Skip to content
REPORT (COM(2023)0360 – C90215/2023 – 2023/0205(COD))

On the proposal for a regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/2554

A-9-2024-0183

Committee on Economic and Monetary · Rapporteur: Michiel Hoogeveen

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the Commission proposal for a regulation on a framework for Financial Data Access. It requires financial institutions to share customer data with authorised data users at the customer's explicit request, and sets rules for financial information service providers. It lists the categories of customer data covered, including mortgages, savings, investments, pensions, non-life insurance and firm creditworthiness data, and excludes health, life and consumer creditworthiness data. It requires data holders to provide permission dashboards, and requires data holders and data users to join financial data access schemes that set common standards, compensation models and dispute resolution. It creates an authorisation regime for financial information service providers, supervised by national competent authorities, with sanctions for breaches. It amends Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/2554 to bring financial information service providers within the scope of the European Supervisory Authorities.

Committee position. The Committee on Economic and Monetary Affairs adopts Parliament's position at first reading, amending the Commission proposal to introduce a framework for Financial Data Access, including rules on data sharing, permission dashboards, financial data access schemes, and authorisation of financial information service providers.

Key points

  1. Data holders must make customer data available to the customer or to a data user acting on the customer's behalf, without undue delay, continuously and in real-time, free of charge to the customer.
  2. Data holders may claim compensation from data users only under a financial data access scheme or Article 11, limited to reasonable and proportionate costs.
  3. Data users must be financial institutions or authorised financial information service providers, and may only access data adequate, relevant and necessary for the permitted purpose.
  4. Data users must not process data for other purposes, transfer it to third parties without explicit permission, or combine it with gatekeeper data.
  5. Data holders must provide a permission dashboard allowing customers to view, manage and withdraw permissions, and to opt out of future data access.
  6. Data holders and data users must become members of a financial data access scheme by 30 months from entry into force, with development, implementation and operationalisation phases.
  7. Financial data access schemes must include fair representation, open membership, common standards, a compensation model, liability rules and dispute resolution.
  8. The Commission may adopt a delegated act specifying data access arrangements if a scheme is not developed or implemented in time.
  9. Financial information service providers must be authorised by the competent authority of their Member State of establishment and meet governance, security and professional indemnity insurance requirements.
  10. EBA must maintain a public register of authorised financial information service providers and financial data access schemes.
  11. Member States must provide for administrative penalties and periodic penalty payments for infringements, including fines up to EUR 35 000 for natural persons and up to EUR 160 000 or 4.5% of turnover for legal persons.
  12. The regulation applies from 32 months after entry into force, with Articles 9 to 13 applying from 30 months, and special later dates for certain entities.

Who is affected

  • Financial institutions acting as data holders, such as credit institutions, payment institutions, investment firms and insurance undertakings, must share customer data on request.
  • Financial information service providers must be authorised and supervised, and must meet organisational and security requirements.
  • Customers, including consumers and micro, small and medium-sized enterprises, gain rights to access and control their financial data.
  • Gatekeepers and entities owned or controlled by them face restrictions on accessing and combining customer data.
  • Small enterprises are excluded until 12 months after the date of application, but may opt in earlier.

Figures and deadlines

  • Compensation for data access is limited to reasonable and proportionate costs.
  • Small enterprises are excluded until 12 months from the date of application of the Regulation.
  • Financial information service providers must hold initial capital of EUR 50 000 as an alternative to professional indemnity insurance.
  • Maximum administrative fines for natural persons: up to EUR 35 000 per infringement and up to EUR 350 000 per year.
  • Maximum administrative fines for legal persons: up to EUR 160 000 per infringement and up to EUR 1 600 000 per year, or 4.5% of total annual turnover.
  • Periodic penalty payments: 3% of average daily turnover for legal persons, EUR 30 000 for natural persons, for up to 6 months.
  • The regulation applies from 32 months after entry into force, with Articles 9 to 13 applying from 30 months.
  • For certain entities, the regulation applies from 38 months after entry into force, with Articles 9 to 13 applying from 36 months.

Legal basis: Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.