FIDA Compliance Programmes

A FIDA compliance programme is a structured framework for banks, insurers and other financial institutions to implement the requirements of the EU Financial Data Access regulation. FIDA requires financial institutions with 250+ employees or EUR 50 million turnover to share customer data with licensed third parties via standardised APIs. A compliance programme covers governance structures, technical API implementation, consent management, staff training and ongoing monitoring. Without such a programme, institutions face regulatory sanctions and exclusion from participation in the open finance ecosystem.

After FIDA enters into force, financial institutions must join a Financial Data Sharing Scheme (FDSS) within 18 months. General rulebooks must be established within 12 months, technical standards and compensation models within 26 months, and full operation within 30 months. Trilogue negotiations have been running since April 2025, with entry into force expected during 2026. Financial institutions should start analysing their data landscapes and planning governance structures now.

PSD2 was limited to payment data and account information. FIDA extends data access to the entire financial sector: savings, loans, mortgages, insurance, pensions, investments and crypto-assets. FIDA also introduces Financial Data Sharing Schemes (FDSS), through which data holders and users agree on standardised rules for data access, compensation and technical interfaces. According to industry analyses, compliance costs are estimated at three times the PSD2 implementation cost.

An effective FIDA governance framework is based on the three lines of defence model: the first line covers operational business areas implementing data access processes; the second line provides compliance and risk management functions setting policies and oversight; the third line delivers independent review through internal audit. Additionally, a FIDA-specific compliance committee, clear escalation paths, a RACI matrix for all stakeholders and regular board reporting are needed to steer the programme.

FIDA requires financial institutions to provide customer data immediately, continuously and in real time via standardised APIs. The APIs must meet the technical standards agreed within the FDSS and provide a customer dashboard for real-time monitoring and management of data sharing permissions. Data holders must implement consent management systems that handle granular permissions and revocations. The technical infrastructure must also meet DORA requirements for operational resilience.

FIDA is part of the EU digital finance package and closely related to DORA (Digital Operational Resilience Act) and PSD3 (Payment Services Directive 3). DORA governs operational resilience requirements for IT systems, which also apply to FIDA data access infrastructure. PSD3 updates the payments framework and complements FIDA for payment data. A compliance programme should address these regulations in an integrated manner to avoid duplication and leverage synergies in governance, risk management and technical implementation.

Costs depend on the size and complexity of the institution. Industry analyses expect FIDA compliance costs to be three times the PSD2 implementation cost, as FIDA affects most financial products and numerous IT systems. Key cost drivers include API development and integration, consent management systems, governance build-up, staff training and ongoing monitoring. Early planning and leveraging existing PSD2 infrastructure can significantly reduce costs. ADVISORI supports budget planning with realistic cost estimates and implementation timelines.