What Are the FRIDA Roles?
FRIDA introduces six terms that define who does what:
- Sending PSP: the PSP that creates a Fraud Alert
- Receiving PSP: a PSP that receives alerts
- ASPSP (account servicing PSP): the PSP that holds the account named in an alert
- FIP (Fraud Information Platform): the connection point for PSPs
- FCP (FRIDA Central Platform): the central hub
- EDS (EPC Directory Service): the participant directory
The FRIDA roles decide who can create an alert, who can change it, who is liable for it and who has to connect to what. Get them clear, and most of the draft FRIDA Rulebook falls into place.
If you need the bigger picture first, read what FRIDA is and how it works.
What Roles Do PSPs Play in FRIDA?
Only PSPs can be scheme participants. Over time, each one will play three different roles.
| Role | What it does |
| Sending PSP | Creates a Fraud Alert, and can later update or cancel it |
| Receiving PSP | Receives every alert and update that other PSPs share |
| ASPSP | Holds the account named in an alert, and can give its verdict on that account |
When a PSP reports one of its own accounts, it is both the Sending PSP and the ASPSP. The rulebook asks PSPs to share these alerts too, so this is not a rare case.
What Is the ASPSP Role in FRIDA?
The ASPSP is in an unusual position. It did not raise the alert, but the alert is about its customer.
FRIDA lets the ASPSP record its own verdict on the account, such as genuine, blocked or closed. We explain how this works in our guide to FRIDA. It can also update the account holder’s details.
Where the IBAN belongs to a customer of an e-money institution (EMI) or payment initiation service provider (PISP), the ASPSP can pass these rights to that firm. That firm must also take part in FRIDA.
The ASPSP does not have to respond. But the rulebook strongly recommends it does so quickly, especially when the account is genuine. A false alert left unanswered can harm a real customer.
What Is a Fraud Information Platform in FRIDA?
PSPs connect to the central platform through a Fraud Information Platform (FIP), which sends and receives alerts on their behalf.
The rulebook is careful about where responsibility sits. A FIP can only serve PSPs that adhere to FRIDA, and it is liable only for its own processing. The scheme duties stay with the PSP.
FIPs must also pass an EPC qualification process, and the detailed criteria are still being finalised. They must be able to process FRIDA messages 24 hours a day, every day, apart from planned maintenance.
Who Can Be a FIP in FRIDA?
Annex II limits the role to certain kinds of organisation. These include national banks and financial regulators, and bodies they own or supervise, such as clearing and settlement mechanisms. National and financial CERTs and CSIRTs also qualify. So does any licensed PSP.
Can a PSP be its own FIP?
Yes. Because licensed PSPs are eligible, a PSP can act as its own FIP and connect to the FRIDA Central Platform directly. It must then meet every FIP obligation. But it does not have to build the connection itself. Annex II allows a FIP to outsource its FRIDA work to third parties under binding contracts, so a PSP can use a technology service provider to run it.
How Does the FRIDA Central Platform Work?
FRIDA hub-and-spoke model: PSPs connect through FIPs, or as their own FIP, to the FRIDA Central Platform
FRIDA uses a hub-and-spoke design. At the centre sits the FRIDA Central Platform (FCP).
The FCP receives and checks every Fraud Alert, stores it and makes it available to every connected FIP. It manages each alert’s life cycle, including clean-up when alerts expire. Our article on the FRIDA fraud alert lifecycle covers this in detail. The FCP also offers a user interface for entering and viewing alerts.
The practical benefit is simple. A FIP only needs one connection, to the FCP, not a link to every other FIP. Alerts then flow in near real time.
Who Runs FRIDA Behind the Scenes?
Three more actors complete the picture. The European Payments Council (EPC) is the scheme manager. It owns the FCP and manages who joins. Day-to-day running of the platform sits with an FCP Provider, an external IT firm the EPC appoints.
Then there is the EPC Directory Service (EDS). It holds key data on every participant, including which FIP each one uses. Participants or their FIPs must download it daily and use it to check alerts before sending. For example, an alert must name the ASPSP using the identifier held in the EDS. See what goes into a FRIDA fraud alert for the full dataset.
Does outsourcing move liability?
No. The rulebook says outsourcing “does not relieve” participants of their liabilities and responsibilities. You can hand the work to a FIP or a technology provider. The duties stay with you.
Why the FRIDA Roles Matter
For in-scope PSPs, joining is mandatory. Our guide to who must join FRIDA explains the rules. Once in, your institution will send alerts, receive them and answer for its own accounts, often on the same day.
Each role needs a process, an owner and a link to your fraud systems. Alerts you receive are only useful if they reach the teams that detect and investigate financial crime.
You can be your own FIP without building the connection yourself. TechnoXander FRIDA Fraud Gateway links the FRIDA Central Platform to your fraud and case management systems. Book a demo to see it in practice.
About Author:
