Who Must Join FRIDA?
A common assumption is that FRIDA will apply to banks first, and to EMIs and payment institutions later. The draft rulebook does not work that way.
The draft FRIDA Rulebook answers the question of who must join FRIDA with two tests. Where is the PSP based? And does it take part in EPC payment schemes? Pass both, and FRIDA adherence is mandatory.
If you are new to the scheme, start with our guide to what FRIDA is and how it works.
Does the type of PSP matter?
No. A bank, an electronic money institution (EMI) and a payment institution are treated the same way. What decides the obligation is EPC scheme membership, not the kind of institution.
Is FRIDA Mandatory for EMIs and Banks?
Decision flow: must your PSP join FRIDA? Located in the EEA and in a SEPA payment scheme means mandatory
Yes, if two conditions are met. A PSP must join FRIDA when it is located in the EEA, and so in scope of the proposed Payment Services Regulation (PSR). It must also participate in one or more SEPA payment schemes.
The rulebook lists those schemes as SEPA Credit Transfer (SCT), SEPA Instant Credit Transfer (SCT Inst), SEPA Direct Debit Core and Business-to-Business (SDD), and One-Leg Out Instant Credit Transfer (OCT Inst).
So an EEA EMI that is a direct participant in SCT Inst is in exactly the same position as a large bank. Both must adhere. Both must be able to send and receive fraud alerts.
Two timing points matter. The obligation applies from the date the PSR takes effect, which the EPC expects in Q4 2028. And for PSPs in non-EU EEA countries, it starts once the PSR applies locally.
Who Can Join FRIDA Voluntarily?
Participation is wider than the mandate. Any PSP processing payments within the PSR’s scope can join, including PSPs that run account-to-account payments through other schemes instead of the EPC ones. For them, joining is optional.
The rulebook sets out the full position in a simple grid:
| Country of PSP | EPC scheme participant | Not an EPC scheme participant |
| EEA | Mandatory | Optional |
| SEPA, non-EEA | Optional if/when possible once regulatory aspects are resolved; mandatory as of a date to be decided by the EPC | Optional if/when possible once regulatory aspects are resolved |
| Non-SEPA, non-EEA | Not applicable | Not applicable |
Source: EPC108-26 FRIDA Rulebook v0.1, section 1.3.
What About Non-EEA SEPA Countries?
The SEPA schemes reach beyond the EEA. The EPC keeps a list of the countries in their scope.
For PSPs in those non-EEA SEPA countries, joining FRIDA depends on equivalence and reciprocity between local law and EU rules. Once that is in place, the EPC will set a date from which SEPA scheme members in that country must join.
What Are the FRIDA Opt-Out Criteria?
Mandatory does not mean without exception. Section 4.8 of the rulebook lists six reasons a PSP can opt out:
- It is outside the euro area and not yet affected by PSR Article 83a.
- The PSR does not apply to it, for example because its accounts are not “payment accounts”.
- It is outside the EEA, in a country with no equivalent local rules.
- It plans to leave all EPC payment schemes before Article 83a takes effect.
- It already shares data under AMLR Article 75 or DORA Article 45, and considers that enough.
- Another reason, which the PSP must specify.
The fifth reason stands out, because it leaves the judgement with the PSP itself. A PSP choosing this route should expect to explain why an AML or cyber-sharing arrangement meets a fraud-sharing obligation.
What Does It Take to Be Eligible?
Whether a PSP joins because it must or because it chooses to, it has to meet the eligibility rules in section 4.4 at all times.
In practice, that means staying licensed and solvent, and complying with AML, sanctions and GDPR rules. It also means having sound risk controls and a secure, reliable connection to the FRIDA ecosystem. To join, a PSP signs the Adherence Agreement and provides a legal opinion.
That connection can run through a third-party Fraud Information Platform, or the PSP can act as its own. Our guide to FRIDA roles explains both routes.
Is FRIDA a receive-only service?
No. Every participant must be able to send alerts as well as receive them, and feed what it receives into its transaction monitoring. In practice, that means mapping your own fraud cases to the FRIDA alert dataset.
Why Treating FRIDA as Optional Is the Riskier Choice
The opt-outs exist. But staying on the edge of FRIDA carries costs that are easy to underestimate.
The first is liability. For in-scope PSPs, FRIDA is how PSR Article 83a data sharing is meant to work, and the PSR also shifts more fraud losses onto PSPs. A PSP that could have seen an alert on a mule account, and did not, will find that hard to defend.
The second is visibility. The draft rulebook envisages alerts naming IBANs held at PSPs outside the scheme. In that case, a non-participant’s customers could be flagged across the network. That PSP would receive nothing, and could not respond by marking a customer’s account as genuine.
The third is targeting. Fraud moves to where controls are weakest. As participants screen against shared alerts, PSPs outside the network become the obvious place to run mule accounts. It is the same logic behind industry-wide checks such as Confirmation of Payee in the UK: protection works best when everyone takes part. The risk will concentrate on the periphery.
Waiting for regulatory clarity is understandable. But as we noted on AMLA’s draft standards, late preparation usually costs more. With FRIDA, it also leaves a PSP exposed while others are already sharing alerts.
If your PSP is in the EEA and takes part in an EPC payment scheme, FRIDA applies to you. TechnoXander FRIDA Fraud Gateway gets you ready to send and receive alerts from day one. Book a demo to map your path to FRIDA.
About Author:
