About the publication

An independent analytical publication on payment infrastructure

Veridexaa Analytics is operated by Veridexaa Analytics Group from Espoo, Finland. We document how open-banking payments work in practice, for the teams that have to build, audit and operate them.

Last updated: 9 October 2026

Veridexaa Analytics started from a recurring observation: organisations choosing an open-banking payment method were asked to decide on the basis of sales material, while the factors that actually determined their outcomes were written in regulatory technical standards, scheme rulebooks and bank interface specifications that few people outside payments engineering read.

The gap was not a lack of information but a lack of structure. Each regime explained itself in its own vocabulary. The PSD2 RTS spoke of authentication codes and dedicated interfaces; the European Payments Council spoke of schemes, participants and timelines; providers spoke of conversion and coverage. A product manager trying to understand why a payment succeeded in one bank and failed in another had to translate between all three.

Our response is to publish that translation openly. The whitepaper sets out the regulatory boundaries as precisely as the texts allow. The infrastructure ledger records what can be verified about individual providers and states plainly what cannot. Every page shows its sources and its last review date, so readers can decide how far to rely on it.

We write for an audience that includes treasury and finance teams, product owners, integration engineers and compliance officers in the Nordic countries and Poland. That audience is served best by documents that are precise, dated and modest about what is known. We therefore avoid rankings, scores and unattributed performance figures.

The publication is financed by its operator. It contains no affiliate links, and inclusion in the ledger cannot be purchased. Organisations that want an analysis of their own flows can request a technical audit through the inquiry form; the scope of any such work is agreed in writing before it begins and is kept separate from editorial content.

Editorial principles

Sources before conclusions

A statement is published only with the instrument, article or document it rests on. Where we interpret, we say that we are interpreting.

No unverifiable numbers

We do not publish latency, conversion or uptime figures unless they come from a reproducible measurement or a contractual commitment.

Independence from providers

Providers cannot pay for inclusion or placement. Corrections are accepted only with a public source.

Dated and correctable

Every module carries a review date. Errors are corrected in the next revision and the correction is recorded.

How the analyst team is organised

The publication is produced by a small analyst team organised around four functions. We list functions rather than personal profiles; correspondence is handled through the shared desks listed on the contact page.

01

Payments infrastructure analysis

Reviews scheme rulebooks, clearing arrangements and settlement timelines, and maintains the infrastructure ledger.

02

Regulatory research

Tracks PSD2, the RTS, Regulation (EU) 2024/886 and related supervisory guidance, and drafts the whitepaper modules.

03

Interface and data verification

Reads bank and provider interface documentation and checks factual claims against public registers before publication.

04

Editorial desk

Edits all modules, manages the six language editions and handles corrections and reader correspondence.

Markets covered

  • Finland
  • Sweden
  • Norway
  • Denmark
  • Poland
  • Pan-European (SEPA)

Where we operate

Veridexaa Analytics is operated as an independent analytical publication by Veridexaa Analytics Group at Linnoitustie 6–9, 02600 Espoo, Finland.

Discuss your payment infrastructure with the analyst desk

Describe your markets, bank coverage and payment flows, and we will reply by email.

Request Technical Audit →

Privacy Policy

Last updated: 9 October 2026

This policy explains how personal data is processed when you visit veridexaa.com or correspond with Veridexaa Analytics. It is issued under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679.

1. Controller

The controller is Veridexaa Analytics Group, which operates Veridexaa Analytics as an independent analytical publication at Linnoitustie 6–9, 02600 Espoo, Finland. Privacy and data protection matters: privacy@veridexaa.com.

2. Scope

This policy covers the website veridexaa.com in all language editions and email correspondence sent to any veridexaa.com address. It does not cover third-party websites or services referred to in our content.

3. Legal framework

Processing is governed by the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Finnish Data Protection Act (1050/2018). Storage of information on your device is governed by the Finnish Act on Electronic Communications Services (917/2014), which implements Article 5(3) of Directive 2002/58/EC.

4. Data we process

Correspondence data: the name, organisation, role, email address and message content that you choose to send us by email, including messages prepared with the inquiry form. Technical data: IP address, date and time, requested address, referring page and browser user agent, recorded in server logs by our hosting provider. Consent record: your cookie choice and the time it was made, stored only in your own browser's local storage and not transmitted to us. The inquiry form does not send data to this website; it opens your own email client with a pre-filled message.

5. Purposes and legal bases

Answering inquiries and technical audit requests: legitimate interests (Art. 6(1)(f)) in responding to correspondence, or steps taken at your request before entering into a contract (Art. 6(1)(b)). Operating and securing the website through server logs: legitimate interests (Art. 6(1)(f)) in availability and security. Remembering your consent choice: compliance with a legal obligation (Art. 6(1)(c) together with Art. 7(1)). Optional analytics, if enabled in future: your consent (Art. 6(1)(a)). Accounting records for any contracted work: legal obligation (Art. 6(1)(c)) under the Finnish Accounting Act (1336/1997).

6. Sources of data

Correspondence data is received directly from you. Technical data is generated automatically when your browser requests pages from our server. We do not buy personal data or enrich it from third-party sources.

7. Recipients and processors

Personal data is disclosed only to service providers that process it on our behalf under agreements meeting Article 28 GDPR, namely our hosting provider and our email service provider. Fonts are delivered by Google Fonts (Google Ireland Limited), which receives your IP address when the font files are requested. We do not sell personal data. Data may be disclosed to authorities where we are legally required to do so.

8. International transfers

We aim to process personal data within the European Economic Area. Where a processor transfers data outside the EEA, the transfer relies on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified recipients, or on standard contractual clauses under Commission Implementing Decision (EU) 2021/914, together with an assessment of the transfer.

9. Retention

Correspondence is retained for up to 24 months after the last exchange, unless it becomes part of a contract, in which case it is retained for the duration of the contract and the applicable limitation period. Server logs are retained according to the hosting provider's configuration and are not used for profiling. Accounting records are retained for the periods required by the Finnish Accounting Act. The consent record remains in your browser until you clear it or change your choice.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

11. How to exercise your rights

Send your request to privacy@veridexaa.com. We respond within one month of receipt; this period may be extended by two further months for complex or numerous requests, in which case we will inform you within the first month (Art. 12(3)). We may ask for information needed to confirm your identity.

12. Security

The website is served exclusively over encrypted HTTPS connections. Access to correspondence is restricted to the personnel who handle it. The website itself does not store form submissions, and we apply data minimisation to the information we request.

13. Personal data breaches

If a personal data breach occurs, we notify the supervisory authority within 72 hours of becoming aware of it where required by Article 33, and inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34).

14. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects (Art. 22).

15. Children

The website is a business-to-business publication and is not directed at children. We do not knowingly process personal data of children.

16. Obligation to provide data

You are not obliged to provide personal data. Without contact details we cannot reply to an inquiry.

17. Supervisory authority

You may lodge a complaint with the Office of the Data Protection Ombudsman in Finland (www.tietosuoja.fi) or with the supervisory authority of your habitual residence or place of work in the EU or EEA.

18. Changes and contact

We update this policy when our processing changes; the date of the current version is shown above. Questions: privacy@veridexaa.com, Veridexaa Analytics Group, Linnoitustie 6–9, 02600 Espoo, Finland.

Terms of Service

Last updated: 9 October 2026

These terms govern the use of veridexaa.com. By using the website you accept them.

1. Operator

The website is operated by Veridexaa Analytics Group as an independent analytical publication, Linnoitustie 6–9, 02600 Espoo, Finland. Legal matters: legal@veridexaa.com.

2. Service

Veridexaa Analytics publishes research, regulatory analysis and source-referenced comparisons on open-banking payment infrastructure. Access to the published content is free of charge and does not require registration.

3. Information, not advice

Content is provided for general technical information. It does not constitute legal, financial, investment, tax or regulatory advice, and it is not a recommendation to use or avoid any provider. You should obtain professional advice before acting on any content.

4. Technical audit requests

Submitting an inquiry or audit request does not create a contract or a client relationship. Any engagement is subject to a separate written agreement that defines its scope, deliverables and terms, and is kept separate from editorial content.

5. Accuracy and corrections

We take care to attribute every statement to a source and to date each module. Regulation, provider status and market conditions change, and content may become outdated. Corrections supported by a public source can be submitted through the inquiry form.

6. Provider names and trademarks

Brite, Zimpler, Trumo, Trustly and other names are trademarks of their respective owners and are used only to identify those providers. Their mention does not imply affiliation with, endorsement by or sponsorship from them.

7. Acceptable use

You may not use the website in breach of law, attempt to gain unauthorised access to it, disrupt its operation, introduce malicious code, or collect content by automated means in a way that burdens the service. Reasonable indexing by search engines is permitted.

8. Intellectual property

Texts, tables, layouts and vector graphics on the website are protected by copyright and belong to the operator unless stated otherwise. You may quote short passages with clear attribution to Veridexaa Analytics and the page concerned. Other reproduction requires prior written permission.

9. References to third parties

Sources are cited as text references. We are not responsible for the content, availability or practices of third-party publications or services.

10. Availability

We aim to keep the website available but do not guarantee uninterrupted or error-free operation. We may modify, suspend or discontinue any part of the website.

11. Disclaimer

The website and its content are provided as is. To the extent permitted by law, we make no warranties as to completeness, accuracy or fitness for a particular purpose.

12. Limitation of liability

To the extent permitted by mandatory law, the operator is not liable for indirect or consequential loss, or for decisions made on the basis of the content. Nothing in these terms limits liability that cannot be limited under applicable law, including liability for intentional misconduct or gross negligence.

13. Privacy and cookies

Processing of personal data is described in the Privacy Policy, and use of local storage in the Cookie Settings. Both form part of these terms.

14. Changes

We may amend these terms. The version in force is the one published on the website, with its date shown above.

15. Governing law and jurisdiction

These terms are governed by the laws of Finland. Disputes are resolved by the competent courts of Finland, without prejudice to mandatory protections that may apply in your country of residence.

16. Severability and contact

If a provision is held invalid, the remaining provisions remain in force. Questions about these terms: legal@veridexaa.com.

Cookie Settings

Last updated: 9 October 2026

This section explains what the website stores on your device and lets you change your choice at any time.

1. What cookies and local storage are

Cookies are small files placed in your browser by a website. Local storage is a comparable browser mechanism that keeps data on your device. Both are covered by the same consent rules.

2. Strictly necessary storage

Key vx_consent_v1 in local storage: records your consent choice and the time it was made. It stays on your device until you clear it or change your choice, and it is not sent to our server. The website sets no cookies of its own by default.

3. Analytics

Off by default. At the time of the last update the website loads no analytics scripts. If analytics is added, it will be activated only after you enable it here, and the tool, its purpose and its retention will be listed in this section.

4. Marketing

The website uses no advertising or marketing cookies and no tracking pixels.

5. Third-party resources

Fonts are loaded from Google Fonts. When your browser requests the font files, Google receives your IP address and browser information. Google Fonts does not set cookies for this request.

6. Changing your choice

Use the Manage cookie preferences button below to reset your choice. The banner will reappear so you can choose again.

7. Browser controls

You can also delete stored data or block storage in your browser settings: Chrome (Settings, Privacy and security), Firefox (Settings, Privacy and Security), Safari (Settings, Privacy) and Edge (Settings, Cookies and site permissions).

8. Legal framework

Storage on your device is governed by the Finnish Act on Electronic Communications Services (917/2014), implementing Article 5(3) of Directive 2002/58/EC, and by the GDPR where personal data is involved.

9. Contact

Questions about storage and consent: privacy@veridexaa.com.