The following article is excerpted from the AFP Payments Guide, The New Generation of Third-Party Providers, underwritten by DBS.

At the heart of the revised Payment Services Directive (PSD2) is the access to customers’ payment accounts held by banks through application programming interfaces (APIs). PSD2 obliges banks to grant access to payment accounts to two new types of third-party providers: Payment Initiation Service Providers (PISPs) and Account Information Service Providers (AISPs). PSD2 gives banks and similar institutions the denomination Account Servicing Payment Service Providers (ASPSPs) to emphasize the difference between the institutions that hold customer accounts and the new players that merely access them through so-called open APIs.

The European Commission is convinced that these new players can offer cheaper innovative products to benefit consumers, corporates and the European economy. Let’s start by evaluating PISPs and the services that they provide.

PAYMENT INITIATION SERVICE PROVIDERS (PISPs)

PISPs are able to issue payment instruments and initiate online and mobile payments to beneficiaries (businesses or people) directly from the payer’s bank account. Before accessing a customer’s account, a PISP must receive their formal approval and consent. A connection to the payer’s bank systems is then required to access and debit the payment account through a payment instruction given by the PISP. The PISP needs to know the account information of the beneficiaries (their customers) to which it is sending the funds. Consequently, PISPs must build connections and manage relationships to payment service users (PSUs) and to their account holders, the banks (ASPSPs).

The Role of a PISP

The first playing field for PISPs will be online payments. That is the area where the European Commission and experts see many opportunities for disruption and innovation. Since the majority of online payments today are made with cards, let’s see how PISPs impact the traditional Four Corner Model for online card payments, and what it means for corporates.

FIGURE 1. THE FOUR CORNER MODEL

Source: Jean Paul Megue.

In the classic Four Corner Model, there is no PISP and the four parties exchange information among themselves. Banks use card networks for card transaction information exchange, clearing and settlement.

When a PISP is introduced, it needs to establish connections with at least three parties: the consumer, the consumer’s bank and the corporate. But it eventually needs to connect to the corporate’s bank too.

1. Connection to the consumer (type of PSU): The PISP must connect with the consumer to get consent and collect data regarding identity and account details. Note that a PSU is “a physical or legal person making use of a payment service in the capacity of payer, payee, or both.”
2. Connection to the corporate: The PISP will earn money primarily by helping corporates to get paid easier and faster. PISPs need to sign an agreement with corporates to initiate payments from consumers’ accounts to their favor. That requires gathering some information about the corporate and its activity (know-your-customer and due diligence).
3. Connection to the consumer’s bank (issuing bank in the classic Four Corner Model): The PISP must access the consumer’s bank to initiate the payment from her/his account. PISPs should use open APIs to initiate payments from customer’s accounts. PDS2 enforces an Access to Account (XS2A) rule mandating banks (ASPSPs) to facilitate secure access via APIs to their customer accounts. This PISP-to-bank communication is crucial to open banking. Unless common technical standards are defined and widely adopted, open banking will not become a reality. Unfortunately, the PDS2 Regulatory Technical Standards (RTS) for strong customer authentication and common and secure open standards of communication do not provide a single EU-wide API standard. In the short term, this will negatively impact the speed to market for PISP and ultimately for their customers, the corporates.

   What happens after the PISP has initiated the payment on behalf of the consumer? The consumer’s bank moves the funds to credit the corporate account through an ACH transfer. It is simpler and cheaper than card payments requiring to use the rather expensive card networks.

4. Connection to the corporate’s bank (acquiring bank): This connection is needed if the corporate decides to use the PISP solutions as well to initiate payments (expense payments made online for instance) or to refund their customers in case of dispute. Other use cases like supplier payments or salary payments are possible. The PISP must have the formal consent of the corporate before initiating payments from its account(s).

Two Opportunities that PISPs Offer Corporates

Online payments fees reduction: Expensive fees related to the online card-based transactions can be reduced significantly, since PISPs initiate a credit transfer to debit the customer’s account and credit the merchant’s account. Online credit transfers are cheaper than online card payments and will allow PISPs to generate revenues while at the same time reducing online card processing fees and costs for corporates.

Faster cashing and better liquidity: Today, corporates generally collect cash two or more days after the online card transaction is initiated. By pushing the funds, PISPs can credit corporates’ accounts instantaneously (SEPA Credit Transfer Instant) or in one maximum one business day (SEPA Credit Transfer Classic). Cash flow can thus be improved.

Potential Risks for Corporates  

Security and reputational risk: Corporates must build and manage a new relationship to the PISP in a sensitive area—accounts receivable. Their information and reputation are at stake. If a PISP’s security is compromised, the reputation of all companies working with that PISP might be affected. So it is important to check the background of a PISP before engaging in the business relationship. Take time to control what they do on a regular basis and ensure that they improve their customer services and comply with the evolving regulation.

Dependency risk: If the PISP becomes unavailable for a length of time, what impact would it have on the business? Getting paid is so important that this question should not be neglected. Each serious business should have a backup plan.

Jean Paul Megue has over 12 years of experience in payments and has carried out multiple projects internationally. Based in Paris, he runs the blog Paiementor.com. His latest book is “SEPA Credit Transfer: How to understand and add value to your SCT payment project.”

For more insights, download  The New Generation of Third-Party Providers.