Skip to content
DRAFT REPORT (COM(2023)0360 – C90215/2023 – 2023/0205(COD))

On the proposal for a regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/2554

ECON-PR-757355

Committee on Economic and Monetary Affairs · Rapporteur: Michiel Hoogeveen

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

This is the rapporteur's draft report on the Commission proposal for a regulation on a framework for Financial Data Access (FiDA). It proposes amendments to the Commission text, including changes to recitals and articles. The draft report aims to strengthen customer control over financial data, align FiDA with the General Data Protection Regulation (GDPR) and the Data Act, and prevent gatekeepers under the Digital Markets Act from accessing data. It also proposes to exclude third-country providers from authorisation as financial information service providers, to enhance the role of the European Supervisory Authorities, and to introduce requirements for permission dashboards and compensation.

Committee position. The rapporteur welcomes the FiDA proposal and supports its objectives, but proposes amendments to enhance customer trust, promote innovation, and improve interoperability and supervision, including aligning with the GDPR and the Data Act and strengthening the role of the European Supervisory Authorities.

Key points

  1. Emphasises that customers keep ownership of their financial data and that access should be secure.
  2. Clarifies that FiDA should enable customers to access and re-use their data, and the financial sector to offer services based on that data.
  3. Excludes data related to sickness and health insurance, life insurance, and occupational pension schemes from the scope, and requires respect for trade secrets.
  4. Requires explicit customer permission for data access, prohibits gatekeepers from being data users, and mandates that data use be in the best interest of the customer.
  5. Introduces new definitions for 'financial information service', 'financial service', 'crowdfunding service provider', and 'trade secret'.
  6. Obliges data holders to provide data to customers via online or mobile interfaces, free of charge and in real-time.
  7. Requires data users to protect trade secrets, not transfer data without explicit permission, and not use data for direct marketing without consent.
  8. Mandates the European Supervisory Authorities to develop regulatory technical standards on credit scoring, risk assessment, and pricing for insurance products.
  9. Prohibits denying consumers access to financial products solely for refusing to give data access permission.
  10. Requires permission dashboards to be easily accessible, allow withdrawal and re-establishment of permissions, and not unduly influence customers.
  11. Tasks the European Supervisory Authorities with assessing financial data access schemes and maintaining a public register.
  12. Requires the European Supervisory Authorities to present an annual joint report on the application of the regulation.

Who is affected

  • Customers of financial institutions, who gain rights to access and control their financial data.
  • Financial institutions acting as data holders, required to provide data access and permission dashboards.
  • Financial information service providers, subject to authorisation and obligations.
  • Gatekeepers under the Digital Markets Act, prohibited from accessing data under FiDA.
  • Third-country providers, excluded from authorisation as financial information service providers.

Figures and deadlines

  • Initial capital of EUR 50 000 for financial information service providers as an alternative to professional indemnity insurance.
  • Permission dashboard should include a record of withdrawn or expired permissions for a period of up to two years.
  • Competent authority shall inform the applicant whether authorisation is granted or refused within 3 months of receipt of a complete application.
  • Authorisation lapses if not used within 12 months or if business ceased for more than 6 months.

Legal basis: Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.