PISP (Payment Initiation Service Provider) in Spain

A PISP (payment initiation service provider) is a category of payment service provider regulated by the PSD2 Directive (Directive (EU) 2015/2366) that allows third parties to initiate payments from the user’s bank account, with the user’s express consent, without the user having to go to their bank directly.

The PISP acts as an intermediary between the paying user and the bank where the account is held: it initiates the payment order through the open access interfaces (APIs) that banks must make available to third parties under the PSD2 open banking framework.

PISPs are a key player in the European fintech ecosystem, enabling instant payments, card-free checkout, B2B payment solutions and new business models based on access to payment data.

A PISP (payment initiation service provider) initiates payment orders from the user’s account, while an AISP (account information service provider) only accesses the user’s account information for aggregation, analysis or data presentation, without executing payments.

Both are regulated by PSD2 and require authorization or registration with the competent supervisor, but their obligations differ: PISPs bear greater responsibility for security and authentication because they execute transactions that move funds, while AISPs operate in a read-only environment.

The same entity can obtain dual PISP + AISP authorization if its business model combines payment initiation with account aggregation, which is common in full open banking solutions.

In Spain, authorization as a PISP is obtained from the Bank of Spain, the competent authority for supervising payment institutions under Law 21/2011 on Electronic Money and Royal Decree-law 19/2018 on payment services.

Documents required for the PISP license:

• Program of operations describing the planned payment initiation services.
• Business plan with three-year financial projections.
• Description of the organizational structure and corporate governance.
• Information security policy and operational risk management plan.
• Procedures for managing major incidents and reporting them to the Bank of Spain.
• Internal control and audit mechanisms, and AML/CFT policy.

The authorization process usually takes three to six months from submission of the complete application, depending on the complexity of the business model and the quality of the documentation provided.

Strong customer authentication (SCA) is one of the most demanding requirements for PISPs under PSD2. Before initiating a payment, the PISP must make sure that the user has been authenticated by their bank using at least two of the three possible factors: something the user knows (PIN, password), something they have (mobile device, card) and something they are (biometrics).

PISPs do not store the user’s online banking credentials: they access the bank’s interface (production API) using the authentication token generated in the SCA process, which secures the transaction without compromising the user’s credentials.

Correct SCA compliance is essential for the PISP to be released from liability in claims for unauthorized payment transactions.

PISPs are among the obliged entities under Law 10/2010 on the prevention of money laundering and terrorist financing, which entails a series of specific obligations tailored to the payment initiation business model.

The most relevant obligations include identifying and verifying the identity of customers (KYC), identifying the beneficial owner when the payer is a legal entity, ongoing monitoring of initiated transactions to detect anomalous patterns, and reporting suspicious transactions to SEPBLAC.

The PISP’s AML/CFT system must be adapted to its position in the payment chain: although the PISP does not hold customer funds, it has access to valuable transaction information that must be handled rigorously and confidentially.

In June 2023 the European Commission published its proposals for PSD3 and the new Payment Services Regulation (PSR), which will bring significant changes for PISPs: stronger rights of access to bank interfaces, an improved liability framework for fraud, new obligations to inform users and higher interoperability requirements.

PSD3 also broadens the scope of open banking and strengthens the competitive position of PISPs vis-à-vis banks, which will have to provide higher-quality interfaces with stronger availability guarantees.

Entities already operating as PISPs under PSD2 will need to review their regulatory documentation and technical systems to adapt to the new PSD3 requirements once it is transposed into Spanish law.

Obtaining PISP authorization in Spain takes between three and six months from submission of the complete application to the Bank of Spain, although it can take longer if the authority requests additional documents or clarifications about the business model.

The cost of legal advice for obtaining a PISP license depends on the complexity of the business model, the number of payment services applied for and how well prepared the entity already is. On top of this come the Bank of Spain’s regulatory fees and the cost of technically implementing the required security systems.

Specialist advice from the start of the process significantly reduces the risk of additional requests for information from the Bank of Spain and shortens the time needed to obtain the PISP license.