Primary tabs

Redsys Servicios de Procesamiento, S.L.

Making the exemption mandatory implies a loss of control on the part of the ASPSPs’, who would not be able to establish a shorter timeframe according to their policies and risk appetite. To compensate for this, we think there should be stricter requirements for the TPPs to offer a clear and easy to use process to manage and revoke consents. Several ASPSPs have reported that customers sometimes contact them to ask how they can revoke a consent, because the TPP in question does not inform clearly of this process. In that regard, we suggest that the ASPSPs should be allowed to manage consent revocation in cases when the TPP does not provide or communicate an easy process to do it.
We feel that if the exemption is going to be mandatory and for such an extended period of time, then the PSUs must have an easily accessible way to revoke the consent if they wish. This will help reduce potential fraud or unauthorized accesses to the account.
We would also like to confirm our interpretation that if this proposal is implemented as it is, the existing tokens already issued at the time the new exemption applies will remain unchanged until they expire.
In our opinion, the proposed timeline is too short. It would mean that ASPSPs would have only 5 months to implement the necessary changes in their APIs. Although the change proposed may seem relatively easy, in our experience the time involved in planning, developing and testing any change can amount to several months, as it needs to be fit into the ASPSP’s technical development schedule, along with other competing priorities. This could cause that some ASPSP’s may find it hard to meet this timeline and risk not having the change ready for the deadline.

We would like to propose increasing the timeline to 12 months, but keeping the 3-month advance period to make the changes available for AISPs for testing. This way ASPSPs will have 9 months to implement, which we feel should be enough in most cases, and TPPs will have the usual 3 months to adapt to the changes instead of just 1. We think this is a more realistic approach that increases the chances of having a smooth transition to the new scenario.
API initiatives
Redsys Servicios de Procesamiento, S.L.