AISPs must allow customers to provide consent for accessing their account information for a duration of up to 12 months.