re-authentication is required. BankSync shows the expiry on each connection and prompts you to renew before it lapses.

Does PSD2 cover all of Europe?

PSD2 applies across the EU and, via the EEA agreement, in Norway, Iceland, and Liechtenstein. The UK has an equivalent framework (UK Open Banking under FCA supervision) which BankSync also supports.

What is SCA?

Strong Customer Authentication: the requirement that you prove your identity to your bank with two independent factors when granting access. It is why connecting a bank routes you to your bank’s own app or login page rather than typing credentials into a third party.

Put PSD2 to work.

Start free trialView pricing →