European Accessibility Act for payment apps: responsibilities of an overseas fintech and its EU partner

The European Accessibility Act (EAA), Directive (EU) 2019/882, covers specified consumer services provided from 28 June 2025. Its consumer banking category includes payment services, services linked to payment accounts and electronic money. The proposed Irish offering therefore falls within that category on the stated facts. The European Accessibility Act for banks also matters to an EMI providing these services; the statutory category extends beyond institutions called banks. (EAA, arts. 2(2)(d) and 3(28); S.I. No. 636/2023, regs. 2 and 3(2)(e).)

Record which entity offers each service, signs the customer contract and controls onboarding, account operation, communications and complaints. Under this arrangement, the Irish EMI is the service provider. The Kenyan company supplies development, maintenance and agreed support to it. Those business-to-business activities do not automatically impose every EAA service-provider duty on the software supplier. If the Kenyan company also offers a covered service directly to consumers, assess that activity separately. An online process directed at concluding a consumer contract can also engage the e-commerce category. (EAA, arts. 3(4), 3(30) and 13; S.I. No. 636/2023, regs. 2, 3(2)(g) and 14.)

Developing the app in Kenya does not remove the Irish provider's obligations. The service-provider definition includes persons offering services to consumers in the Union. The EAA does not impose a general EU representative requirement on service suppliers. Its authorised-representative provisions concern manufacturers and products. (EAA, arts. 3(4), 3(18), 8 and 13.)

A payment terminal is a separately covered product. A mobile app serving as the interface to this payment service does not require EAA CE marking or a product EU declaration of conformity merely for that reason. If the parties later supply covered hardware, identify its manufacturer, importer and distributor and apply the relevant product duties. (S.I. No. 636/2023, regs. 3(1), 8–12 and 17–19.)

For an EMI or payment institution (PI), the role schedule used for an EMI or PI Principal Launch should therefore identify both the regulated service and the supplier's actual delivery responsibilities.

Ireland implements the EAA through the European Union (Accessibility Requirements of Products and Services) Regulations 2023, S.I. No. 636/2023. The Central Bank of Ireland is the compliance authority for consumer banking services. The Competition and Consumer Protection Commission has the product market-surveillance role and supervises specified services, including e-commerce. Expansion into another Member State requires a further check of its implementation, authority, procedures and enforcement rules. (S.I. No. 636/2023, reg. 4; EAA, arts. 23, 29 and 30.)

The microenterprise exemption concerns the service provider claiming it. The definition requires fewer than ten persons and either annual turnover or an annual balance-sheet total not exceeding €2 million. Verify the accounts, staffing and ownership links. The EAA's anti-circumvention recital points to Recommendation 2003/361/EC, whose Annex addresses partner and linked enterprises. A small Kenyan supplier's status does not exempt a larger Irish EMI. No exemption is established on the stated facts. (S.I. No. 636/2023, regs. 2 and 5(4); EAA, recital 53; Recommendation 2003/361/EC, Annex, arts. 3–6.)

Fundamental alteration and disproportionate burden are separate, limited grounds for relief. The provider must assess the particular requirement and document the relevant test. A disproportionate-burden assessment must use Schedule 4, including cost ratios and the benefits for people with disabilities. Funding from outside the operator's own resources specifically provided to improve accessibility prevents reliance on that burden ground. These provisions do not make a difficult integration or supplier refusal an exemption. (S.I. No. 636/2023, reg. 15(1)–(4), (8) and Schedule 4.)

Keep the assessment for five years after the service was last provided and inform the relevant authority when relying on the relief. Renew a disproportionate-burden assessment when the service changes, when the authority requests it and at least every five years. Continue to meet unaffected requirements. (S.I. No. 636/2023, reg. 15(4), (7) and (9).)

The proposed new launch has no established transitional protection. The concession for service contracts agreed before 28 June 2025 concerns their unchanged continuation for a limited period. Separate provisions address continued use of products and existing self-service terminals. Reusing an old software component does not bring a new app-based service within those concessions. (S.I. No. 636/2023, reg. 38; EAA, art. 32.)

Start with a customer-journey inventory. Include learning about the service, account opening, identity verification, authentication and recovery, balances, statements, payee entry, payment approval, errors, help and complaints. For each step, identify the screen or communication, its supplier, the applicable requirement and the evidence needed. Record third-party software development kits (SDKs), embedded web pages and external redirects.

The law requires accessible websites and mobile services. Consumer banking requirements expressly extend to identification methods, electronic signatures, security and payments. These functions must be perceivable, operable, understandable and robust. The limited exception for third-party content requires it to be neither funded, developed nor controlled by the operator. Commissioning an identity or authentication component does not establish that exception. (S.I. No. 636/2023, reg. 3(4)(d) and Schedule 1, Parts 3(c) and 4(e)(i).)

Translate those outcomes into testable tasks. A customer using a screen reader must be able to identify fields and understand errors. Controls must support relevant alternative input methods. Payment information must expose the payee, amount, charges and result in an accessible form. Test correction, cancellation, timeouts and uncertain transaction outcomes, as well as successful payments. These are proposed implementation checks, supported by the functional requirements and relevant technical criteria. (Schedule 1, Parts 3, 4(e) and 7; Web Content Accessibility Guidelines (WCAG) 2.2, success criteria 3.3.4 and 4.1.3.)

Accessible onboarding must preserve identity verification. If a camera task or document-upload flow excludes a customer, assess an accessible route using reliable documents or information, with trained assistance where appropriate. The EMI must approve the method and retain evidence of the checks. Irish law requires identification and verification; it does not prescribe one universal selfie workflow. (Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, ss. 33(2)–(3) and 55(1)–(2), as amended, including by the 2021 Amendment Act, s. 6.)

Strong customer authentication remains necessary where the payment rules require it, subject to the applicable exemptions. An alternative must preserve the required independent authentication elements and, for relevant remote payments, dynamic linking to the amount and payee. Accessibility does not create a separate exemption. A support agent should not solve an inaccessible approval screen by asking for the customer's security credentials. (S.I. No. 6/2018, reg. 120; Commission Delegated Regulation (EU) 2018/389, arts. 4, 5 and 9.)

Select technical evidence that matches the service

As at 3 November 2026, EN 301 549 V4.1.1 (September 2026) is the published technical edition. It incorporates WCAG 2.2 requirements for relevant web, document and software functions. At that date, V4.1.1 had not been cited in the Official Journal under the EAA. Its publication does not itself establish an EAA presumption of conformity. That requires the relevant Official Journal citation and applies only to requirements covered. The citation of V3.2.1 under Decision (EU) 2021/1339 concerns the public-sector Web Accessibility Directive, not this EAA service. (EAA, art. 15; EN 301 549 V4.1.1, Annex A.2.0; ETSI, work item REN/HF-00301561, status at 3 November 2026; Decision (EU) 2021/1339, arts. 1–2 and Annex.)

Specify the edition and applicable clauses in procurement and testing. WCAG 2.2 Level AA is a useful contractual target, but a web-page result does not establish conformity of native software, statements, support and service information. Require competent manual evaluation alongside useful automated checks, relevant assistive technologies and appropriate user testing. State the tested builds, devices, operating systems and component versions. (EN 301 549 V4.1.1, clauses 9–12; WCAG 2.2, sections 5.2.2–5.2.3.)

An overlay, scan report, accessibility statement or certification badge cannot replace that evidence. Review what was tested, which requirements were assessed, the failures found and the limitations. A supplier's component report must be checked against the component's behaviour inside the actual app.

Provide accessible information about the service's operation and accessibility features. Review contractual material, fees, instructions, balances, statements, notifications and complaint information. The requirements include information available through more than one sensory channel, understandable presentation and accessible electronic formats. Consumer banking information must not exceed the complexity of Council of Europe language level B2, or upper intermediate. Use plain explanations while retaining legally necessary content. (S.I. No. 636/2023, Schedule 1, Parts 3(b) and 4(e)(ii).)

Before providing the service, the EMI must prepare information explaining how it meets the requirements. Include it in the general terms or an equivalent document. Describe the service, its operation and how the applicable requirements are met. Make this information publicly available in writing and orally, in accessible forms, and retain it throughout operation. A description of future intentions cannot establish how the launch version complies. (S.I. No. 636/2023, reg. 14(2) and Schedule 3.)

First-line support should be able to explain accessibility features and assistive-technology compatibility through accessible communication modes. Give staff an escalation route for failed onboarding, authentication and payments. Test the route itself, including any identity check required to obtain help. Ireland's current Consumer Protection Regulations also address assistance for consumers in vulnerable circumstances, relevant staff training, digital design and access to assistance. Include the Kenyan support team in the EMI's applicable training and oversight arrangements. (S.I. No. 636/2023, Schedule 1, Part 3(d); S.I. No. 81/2025, as amended, regs. 9(1)(a)(ii), 34–35 and 38–41.)

Define what Kenyan staff can access

Map the actual information available to support and developers: identity documents, account records, transaction details, tickets, recordings and authentication logs. If the Kenyan company processes this information only on the EMI's instructions, provide the required processor terms and controls over subcontractors. Assess any use for the supplier's own purposes separately. Limit permissions and retention to the support task. (General Data Protection Regulation (GDPR), arts. 4(7)–(8), 5(1)(c), 28 and 32.)

Making EU customer data remotely available to the separate Kenyan company can constitute an international transfer. EU hosting does not remove that issue. Kenya has no European Commission adequacy decision. Before access begins, establish the applicable Chapter V safeguard. Where appropriate, use the correct standard contractual clauses and assess the destination's laws and practices, with necessary supplementary measures. (GDPR, arts. 44–46; Decision (EU) 2021/914, art. 1 and Annex, clause 14; European Data Protection Board (EDPB) Guidelines 05/2021, paras. 9 and 16; European Commission, adequacy-decisions list, as at 3 November 2026.)

Kenyan processing also requires a local assessment. The Data Protection Act 2019 applies to the Kenyan entity's processing in Kenya. Check registration with the Office of the Data Protection Commissioner, lawful processing, security and processor contracts. The registration regulations specifically list processing for financial services. Assess subsequent transfers out of Kenya, including additional conditions for sensitive data. (Kenya Data Protection Act 2019, ss. 4, 18, 25, 30, 41–42 and 48–49; General Regulations 2021, regs. 24–25 and 40–48; Registration Regulations 2021, reg. 13 and Third Schedule, item 8.)

Record the assistance or communication preference needed. Avoid collecting medical evidence simply to permit an accessible route. Disability information that reveals health status and biometric identification data require the applicable additional safeguards; ordinary identity-verification duties remain separate. (GDPR, arts. 5(1)(c) and 9; Kenya Data Protection Act 2019, ss. 2 and 44–46.)

The EMI should own the legal requirements assessment, complete-service acceptance, public information and regulatory response. The Kenyan supplier should own agreed interface and support deliverables, component coordination, defect investigation and repairs within its control. Allocate responsibility for EMI-controlled systems and each other vendor expressly. The EMI's obligation to maintain conformity continues through outsourcing. (S.I. No. 636/2023, reg. 14.)

Use an accessibility schedule with these proposed contractual controls:

1. Specify the supported customer tasks, relevant legal requirements, technical edition and responsibilities for every component and support channel.
2. Require component evidence and integrated testing of the actual release. Give the EMI access to findings, methods, reproduction steps, test limitations and retest results.
3. Classify defects by the customer task prevented and the consequence. Set escalation, containment and repair periods suited to that impact. These agreed periods do not replace statutory duties or an authority's direction.
4. Make acceptance depend on the agreed evidence and correction of unresolved non-compliance, unless a legally supported exception applies. A commercial risk rating cannot create an exemption.
5. Require notice and regression checks for material app, SDK, identity, authentication and support changes. Apply equivalent requirements to subcontractors and reserve access needed to investigate failures.
6. Provide continuity and exit arrangements so the EMI can obtain records, maintain accessible service and transfer repair work when a supplier is replaced.

The Digital Operational Resilience Act (DORA) also governs the EMI's arrangements for ongoing information and communication technology services. Its contract requirements cover service descriptions, locations, data protection, service levels, assistance, cooperation and termination. Additional requirements apply to services supporting critical or important functions. Classify the arrangement and reconcile the accessibility schedule with those obligations. (Regulation (EU) 2022/2554, arts. 2(1)(d), 3(21), 28 and 30.)

The launch decision should identify the exact release and a named EMI owner. Withhold acceptance where customers cannot complete a required journey, where an unresolved third-party failure prevents conformity with an applicable requirement, or where the evidence omits a necessary component or communication channel. Missing service information or an unsupported exemption also prevents an adequate compliance conclusion. An accessible alternative must be tested and assessed against the applicable requirement before it is accepted.

After launch, monitor complaints, failures and changes affecting accessibility. Update the evidence and public service information when the service changes. If the service is non-compliant, take corrective measures and immediately inform the competent national authorities where it is provided. For this Irish consumer banking service, that includes the Central Bank. Its powers include compliance checks and remedial directions; Irish enforcement provisions also provide court remedies and offences. The EMI must provide the conformity information requested in a reasoned authority notice and cooperate with the authority's compliance action when requested. Supplier service levels must support that response. (S.I. No. 636/2023, regs. 14(3)–(4), 24, 27 and 29–34.)

Keep complaints accessible and distinguish the relevant routes. The EMI should handle individual complaints and explain available escalation, including the Financial Services and Pensions Ombudsman where eligible. A report to the Central Bank serves its supervisory role. Payment-services complaint requirements have their own scope and response periods; they are not general EAA defect-repair deadlines. (S.I. No. 6/2018, regs. 121 and 124–125.)

The recommended arrangement is an EMI-controlled launch decision supported by enforceable supplier obligations and an evidence package containing:

• the legal role map and customer-journey inventory;
• the supplier and component inventory, with versions and control boundaries;
• the applicable-requirements assessment and any exemption evidence;
• technical findings, repairs, retests and assessed alternatives;
• remediation owners, change controls and continuity arrangements;
• the public service information and approved support and data-access arrangements.

Direct consumer services offered by the Kenyan company, different ownership or size facts, covered hardware, another destination market or changed data flows require the allocation to be revisited. Actual test failures determine the work still needed before acceptance. Licensing changes belong in a separate Payment and E-Money Licensing assessment.

Review the payment app's launch responsibilities and supplier terms.