What is a PISP? Payment initiation service providers explained
A payment initiation service provider (PISP) is a regulated firm that, at a customer’s request, instructs the customer’s bank to make a payment from their account. The PISP never holds the money. It sends the instruction, the customer approves it with their own bank, and the funds move directly from the payer’s account to the beneficiary’s.
The role was created by the EU’s second Payment Services Directive (PSD2), which obliged banks to open their payment accounts to licensed third parties. It is the regulated activity behind what most people call Open Banking payments, pay-by-bank or account-to-account payments.
How a PISP payment works
- A payment is created. A merchant, a platform or the PISP’s own app asks the PISP to initiate a payment — an amount, a currency and a beneficiary account.
- The payer chooses their bank. The PISP shows a bank picker, in its own interface or on a hosted payment page.
- The PISP instructs the bank. Over the bank’s PSD2 interface, identifying itself with its eIDAS certificates, the PISP submits the payment order.
- The payer approves. The bank applies strong customer authentication in its own app or on its own pages. The PISP never needs the payer’s banking credentials.
- The bank executes. The payment leaves the payer’s account as an ordinary credit transfer — in the euro area usually a SEPA Instant Credit Transfer, in the UK a Faster Payment — and lands in the beneficiary’s account.
- The PISP reports the outcome. The bank returns a payment status, and the PISP passes it on to the merchant.
No card network is involved, so there is no interchange, no scheme fee and no chargeback process. That cost structure is the commercial case for payment initiation.
PISP, AISP, ASPSP: who is who
PSD2 introduced a small vocabulary that is worth getting straight.
| Term | Stands for | What it is |
|---|---|---|
| ASPSP | Account servicing payment service provider | The bank, or any institution that holds the customer’s payment account |
| PISP | Payment initiation service provider | A firm licensed to initiate payments from accounts held elsewhere |
| AISP | Account information service provider | A firm registered to read account data — balances and transactions — with the customer’s consent |
| CBPII | Card-based payment instrument issuer | A firm that may ask a bank to confirm whether funds are available |
| TPP | Third-party provider | The umbrella term for PISPs, AISPs and CBPIIs |
The key difference between a PISP and an AISP is that a PISP moves money and an AISP only reads data. The regulatory bar follows from that: payment initiation requires full authorisation as a payment institution, while an account information service on its own needs only registration.
What a PISP is not allowed to do
PSD2 draws the role narrowly, which is what makes it safe to open bank accounts to it. A PISP must not hold the payer’s funds at any point, must not store the payer’s sensitive payment data, must not ask for more data than the payment needs, and must not change the amount, the payee or any other feature of the transaction the payer approved.
What it takes to become a PISP
In the EU and EEA, a firm applies to its national competent authority — BaFin in Germany, the Bank of Lithuania, De Nederlandsche Bank and so on — for authorisation as a payment institution with permission for payment initiation services. A payment-initiation-only institution needs:
- Initial capital of €50,000, the lowest tier for payment institutions.
- Professional indemnity insurance or a comparable guarantee, sized under European Banking Authority guidelines, because a PISP holds no client funds to safeguard.
- A governance and control framework: a business plan, security and incident management policies, business continuity arrangements, fit and proper management, and anti-money-laundering controls.
- A description of outsourcing arrangements, if technology or operations are provided by someone else.
Once authorised, the firm appears on its regulator’s public register and the European Banking Authority’s central register, and may passport into other EU and EEA member states by notification rather than by fresh application.
The United Kingdom kept the same model after Brexit under the Payment Services Regulations 2017, with the Financial Conduct Authority as regulator. EU passports no longer reach the UK, and UK authorisations do not reach the EU, so a firm active in both holds two authorisations.
The EU is in the process of replacing PSD2 with a third Payment Services Directive and a directly applicable Payment Services Regulation, first proposed by the European Commission in June 2023. Payment initiation remains a regulated service under the new framework.
The second hurdle: connectivity
A licence gives a PISP the right to connect to every bank. It does not supply the connections. PSD2 never mandated one technical standard, so European banks expose their interfaces through several competing API standards, each implemented differently bank by bank — and each bank identifies the PISP by its eIDAS certificates.
A newly licensed PISP therefore has three options: build and maintain the bank connections itself, send its payments through an aggregator’s licence instead of using its own, or run its own licence on infrastructure built for that purpose. We compare them in build versus buy for Open Banking connectivity.