AISP explained: who is allowed to read UK bank data, and how to become one
What an AISP is, how it differs from a PISP, the three ways to get AISP access in the UK, and what it means for anyone building an AI tool that reads bank accounts.
The short answer
An AISP is an Account Information Service Provider: a firm the FCA has approved to read bank account data on a customer's behalf. If your software reads someone else's bank account through Open Banking, either you are an AISP, you are an agent of one, or you are using an AISP's platform under their licence. There is no fourth option.
AISP vs PISP
| Topic | AISP | PISP |
|---|---|---|
| Stands for | Account Information Service Provider | Payment Initiation Service Provider |
| What it can do | Read balances, transactions and account details | Instruct a payment from the customer's account |
| Regulatory route | Registration (lighter) or authorisation | Authorisation only |
| Capital requirement | None for registration | Yes |
| Typical users | Budgeting apps, lenders assessing affordability, accountancy tools, AI finance assistants | Payment providers, checkout services |
| Risk profile | Data only, no money moves | Money moves |
Most AI finance tools only need AISP access. Adding payments means becoming a PISP, which is a materially heavier regulatory undertaking. Read-only is the sensible starting point.
The three routes to AISP access
- Registered AISP (RAISP). A firm that only provides account information can register with the FCA rather than seek full authorisation. Registration is lighter than authorisation but is still a proper FCA application: you need professional indemnity insurance, a security policy, incident procedures, and directors the FCA is satisfied with. Expect months, not weeks, and legal costs.
- Agent of an AISP. An existing AISP can appoint you as its agent. You appear on the FCA register under their firm, they carry the regulatory responsibility, and you operate under their oversight. Several of the large providers offer this. It is faster and cheaper than your own registration and is the normal starting point for early-stage products.
- Use an AISP's platform. Providers such as TrueLayer, Plaid, Yapily and GoCardless are themselves AISPs. If your product uses their hosted consent flow and they remain the party the customer consents to, you may not need any regulatory status of your own. Whether this works depends on how your product is structured and each provider's terms. Take advice before assuming it applies to you.
What the FCA register tells you
Every AISP, and every agent, is on the FCA Financial Services Register. Search the firm name, check the permissions include "Account information services", and check the status is current. A firm that is not there is not licensed, whatever its website says. This applies to AI tools as much as to apps: if a tool asks you to connect your bank and neither it nor a named provider is on the register, do not connect.
Consent and the 90-day rule
When you connect an account through an AISP, you authenticate at your bank and approve a specific consent: which accounts, what data, for how long. Under current UK rules the AISP must reconfirm your consent every 90 days, but you no longer have to re-authenticate at the bank each time. You can withdraw consent at any point through the AISP or through your bank.
For AI assistants this is the practical constraint to design around: a connection is not permanent, and the tool must handle reconfirmation gracefully or it will silently stop working.
What this means for AI finance tools
A self-hosted tool that reads only your own accounts, on your own server, is in a different position from a product other people use. The regulatory obligations attach to providing a service to others.
Anything offered to the public that reads bank data needs one of the three routes above. Agent-of-AISP via an established provider is the realistic path for a small team.
Adding "pay this bill" changes the category entirely. Keep read-only until there is a clear reason not to.
FAQ
What does AISP stand for?
Account Information Service Provider. It is the regulated category for firms that read bank account data with the customer's consent.
Is registration the same as authorisation?
No. Registration is a lighter route available only to firms providing account information services and nothing else. Authorisation is the full regime and is required for payment initiation.
How long does it take to become a registered AISP?
Plan for several months from a complete application. Preparing the application takes time too.
Can I be an agent of more than one AISP?
In principle, but in practice a product uses one provider's rails. Pick one.
Do I need to be an AISP to build an MCP server for my own accounts?
If it only serves you, on infrastructure you control, you are not providing a service to others. The moment other people use it, the analysis changes.
Related guides
- Monzo, Starling and Revolut APIs: what an AI assistant can actually read
How Monzo, Starling and Revolut expose account data to developers and AI agents in the UK, and where each bank's own API ends and Open Banking begins.
- Is Open Banking safe? What changes when an AI assistant is on the other end
How UK Open Banking protects your data, what a licensed provider can and cannot do, and the extra questions to ask before letting an AI assistant read your bank account.