On paper, liability depends on jurisdiction and contract: in the UK, statute typically points to the Account Information Service Provider (AISP) or Payment Initiation Service Provider (PISP); in the US, data access agreements often route it to the aggregator. In practice, the institution holding the customer relationship deals with the complaint, the regulator, and the reputational fallout first – regardless of where liability is eventually determined to sit.
Why the practical answer differs from the contractual one
A breach compounds liability for years, and it starts with the customer account-holding institution.
A data breach or fraud event doesn't resolve at the moment it's discovered – the liability it creates compounds over months or years, as it moves through forensic investigation, litigation, and settlement. The institution holding the customer relationship has to make that customer whole first, then separately pursue redress from the intermediaries and providers further down the chain – often three, four, or more parties removed – a process that can take months, if it resolves at all.
About Invela
Invela is the infrastructure layer that makes open finance trustworthy – accrediting who's in the network, monitoring risk in real time, and ensuring liability lands in the right place.
