A bank must give third-party providers an interface that performs as well as the one its own customers use and that adds no obstacles. If that interface fails, the standards allow temporary fallback to the customer-facing channel under conditions. Unplanned downtime can be presumed after five unanswered requests over 30 seconds.
What the standards say
Articles 30 to 33 of Commission Delegated Regulation (EU) 2018/389 cover the access interface for account information providers, payment initiation providers and card-based payment instrument issuers. The points below are a summary. Read the text for the exact conditions.
Parity and no obstacles
The dedicated interface must offer the same availability and performance as the interface the bank gives its own customers. Key performance indicators must be at least as strict.
It must also not create obstacles. The text names forced redirects and extra authorisations beyond what the Directive already requires as examples of what to avoid.
For an API team this turns non-functional work into compliance work. Latency, error rate and uptime need to be measured for both channels, side by side, and kept.
When fallback is allowed
Article 33 says unplanned unavailability may be presumed when five consecutive access requests go unanswered for 30 seconds. In that case a provider may temporarily use the customer-facing interface, subject to conditions:
- The data is not used for any other purpose.
- The data accessed is logged.
- The account servicing provider is informed.
The fallback exemption
A competent authority can exempt a dedicated interface from the fallback requirement if it meets set conditions, including at least three months of wide use and problems resolved without undue delay. The exemption is revoked if the conditions are not met for more than two consecutive calendar weeks.
That two week clock is worth building an alert around. Bank teams often watch daily uptime but not whether an incident is still open against the exemption conditions.
Security angles
Fallback means a third party is using a channel that was not designed for it. That raises questions your bank team should answer in advance:
- Can you tell third-party traffic apart from customer traffic on the customer interface?
- Do rate limits and fraud rules treat that traffic sensibly during an outage?
- Is the logging of accessed data complete enough to meet the condition?
Treat the fallback path as a production surface with its own threat model, not as an afterthought.
Quick check
Does a dedicated interface need the same uptime as the customer channel?
The standards require the same level of availability and performance, with indicators at least as strict, so you need to measure both.
Can a provider use fallback for any reason?
No. The text ties it to unavailability, with five unanswered requests over 30 seconds as a presumption, and it attaches conditions on data use and logging.
Sources
Last reviewed: 19 October 2026.
