PSD2 is the European Union directive that opened bank payment accounts to licensed third parties, mandating that banks provide access to accounts (XS2A) for account-information and payment-initiation services under strong customer authentication. It is the legal foundation of open banking across the EU and, as retained law, the UK — implemented technically by the OBIE standard in the UK and the Berlin Group NextGenPSD2 framework across the continent.
PSD2
Directive European Union / United Kingdom
PSD2 — the Revised Payment Services Directive — is the European law that pried open bank payment accounts. It requires banks (account servicing payment service providers) to let licensed third parties, with the customer’s consent, access account information and initiate payments, and it banned the credential-sharing screen-scraping the fintech ecosystem had quietly run on.
- Access to Account (XS2A) - The core obligation: banks must expose an interface for Account Information Services (AIS) and Payment Initiation Services (PIS), so a third party can read balances and transactions and move money under consent.
- Payment initiation, not just data - PSD2 gave the ecosystem something to do, not just something to read — the write surface that distinguishes European and UK open banking from read-only regimes.
- Retained in UK law - Post-Brexit, PSD2 continues as retained UK law, which is why the UK’s OBIE standard and the EU’s Berlin Group framework are two implementations of one directive.
PSD2 is the regulation I hold up as the one that worked — with a caveat. Where a market paired it with conformance and a delivery body (the UK), it produced working, actionable APIs; where it was implemented as a framework each bank profiled locally (much of the continent), it multiplied into national and per-bank flavors. The law was right; the execution decided the result.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
UK Open Banking Standard
The OBIE Read/Write specification implements PSD2's access-to-account obligation in the UK.
Berlin Group NextGenPSD2
The XS2A framework most EU banks implement to satisfy PSD2's dedicated-interface requirement.
Reaches these HTTP headers
Where a regulation actually touches the wire. Mandated means the law, or a technical standard it makes binding, names this header. Evidentiary means no law names it, but it is the deployed control for an obligation the law does impose. Inferred means it would be good evidence and nothing requires it — interesting to read, never to score.
consent-id
mandated
credentialed only
A consent — a legal artifact with a lawful basis behind it — reduced to an identifier in a request header. Read alongside [[gdpr]].
digest
mandated
credentialed only
psu-id
mandated
credentialed only
psu-ip-address
mandated
credentialed only
signature
mandated
credentialed only
Berlin Group requires signed requests; the signature travels here.
tpp-signature-certificate
mandated
credentialed only
x-fapi-auth-date
mandated
credentialed only
via fapi
x-fapi-customer-ip-address
mandated
credentialed only
via fapi
x-fapi-customer-last-logged-time
mandated
credentialed only
via fapi
x-fapi-interaction-id
mandated
credentialed only
via fapi
Carried into PSD2 implementations through the FAPI security profile.
deprecation
evidentiary
in the contract
via http
The RTS testing and change-notification windows have to be signalled somehow.
retry-after
evidentiary
observable at the edge
RTS Article 32 requires a dedicated interface to perform at least as well as the customer interface and not obstruct. How a provider throttles a TPP is a regulatory question, and this header is where it surfaces.
Referenced on the API Evangelist blog
Where this regulation shows up across sixteen years of my writing at apievangelist.com — how it fits into API design, governance, and the agentic turn.
US Companies Getting Ahead Of EU Regulations
2018-03-07
A Regulatory Subway Map For PSD2
2018-02-03
