POST-BREXIT Certificate Implementation Status (updated by OBIE IES team)
Status
colour
Green
title
READY
Panel
borderStyle
dashed
title
Implementation
Page Properties
id
TC-IMP
Directory?
Open Banking
Location of Well Known Endpoints?
OB Technical Directory
API Standard Implemented?
Open Banking
Name of Account Holder Implementation Date?
Completed - September 2019
Date of Current eIDAS Implementation?
September 2019
Current Certificates used for Identification?
OB Transport + ClientID + Secret OBWAC
Current Certificates used for Transport?
OB Transport / OBWAC
Current Certificates used for Signing?
OB Signing / OBSEAL
Date of Future eIDAS Implementation?
March 2020
As of the 14th of March, TPPs with eIDAS certificates who have registered with the Open Banking Implementation Entity and are onboarding with OBWAC/OBSEAL or QWAC/QSEAL certificates, can continue to use manual onboarding via the developer portal. Using this method, the TPP logs onto the developer portal with their Open Banking credentials and can create an application to onboard. This will ensure the TPP can continue to use their existing application on the developer portal that any associated live customer consents will have been created under. If a TPP has an eIDAS certificate, and wants to onboard directly with us, this is possible via our Dynamic Client Registration.
Future Certificates used for Identification?
OBWAC / QWAC
Future Certificates used for Transport?
OBWAC / QWAC
Future Certificates used for Signing?
OBSEAL / QSEAL
Major Milestones
Delivered Items:
P2 2WR / Event Notification API since
AIS / PIS / COF v3.1.4 since
P7 Phase 1 (SIP) Refunds (Payments v3.1.4) since
P7 Phase 2 (Non-SIP) Refunds (Payments v3.1.4) from
P9 Payment Status since - Changes may need to be made by TPP to cater for additional statuses as per OBIE specifications - in some instances, TPPs will need to call the Payment Status endpoint to ensure they have the latest view
CEG v3.1.5 (Agency Arrangement) from
Waiver 007 (Payment and Event Notification Signing) from
Key points for TPP awareness and action;
All payment requests in Sandbox and Production (as appropriate) must not include the b64 claim in the header.
Your requests will fail if they include the b64 claim after this date.
Changes at TPP side to enable sending JWS signature in Payment requests (as per Waiver specs; 3.1.4 & above) can be made any time before 26th October – if the change is not made by this date then your requests will fail
Changes at TPP side to validate JWS signature in Barclays’ payment response can only be made after 26th October
AIS v3.1.6 (CASS) from
Future Delivery Items:
AIS / PIS / COF v3.1.7 from
Other deliverables to be aligned with CMA roadmap for 2021
Relevant AIS / PIS / CoF journeys supported for following payment account types:
Note that Account Holder Name for PCA / BCA / Pingit customers is available through PARTIES end point and through ACCOUNTS end point for Barclaycard UK, Barclaycard Commercial Payment and Barclays Corporate customers
IMPORTANT INFORMATION
In order to complete Open Banking journeys, you will need to establish the Identity Provider (IDP) authentication method for your implementation.
An IDP is a system to authenticate and gain permission from an end user - such as a customer, to access their resources e.g. their account data. For Open Banking, this is used to authenticate the customer providing the consent to the Third Party.
Examples of an IDP in Open Banking includes Barclays app (Personal and Business Banking customers) and iPortal (Barclays Corporate clients), but we have a number of methods depending on the customer type and digital channel that they use. This needs to be considered in your development.
The latest OpenID configuration (OIDC) URLs available are shown below
TPPs are reminded that latest URLS MUST be used and where a legacy URL is still being used then TPP MUST migrate to URLs below
Note - some Business Banking clients will require the Corporate Banking IDP as they use Corporate Banking services to fulfil their business requirements and some Corporate clients will require the Business Banking IDP as they use Business Banking services to fulfil their business requirements
Brand(s)
Security Profile?
Currently Open Banking Security Profile
FAPI 2 rules enforced
TPPs must align their Open Banking implementations to the following security best practices recommended under FAPI 2
The request object must contain an exp claim
You must use PS256 algorithms to create the request Object signing