On paper, liability depends on jurisdiction and contract: in the UK, statute typically points to the Account Information Service Provider (AISP) or Payment Information Service Provider (PISP); in the US, data access agreements often route it to the aggregator. In practice, the institution holding the customer relationship deals with the complaint, the regulator, and the reputational fallout first – regardless of where liability is eventually determined to sit.
A breach compounds liability for years, and it starts with the customer account-holding institution.
A data breach or fraud event doesn't resolve at the moment it's discovered – the liability it creates compounds over months or years, as it moves through forensic investigation, litigation, and settlement. The institution holding the customer relationship has to make that customer whole first, then separately pursue redress from the intermediaries and providers further down the chain – often three, four, or more parties removed – a process that can take months, if it resolves at all.
-p-2000.jpg)
.jpg)
