A regulatory requirement introduced by PSD2. It mandates that banks (Account Servicing Payment Service Providers or ASPSPs) must create secure channels for TPPs to access their customers’ account data. XS2A eliminates the bank’s monopoly on customer data. It forces banks to build APIs (Application Programming Interfaces) that allow TPPs to:
- Check account balances.
- View transaction histories.
- Initiate payments.
XS2A is governed by Strong Customer Authentication (SCA), meaning the user must still verify their identity (usually via a fingerprint, face scan, or SMS code) before the bank grants the TPP access.