Financial Data Access Framework (FIDA)

Proposal for a regulation on a framework for financial data access (COM/2023/360)

Background and Scope

A central objective of the proposed Financial Data Access (FIDA) regulation is to provide consumers and businesses throughout the EU with greater control over their financial data, while simultaneously facilitating more uniform data sharing in the financial sector. It is closely connected to broader initiatives promoting open finance and is designed to give customers greater control over their financial information. While certain financial institutions have customarily handled and exchanged account data, FIDA implements more uniform standards designed to ensure consistency and security in those interactions.

Within FIDA, regulators emphasize secure data-sharing protocols, robust consumer protections, and the responsible use of consumer data by all involved parties. Intended to complement existing data protection regulations, it imposes heightened compliance requirements on both traditional financial institutions and newer market entrants. The scope of FIDA extends to various categories of financial entities, including investment firms, financial information service providers and electronic money institutions.

Key Obligations

• Secure interfaces and API implementation: Implementation of secure interfaces or application programming interfaces (APIs) for exchanging and receiving data. This includes robust encryption and identity-verification mechanisms.
• Access provision and data sharing scheme participation: Financial service providers must leave access to other financial information service providers (FISPs). These will need to join Financial Data Sharing Schemes.
• Customer data release and consent management: Data holders, at the explicit request of the customer, must release relevant data to authorized recipients, including information on loans, savings products, and insurance policies. Furthermore, customers must be able to view the consents they have granted at any time and withdraw them via a dedicated digital dashboard.
• Licensing the regulatory oversight requirements: FISPs are required to hold licenses to access customer data and will also be subject to audits by the competent national authorities in each specific case.