ISO/TR 21941:2017

TECHNICAL ISO/TR
REPORT 21941
First edition
2017-07
Financial services — Third-party
payment service providers
Services financiers — Prestataires de services de paiement tiers
Reference number
©
ISO 2017
© ISO 2017, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO 2017 – All rights reserved

Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviated terms . 1
4 Overview of the current TPP landscape . 3
4.1 General . 3
4.2 Europe . 5
4.2.1 Europe and the revised Payment Services Directive . 5
4.2.2 Advantages of a common standard . 5
4.2.3 Contents of the standard . 6
4.3 Asia . 6
4.3.1 Korea . 6
4.3.2 Japan . 7
4.3.3 China . 7
4.4 America . 9
4.4.1 Canada . 9
4.4.2 Brazil .10
4.4.3 USA .12
4.5 Oceania — Australia .13
4.6 Africa — South Africa .14
5 Reference models and architecture .15
5.1 General .15
5.2 Example from Norway .16
6 Further potential developments .17
Bibliography .19
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www .iso .org/ patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO’s adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: w w w . i s o .org/ iso/ foreword .html.
This document was prepared by Technical Committee ISO/TC 68, Financial services, Subcommittee SC 2,
Financial Services, security.
iv © ISO 2017 – All rights reserved

Introduction
This document was initiated 2 years ago with the aim of conducting research into the interface between
third-party payment (TPP) and account servicing payment service providers.
As TPP is a fast-developing area, it was critical to provide guidance quickly.
This document gives an overview of the situation in different regions as it was at the end of 2015 and
the beginning of 2016. There have been new developments in several of the regions since then.
For the purposes of this document, payment initiation service providers (PISP) and account information
service providers (AISP) are commonly named as TPPs. Furthermore, while there could be other
relevant documents to choose from in other markets with regard to terms, definitions and abbreviated
[2]
terms, the choice has fallen on PSD2 , as a key reference, as this document can be seen as a good place
to start. It should also be noted that the verbal forms are used and interpreted as follows:
— “should” indicates a recommendation;
— “can” indicates a possibility or a capability;
— “must” indicates an external constraint.
NOTE External constraints are not requirements of the document. They are given for the information of the
user. Examples of external constraints are laws of nature and legal requirements.
TECHNICAL REPORT ISO/TR 21941:2017(E)
Financial services — Third-party payment service
providers
1 Scope
This document reports the findings of research into the interface between third-party payment service
providers (TPPs) and account servicing payment service providers (ASPSPs).
2 Normative references
There are no normative references in this document.
3 Terms, definitions and abbreviated terms
3.1 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at http:// www .iso .org/ obp
— IEC Electropedia: available at http:// www .electropedia .org/
3.1.1
account information service
online service to provide consolidated information on one or more payment accounts (3.1.7) held by
the payment service user (3.1.2) with either another payment service provider or with more than one
payment service provider
[SOURCE: Directive (EU) 2015/2366, definition 16]
3.1.2
payment service user
natural or legal person making use of a payment service in the capacity of payer, payee, or both
[SOURCE: Directive (EU) 2015/2366, definition 10]
3.1.3
account servicing payment service provider
payment service provider providing and maintaining a payment account (3.1.7) for a payer
[SOURCE: Directive (EU) 2015/2366, definition 17]
3.1.4
authentication
procedure which allows the payment service provider to verify the identity of a payment service user
(3.1.2) or the validity of the use of a specific payment instrument (3.1.9), including the use of the user’s
personalized security credentials (3.1.6)
[SOURCE: Directive (EU) 2015/2366, definition 29]
3.1.5
strong customer authentication
authentication (3.1.4) based on the use of two or more elements categorized as knowledge (something
only the user knows), possession (something only the user possesses) and inherence (something the
user is) that are independent, in that the breach of one does not compromise the reliability of the others,
and is designed in such a way as to protect the confidentiality of the authentication data
[SOURCE: Directive (EU) 2015/2366, definition 30]
3.1.6
personalized security credentials
personalized features provided by the payment service provider to a payment service user (3.1.2) for
the purposes of authentication (3.1.4)
[SOURCE: Directive (EU) 2015/2366, definition 31]
3.1.7
payment account
account held in the name of one or more payment service users (3.1.2) which is used for the execution of
payment transactions
[SOURCE: Directive (EU) 2015/2366, definition 12]
3.1.8
payment initiation service
service to initiate a payment order at the request of the payment service user (3.1.2) with respect to a
payment account (3.1.7) held at another payment service provider
[SOURCE: Directive (EU) 2015/2366, definition 15]
3.1.9
payment instrument
personalized device(s) and/or set of procedures agreed between the payment service user (3.1.2) and
the payment service provider and used in order to initiate a payment order
[SOURCE: Directive (EU) 2015/2366, definition 14]
3.1.10
sensitive payment data
data, including personalized security credentials (3.1.6) which can be used to carry out fraud
Note 1 to entry: For the activities of payment initiation service providers and account information service
providers, the name of the account owner and the account number do not constitute sensitive payment data.
[SOURCE: Directive (EU) 2015/2366, definition 32, modified — Part of the definition has been formatted
as Note 1 to entry.]
3.1.11
third-party payment service provider
payment service provider offering payment initiation services (3.1.8) or account information services
(3.1.1) on accounts where they are not the account-servicing payment service provider themselves
3.1.12
interface
device or program for connecting two items of hardware or software so that they can be operated
jointly or communicate with each other
2 © ISO 2017 – All rights reserved

3.1.13
gatekeeper
function that ensures that admittance is limited to third-party payment service providers (3.1.11) who
comply with regulatory and technical requirements
Note 1 to entry: This function can be provided by individual banks or a common actor within finance industry.
Note 2 to entry: The third-party payment service provider itself can provide the gatekeeper function if certified.
3.2 Abbreviated terms
ACH automated clearing house
AISP account information service provider
API application program interface
ASPSP account servicing payment service provider
ATM automated teller machine
EFT electronic funds transfer (or e-funds transfer)
OAuth open authentication
PISP payment initiation service provider
PSD2 Payment Services Directive II
PSP payment service provider
PSU payment service
...