Register your application with each ASPSP (bank) or connect via an AISP/PISP aggregation hub that handles bank registration; obtain your eIDAS-qualified certificate (QWAC and QSEAL) required for direct PSD2 API connections in the EU.
Initiate a consent by POSTing to the bank's consent endpoint (Berlin Group NextGenPSD2: POST /v1/consents) specifying the requested access permissions (balances, transactions, accounts) and the validUntil date (maximum 90 days).
Redirect the PSU (Payment Service User) to the SCA (Strong Customer Authentication) authorisation URL returned in the consent response; the user authenticates with their bank using at least two factors.
After SCA completion, the bank redirects the user back to your redirect_uri with a code or confirmation; retrieve the consent status via GET /v1/consents/{consentId} to confirm it is valid.
Use the confirmed consent to call account data endpoints (GET /v1/accounts, GET /v1/accounts/{accountId}/transactions/{transactionId}) attaching the Consent-ID header on each request.
Track consent expiry dates and proactively prompt the user to re-authorise before the 90-day window expires; implement a re-consent flow that creates a new consent object and goes through SCA again.
Known gotchas
The Berlin Group specification allows significant national and bank-level variation — fields, error codes, and SCA redirect flows differ substantially between German, French, Dutch, and other country implementations; do not assume one bank's implementation generalises.
PSD2 mandates 90-day re-authentication for account information access under RTS Article 10; missing this requirement and continuing to access data after consent expiry is a regulatory violation, not just a technical error.
eIDAS certificates required for direct ASPSP connections are issued by qualified trust service providers, are expensive, and expire periodically; most fintechs use an aggregation middleware (e.g., TrueLayer, Salt Edge, Yapily) to avoid managing certificates directly.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp