Open-banking infrastructure research

How account-to-account payments really clear across the Nordics.

Veridexaa Analytics documents the technical and regulatory parameters that govern open-banking payments: the bank interfaces they run on, the authentication boundaries set by PSD2, and the instant settlement rails introduced at scale by Regulation (EU) 2024/886.

  • PSD2 RTS and Berlin Group XS2A interface analysis
  • SEPA Instant Credit Transfer timelines by market
  • Source-referenced provider ledger, no affiliate links
Request Technical Audit → Read the whitepaper

Scope

A reference desk for teams that integrate bank payments

Payment initiation through open banking sits at the intersection of three regimes that are often discussed separately: the second Payment Services Directive (PSD2) and its Regulatory Technical Standards on strong customer authentication, the European Payments Council schemes that define how euro credit transfers are exchanged, and the Instant Payments Regulation that now obliges payment service providers to send and receive euro transfers in under ten seconds. Implementation decisions made in one regime routinely create constraints in another.

This portal is written for treasury, product, engineering and compliance teams who need to understand those constraints before they commit to an integration path. Each module states its sources, separates regulation from vendor statements, and marks clearly where a figure has not been independently verified.

Implementation parameters

Six parameters that decide how an open-banking payment behaves

01

Access interface

Payment initiation reaches the payer's bank through the dedicated interface required by the PSD2 RTS (Articles 30 to 33). In the Nordics many banks expose interfaces based on the Berlin Group NextGenPSD2 XS2A framework; others publish proprietary specifications. Interface coverage, uptime reporting and fallback arrangements differ bank by bank.

02

Authentication path

Strong customer authentication for a payment initiated through a third party is applied by the payer's bank, not by the initiating provider. The bank's chosen approach (redirect, decoupled or embedded) determines how many screens the payer sees and which national identity schemes are involved.

03

Settlement rail

In euro, an initiated transfer may travel as a SEPA Instant Credit Transfer via TIPS or RT1, or as a standard SEPA Credit Transfer. Outside the euro area, domestic instant systems and national currencies apply. The rail, not the API, determines when funds are final.

04

Payee verification

Since 9 October 2025, euro-area payment service providers other than payment and e-money institutions must offer verification of payee before a credit transfer is authorised. When a payment is initiated through a payment initiation service provider, the regulation places the duty of ensuring correct payee data on that provider.

05

Sanctions screening

Regulation (EU) 2024/886 replaced transaction-by-transaction screening of instant transfers with screening of a provider's own customers against EU targeted financial restrictive measures, at least daily and immediately after new measures take effect. This obligation applies from 9 January 2025.

06

Reconciliation and returns

An executed instant credit transfer is irrevocable for the payer. Refunds are new transfers, and matching relies on the end-to-end identifier and remittance information carried in the ISO 20022 message. Reconciliation design therefore belongs in the integration plan, not after go-live.

Regulatory timeline

Instant Payments Regulation deadlines that matter for our markets

Regulation (EU) 2024/886 amends the SEPA Regulation and entered into force on 8 April 2024. Its deadlines differ by currency area and by type of payment service provider. Finland is in the euro area; Sweden, Denmark and Poland are EU Member States outside it. Norway applies EU payments legislation through the EEA Agreement once a measure is incorporated, so Norwegian timing must be checked against the EEA incorporation status.

ObligationEuro-area PSPs (excl. PIs/EMIs)Non-euro PSPs (excl. PIs/EMIs)Payment and e-money institutions
Receive instant euro transfers9 January 20259 January 20279 April 2027
Send instant euro transfers9 October 20259 July 20279 April 2027 (euro area) / 9 July 2027 (non-euro)
Verification of payee9 October 20259 July 2027Follows the send obligation
Daily sanctions screening of own customers9 January 20259 January 20259 January 2025

Source: Regulation (EU) 2024/886 as summarised by Bird & Bird (2024). The payment-institution verification-of-payee row is an interpretation and should be confirmed against the regulation text for your entity type.

Editorial method

How we separate regulation, vendor claims and measurement

  • Regulatory statements cite the instrument and article, and are checked against the Official Journal text or a named secondary source.
  • Provider statements are labelled as such and attributed to the document in which they were made, with its date.
  • Performance figures are only published when they come from a reproducible measurement or a contractual SLA. Where neither exists, the ledger says so instead of estimating.
  • Every page shows the date of its last review. Corrections can be submitted through the inquiry form and are logged in the next revision.

Research modules

Start with the module that matches your decision

Assess your open-banking integration against the current rulebook

Send a short description of your payment flows, markets and bank coverage. The analyst desk will reply by email to agree the scope of a technical audit.

Request Technical Audit →

Privacy Policy

Last updated: 9 October 2026

This policy explains how personal data is processed when you visit veridexaa.com or correspond with Veridexaa Analytics. It is issued under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679.

1. Controller

The controller is Veridexaa Analytics Group, which operates Veridexaa Analytics as an independent analytical publication at Linnoitustie 6–9, 02600 Espoo, Finland. Privacy and data protection matters: privacy@veridexaa.com.

2. Scope

This policy covers the website veridexaa.com in all language editions and email correspondence sent to any veridexaa.com address. It does not cover third-party websites or services referred to in our content.

3. Legal framework

Processing is governed by the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Finnish Data Protection Act (1050/2018). Storage of information on your device is governed by the Finnish Act on Electronic Communications Services (917/2014), which implements Article 5(3) of Directive 2002/58/EC.

4. Data we process

Correspondence data: the name, organisation, role, email address and message content that you choose to send us by email, including messages prepared with the inquiry form. Technical data: IP address, date and time, requested address, referring page and browser user agent, recorded in server logs by our hosting provider. Consent record: your cookie choice and the time it was made, stored only in your own browser's local storage and not transmitted to us. The inquiry form does not send data to this website; it opens your own email client with a pre-filled message.

5. Purposes and legal bases

Answering inquiries and technical audit requests: legitimate interests (Art. 6(1)(f)) in responding to correspondence, or steps taken at your request before entering into a contract (Art. 6(1)(b)). Operating and securing the website through server logs: legitimate interests (Art. 6(1)(f)) in availability and security. Remembering your consent choice: compliance with a legal obligation (Art. 6(1)(c) together with Art. 7(1)). Optional analytics, if enabled in future: your consent (Art. 6(1)(a)). Accounting records for any contracted work: legal obligation (Art. 6(1)(c)) under the Finnish Accounting Act (1336/1997).

6. Sources of data

Correspondence data is received directly from you. Technical data is generated automatically when your browser requests pages from our server. We do not buy personal data or enrich it from third-party sources.

7. Recipients and processors

Personal data is disclosed only to service providers that process it on our behalf under agreements meeting Article 28 GDPR, namely our hosting provider and our email service provider. Fonts are delivered by Google Fonts (Google Ireland Limited), which receives your IP address when the font files are requested. We do not sell personal data. Data may be disclosed to authorities where we are legally required to do so.

8. International transfers

We aim to process personal data within the European Economic Area. Where a processor transfers data outside the EEA, the transfer relies on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified recipients, or on standard contractual clauses under Commission Implementing Decision (EU) 2021/914, together with an assessment of the transfer.

9. Retention

Correspondence is retained for up to 24 months after the last exchange, unless it becomes part of a contract, in which case it is retained for the duration of the contract and the applicable limitation period. Server logs are retained according to the hosting provider's configuration and are not used for profiling. Accounting records are retained for the periods required by the Finnish Accounting Act. The consent record remains in your browser until you clear it or change your choice.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

11. How to exercise your rights

Send your request to privacy@veridexaa.com. We respond within one month of receipt; this period may be extended by two further months for complex or numerous requests, in which case we will inform you within the first month (Art. 12(3)). We may ask for information needed to confirm your identity.

12. Security

The website is served exclusively over encrypted HTTPS connections. Access to correspondence is restricted to the personnel who handle it. The website itself does not store form submissions, and we apply data minimisation to the information we request.

13. Personal data breaches

If a personal data breach occurs, we notify the supervisory authority within 72 hours of becoming aware of it where required by Article 33, and inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34).

14. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects (Art. 22).

15. Children

The website is a business-to-business publication and is not directed at children. We do not knowingly process personal data of children.

16. Obligation to provide data

You are not obliged to provide personal data. Without contact details we cannot reply to an inquiry.

17. Supervisory authority

You may lodge a complaint with the Office of the Data Protection Ombudsman in Finland (www.tietosuoja.fi) or with the supervisory authority of your habitual residence or place of work in the EU or EEA.

18. Changes and contact

We update this policy when our processing changes; the date of the current version is shown above. Questions: privacy@veridexaa.com, Veridexaa Analytics Group, Linnoitustie 6–9, 02600 Espoo, Finland.

Terms of Service

Last updated: 9 October 2026

These terms govern the use of veridexaa.com. By using the website you accept them.

1. Operator

The website is operated by Veridexaa Analytics Group as an independent analytical publication, Linnoitustie 6–9, 02600 Espoo, Finland. Legal matters: legal@veridexaa.com.

2. Service

Veridexaa Analytics publishes research, regulatory analysis and source-referenced comparisons on open-banking payment infrastructure. Access to the published content is free of charge and does not require registration.

3. Information, not advice

Content is provided for general technical information. It does not constitute legal, financial, investment, tax or regulatory advice, and it is not a recommendation to use or avoid any provider. You should obtain professional advice before acting on any content.

4. Technical audit requests

Submitting an inquiry or audit request does not create a contract or a client relationship. Any engagement is subject to a separate written agreement that defines its scope, deliverables and terms, and is kept separate from editorial content.

5. Accuracy and corrections

We take care to attribute every statement to a source and to date each module. Regulation, provider status and market conditions change, and content may become outdated. Corrections supported by a public source can be submitted through the inquiry form.

6. Provider names and trademarks

Brite, Zimpler, Trumo, Trustly and other names are trademarks of their respective owners and are used only to identify those providers. Their mention does not imply affiliation with, endorsement by or sponsorship from them.

7. Acceptable use

You may not use the website in breach of law, attempt to gain unauthorised access to it, disrupt its operation, introduce malicious code, or collect content by automated means in a way that burdens the service. Reasonable indexing by search engines is permitted.

8. Intellectual property

Texts, tables, layouts and vector graphics on the website are protected by copyright and belong to the operator unless stated otherwise. You may quote short passages with clear attribution to Veridexaa Analytics and the page concerned. Other reproduction requires prior written permission.

9. References to third parties

Sources are cited as text references. We are not responsible for the content, availability or practices of third-party publications or services.

10. Availability

We aim to keep the website available but do not guarantee uninterrupted or error-free operation. We may modify, suspend or discontinue any part of the website.

11. Disclaimer

The website and its content are provided as is. To the extent permitted by law, we make no warranties as to completeness, accuracy or fitness for a particular purpose.

12. Limitation of liability

To the extent permitted by mandatory law, the operator is not liable for indirect or consequential loss, or for decisions made on the basis of the content. Nothing in these terms limits liability that cannot be limited under applicable law, including liability for intentional misconduct or gross negligence.

13. Privacy and cookies

Processing of personal data is described in the Privacy Policy, and use of local storage in the Cookie Settings. Both form part of these terms.

14. Changes

We may amend these terms. The version in force is the one published on the website, with its date shown above.

15. Governing law and jurisdiction

These terms are governed by the laws of Finland. Disputes are resolved by the competent courts of Finland, without prejudice to mandatory protections that may apply in your country of residence.

16. Severability and contact

If a provision is held invalid, the remaining provisions remain in force. Questions about these terms: legal@veridexaa.com.

Cookie Settings

Last updated: 9 October 2026

This section explains what the website stores on your device and lets you change your choice at any time.

1. What cookies and local storage are

Cookies are small files placed in your browser by a website. Local storage is a comparable browser mechanism that keeps data on your device. Both are covered by the same consent rules.

2. Strictly necessary storage

Key vx_consent_v1 in local storage: records your consent choice and the time it was made. It stays on your device until you clear it or change your choice, and it is not sent to our server. The website sets no cookies of its own by default.

3. Analytics

Off by default. At the time of the last update the website loads no analytics scripts. If analytics is added, it will be activated only after you enable it here, and the tool, its purpose and its retention will be listed in this section.

4. Marketing

The website uses no advertising or marketing cookies and no tracking pixels.

5. Third-party resources

Fonts are loaded from Google Fonts. When your browser requests the font files, Google receives your IP address and browser information. Google Fonts does not set cookies for this request.

6. Changing your choice

Use the Manage cookie preferences button below to reset your choice. The banner will reappear so you can choose again.

7. Browser controls

You can also delete stored data or block storage in your browser settings: Chrome (Settings, Privacy and security), Firefox (Settings, Privacy and Security), Safari (Settings, Privacy) and Edge (Settings, Cookies and site permissions).

8. Legal framework

Storage on your device is governed by the Finnish Act on Electronic Communications Services (917/2014), implementing Article 5(3) of Directive 2002/58/EC, and by the GDPR where personal data is involved.

9. Contact

Questions about storage and consent: privacy@veridexaa.com.