No. There is an exemption for technical service providers that provide IT support for the provision of payment services.
However, they have responsibilities under the provisions of the Communiqué that regulates outsourcing and information security.
Limits of an IT provider
A company providing software, infrastructure or hosting services is not considered to provide payment services as long as it does not have control over the funds. The approach changes as soon as it touches the funds or transmits the payment order on its own behalf.
Technical providers are still contractually responsible to the payment institution. Security, access control and data protection clauses are added to the contract.
Software companies that sell their products to banks or payment institutions should reflect this distinction correctly in their marketing and contract language.
What to pay attention to in the contract
The limits of authority, data ownership, confidentiality and incident notification periods should be written clearly. This way, the sharing of responsibility is also clear during audits.
