Section 70(3)

An account information service provider must— not provide account information services without the payment service user's explicit consent; ensure that the payment service user's personalised security credentials are— not accessible to other parties, with the exception of the issuer of the credentials; and transmitted through safe and efficient channels; for each communication session, identify itself to the account servicing payment service provider and communicate securely with the account servicing payment service provider and the payment service user in accordance with the technical standards made under regulation 106A; not access any information other than information from designated payment accounts and associated payment transactions; not request sensitive payment data linked to the payment accounts accessed; not use, access or store any information for any purpose except for the provision of the account information service explicitly requested by the payment service user.

← 2 · All articles · 71 →

Source: legislation.gov.uk · retrieved 2026-09-04