Skip to Content

PSD2 XS2A

PSD2 compliance for European ASPSPs

Complete technical solution helping ASPSPs (Account Servicing Payment Service Providers) comply with the Regulatory Technical Standards of the Second Payment Services Directive (PSD2).

Trusted by 40+ credit institutions in the EU. Our platform is one of the largest Open Banking hubs in Europe: it handles millions of API calls monthly.

Download brochure

Talk to our team

What is PSD2?

The cornerstone of Open Banking,

in application since 2018

PSD2 was adopted by the European Parliament in October 2015 to enhance security and catalyze greater innovation in digital banking. It was progressively rolled-out between 13 January 2018 and 14 September 2019.

The implications of PSD2 include the obligation for ASPSPs to open up their payment services to licensed Third Party Providers (TPPs). This connectivity is done via standardized APIs that are secure and help simplify the process while optimizing the efficiency of the integration process.

Leverage our proven Open Banking platform to deliver seamless, secure, and reliable access to your XS2A interfaces for licensed TPPs. Our mutualized approach simplifies operations, enhances compliance, and reduces costs.
xs2a luxhub platform

How it works

A smooth & secure user flow

Diagram PSD2 XS2A

 ​End-client uses TPP

The bank or EMI's clients (Payment Services User, or PSU) uses a service provided by an external TPP - and gives his/her consent. The TPP needs to connect to the ASPSP's API to retrieve the requested payment account information or initiate a credit transfer.


 ​TPP connects to bank's or EMI's APIs via LUXHUB

The TPP accesses the banks' APIs via LUXHUB's Open Banking hub, after the necessary verification.

​

 ​ASPSP sends back information to TPP / initiates credit transfer

Information is returned by the ASPSP to LUXHUB, and displayed to the PSU directly in the TPP's platform/application / Credit transfer is processed.

 Talk to our team

PSD2 compliance: build or buy?

A recognized Open Banking hub, compliant and secure

Build in-house LUXHUB PSD2 XS2A
Time to market Long implementation cycle PSD2-ready platform available quickly
Compliance Ongoing regulatory burden Compliance expertise built in
TPP management Handle onboarding and support internally TPP onboarding, authentication and helpdesk managed
Resources Requires dedicated internal teams Dedicated experts supporting you every step
Risk Higher implementation and operational complexity Proven service helping mitigate operational risk
Operations Internal monitoring and maintenance 24/7 monitored service and regulatory watch
Experience Build and validate from scratch Trusted by 40+ ASPSPs across Europe since 2018
 Talk to a specialist

Implementation

Access a sandbox in a few days

person typing on a computer

LUXHUB provides you with all necessary information about the dedicated interface via the Wiki tool.

 Fast implementation through standardization,

 Secure collaboration tools to provide well-structured support,

 Support in the needed formalization with National Competent Authority (NCA),

 Different environments to implement and maintain your compliance (Testing, Integration, Production),

Sandboxes with Mock Certificates, hosted on LUXHUB infrastructure.

Developer Portal

Capabilities

A fully operational, efficient and approved PSD2 compliance solution

API Management

Complete management of APIs in Sandbox and Production, including documentation and credentials management.

TPP Authorization

eIDAS-based identification and authorization of regulated Third Party Providers.

TPP Support

Management of TPP onboarding, mandatory TPP Helpdesk, including communication about maintenance and updates. 

Security Monitoring

Reporting dashboards related to API Availability and Performance of API supervised by our SOC.

Operational Management

24/7 management of the entire infrastructure, according to SLO objective and defined BCP.

Legal Reporting

Generation of mandatory and standardized quarterly statistics reports.

Highly Secure Infrastructure

Hosted in a Tier IV Datacenter located in Luxembourg ISO27001 / ISO20000 / ISO9001.

Statistics

Daily API statistics available via API or User Interface.

Regulatory watch

Continuous monitoring and analysis of regulatory developments to identify potential risks, and compliance requirements.

Fallback exemption

Support with NCA interactions and fallback exemption request.

Consent Management

Transparent management of the consent given by the final users.

Compliant & secure

Supervised, certified, EU-hosted


ISO 27001 certified
CSSF supervised entity
(n° Z00000024)
AISP/PISP
TIER IV datacenter in Luxembourg
EU data hosting
DORA-ready

FAQs

Questions teams ask about PSD2 XS2A

All you need to know about PSD2 and LUXHUB's solution.


PSD2 (Directive (EU) 2015/2366 on payment services in the internal market) is the European regulation that introduced Open Banking across the European Union.

Its main objectives are to enable secure access to payment account data for licensed third-party providers (TPPs), strengthen consumer protection through measures such as Strong Customer Authentication (SCA), encourage innovation and competition in the payments market, and create a harmonized regulatory framework for payment services across the European Union.

By fostering greater connectivity between financial institutions and regulated third-party providers, PSD2 has helped drive the development of new digital financial services and payment experiences for consumers and businesses.

XS2A (Access to Account) is the technical framework introduced by PSD2 that enables licensed third-party providers (TPPs) to securely access payment account information and initiate payments on behalf of customers, subject to their consent.

Under PSD2, Account Servicing Payment Service Providers (ASPSPs), such as banks, must provide this access through secure APIs. XS2A therefore forms the foundation of Open Banking in Europe, defining how data is exchanged and establishing requirements for security, authentication, availability, performance, and TPP support.

LUXHUB's PSD2 XS2A solution is a fully managed Open Banking platform designed to help ASPSPs comply with PSD2 requirements.

The platform includes API management, TPP identification and authorization, monitoring and reporting tools, 24/7 operational support, and mandatory TPP Helpdesk services. It also supports institutions in meeting their regulatory obligations while benefiting from a secure, mutualized infrastructure hosted in Luxembourg.

LUXHUB's PSD2 XS2A platform is used by more than 40 Account Servicing Payment Service Providers (ASPSPs) across Europe.

The platform supports a large volume of Open Banking API traffic and has been designed to deliver the scalability, reliability, and performance required by financial institutions operating in diverse European markets.

Founded in 2018 to help financial institutions address PSD2 compliance requirements, LUXHUB has developed extensive expertise in Open Banking and continues to support banks and PSPs in meeting their regulatory obligations efficiently and securely.

LUXHUB's XS2A solution provides a comprehensive set of technical and operational services to help ASPSPs meet their Open Banking obligations under PSD2.

The platform supports the full management of XS2A APIs across integration, pre-production, and production environments. It also includes the identification and authorization of licensed Third-Party Providers (TPPs) through the use of eIDAS certificates and European regulatory registers.

In addition, the solution includes real-time API performance and availability monitoring, support for evolving PSD2 regulatory requirements, and assistance with reporting obligations towards the relevant national competent authorities.

By combining these capabilities within a single managed platform, LUXHUB helps institutions simplify operations, maintain compliance, and deliver a secure and reliable Open Banking service.

Mutualization is at the core of LUXHUB's approach to PSD2 compliance.

Instead of each financial institution building, operating, and maintaining its own Open Banking infrastructure, LUXHUB provides a shared platform that enables multiple ASPSPs to benefit from common technology, expertise, and operational resources.

This approach helps institutions reduce implementation and operating costs, accelerate time to compliance, and remain aligned with evolving regulatory requirements without having to manage a dedicated Open Banking platform internally.

For many institutions, particularly smaller and medium-sized organizations, a mutualized model provides access to a proven, secure, and compliant solution while significantly reducing the complexity of PSD2 compliance.

Strong Customer Authentication (SCA) is a key PSD2 security requirement designed to protect electronic payments and access to payment account data.

Under PSD2, customers must be authenticated using at least two independent authentication factors selected from three categories: something they know (such as a password or PIN), something they possess (such as a mobile device or security token), and something they are (such as a fingerprint or facial recognition).
LUXHUB's XS2A platform supports all PSD2-regulated third-party provider (TPP) categories, including Account Information Service Providers (AISPs), Payment Initiation Service Providers (PISPs), and Card-Based Payment Instrument Issuers (CBPIIs).

To ensure secure access to Open Banking services, the platform validates TPP credentials using eIDAS certificates, enabling ASPSPs to interact confidently with authorized providers across the European ecosystem.

An Account Servicing Payment Service Provider (ASPSP) is a financial institution that holds and services payment accounts on behalf of customers. This typically includes banks and other regulated institutions that provide payment account services.

Under PSD2, ASPSPs must enable licensed Third-Party Providers (TPPs) to securely access account information and initiate payments, with the customer's explicit consent. They are also responsible for providing compliant Open Banking APIs, supporting testing and production environments, ensuring appropriate levels of security and availability, operating TPP support processes, and meeting regulatory reporting obligations.

LUXHUB supports ASPSPs in fulfilling these requirements through its PSD2 XS2A platform, helping simplify compliance while ensuring a secure and reliable Open Banking service.

A PSD2 contingency mechanism is a fallback access solution that enables licensed Third-Party Providers (TPPs) to continue accessing payment account data if an ASPSP's dedicated Open Banking API becomes unavailable.

Under the PSD2 Regulatory Technical Standards (RTS), ASPSPs may be exempted from providing a fallback interface if their dedicated API consistently meets the required standards for availability, performance, and reliability.

LUXHUB's XS2A platform is designed to help ASPSPs meet these requirements through a robust and highly available Open Banking infrastructure. The solution also includes monitoring, performance tracking, and reporting capabilities that support institutions in meeting their ongoing regulatory obligations.

PSD2 laid the foundation for Open Banking in Europe, and the proposed PSD3 and Payment Services Regulation (PSR) are expected to further modernize the European payments landscape.

Key objectives include strengthening fraud prevention, enhancing consumer rights, improving the consistency of Open Banking implementation across Member States, and creating a more harmonized regulatory framework for payment services.

As a long-standing provider of Open Banking and compliance solutions, LUXHUB actively monitors regulatory developments and continuously enhances its platforms to align with emerging requirements. This helps ensure that clients remain prepared for future regulatory changes while benefiting from secure, compliant, and scalable payment infrastructures.

LUXHUB is a regulated financial technology provider operating under the supervision of the CSSF (Commission de Surveillance du Secteur Financier) in Luxembourg and holds Support PFS (Professional of the Financial Sector) status.

The company is also ISO 27001 certified, demonstrating its commitment to internationally recognized information security management standards.

LUXHUB's PSD2 XS2A platform is trusted by more than 40 ASPSPs across Europe and has been designed to support compliance with PSD2 and the associated Regulatory Technical Standards (RTS).

Getting started with LUXHUB's PSD2 XS2A solution is simple.

Financial institutions can request a consultation through the dedicated contact form on the PSD2 XS2A product page, download the product brochure, or contact LUXHUB directly at info[at]luxhub.com or +352 28 80 76.

Following an initial assessment, LUXHUB's experts will review your requirements, define the most suitable integration approach, and provide guidance on implementation timelines and onboarding steps.

From sandbox access and testing to production deployment, LUXHUB supports institutions throughout the entire Open Banking compliance journey, helping ensure a smooth and efficient path to PSD2 compliance.

Ready to start your PSD2 journey?

A 30-minute call with our experts. Let's discuss your PSD2 compliance. We are excited to talk to you and present our PSD2 XS2A solution to your team.

Get started