This Section applies to ASPSPs that have impletemented OB Standards
Info
icon
false
id
Standards-Production
Implement Open Data v2.2
Live
Implement
Have you Implemented OB Standards?
Yes
No
Open Data - Which version have you Implemented?
None
V2.2
V2.3
V2.4
Read/Write API Specification
v3.1
Implement Customer Experience Guidelines v1.1
Mobile
Browser
Implement App-to-App Redirection
Implement OB Security Profile Implementer's Draft v1.1.2
Implement FAPI Profile Implementers Draft 2
Implement CIBA Profile Implementers Draft 1
N/A
Implement Dynamic Client Registration v1.1
Live
Implement Dynamic Client Registration v3.1
Current known issue with DCR v3.1 where NBS are expecting the aud value to be the registered URI (issuer) in the NBS WKEP. OBIE DCR Specs stats this should be the unique identifier for the ASPSP (Org_ID). We will be correcting this when we uplift to DCR v3.3 in Q1 2021
Decommission Read/Write API Specification v1.x/2.x
AIS v1.1 20th January 2020
AIS v2.0 4th May 2020
Change of date for the AIS v2.0 decommission from 20th April to 4th May due to Covid-19 and re-planning the change schedule
Decommission OB Security Profile Implementer's Draft v1.x
Complete
Panel
Implemented or planning to implement
(Lowest version = Current, Highest version = Planned)
V3.0
V3.1
V3.1.1
V3.1.2
V3.1.3
V3.1.4
V3.1.5
V3.1.6
V3.1.7
V3.1.8
Read/Write API - Which date are you planning to implement your latest version?
Dynamic Client Registration - Which version have you Implemented or planning to implement?
(Lowest version = Current, Highest version = Planned)
None
V3.1
V3.2
V3.3
DCR - Which date are you planning to implement your latest version?
Have you implemented Trusted beneficiaries, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
Have you implemented Reverse Payments, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
PISP - Single Payment Limit
£
PISP - Daily Payment Limit
£
How many months of transaction do you provide?
Panel
titleColor
Black
borderStyle
dashed
title
Security Profile
Page Properties
id
ID-Production
Commence support for eIDAS QWAC certificates
Sep 2020
Commence support for eIDAS QSEAL certificates
Sep 2020
Commence support for OBIE QWAC-like certificates
Commence support for OBIE QSEAL-like certificates
Cease support for OBIE non eIDAS-like certificates for transport
We will continue to accept the OB Certificate at the end of the adjustment period in March provided the TPP has identified itself to OBIE using an eIDAS certificate
Cease support for OBIE non eIDAS-like certificates for signing
We will continue to accept the OB Certificate at the end of the adjustment period in March provided the TPP has identified itself to OBIE using an eIDAS certificate
Support for MTLS token endpoint authentication
Support for private_key_jwt token endpoint authentication
Which Security profile have you Implemented or planning to implement?
(Lowest version = Current, Highest version = Planned)
OB Security Profile (Legacy)
FAPI
Other (Please define)
Security Profile - Next Planned Version Implementation Date
CIBA Profile - Implemented or planning to implement
(Lowest version = Current, Highest version = Planned)
None
CIBA
CIBA FAPI Profile
CIBA Profile - Next Planned Version Implementation Date
Security Profile Certification date?
Token Endpoint Authentication Methods Supported
client_secret_post
client_secret_basic
client_secret_jwt
tls_client_auth
Private_key_jwt
Planned date to Cease support for client id and client secret token endpoint authentication
Panel
titleColor
White
titleBGColor
#6180c3
borderStyle
dashed
title
Post Brexit Certificate Implementation
Page Properties
id
Standards-Production
PRE-BREXIT - Certificates Accepted (until 31st Dec 2020)
eIDAS QWAC
eIDAS QSealC
OB legacy (obtransport, obsigning)
OBWAC
OBSeal
Other (Please define)
POST-BREXIT TRANSITION - Certificates Accepted (1st Jan 2021 - 30th Jun 2021)
eIDAS QWAC
eIDAS QSealC
OB legacy (obtransport, obsigning)
OBWAC
OBSeal
Other (Please define)
POST-BREXIT POST TRANSITION - Certificates Accepted (from 1st Jul 2021)
eIDAS QWAC
eIDAS QSealC
OB legacy (obtransport, obsigning)
OBWAC
OBSeal
Other (Please define)
Planned Implementation Date to Satisfy FCA's Post Transition
This date is still being planned by our programme team and the date will be communicated in the new year giving at least 90 days notice
TPP’s registered with tls_client_auth authentication method to update their subject DN information using DCR PUT method (PUT endpoint will be live post our DCR v3.3 release in March 2021.
POST-BREXIT Certificate Implementation Status (updated by OBIE IES team)
statusReadycolour
Panel
Green
title
READY
panel
titleColor
Black
borderStyle
dashed
title
ImplementationCustomer Journey
Page Properties
id
TC-IMP
Directory?
Open Banking
Location of Well Known Endpoints?
OB Technical Directory
API Standard Implemented?
Open Banking
Name of Account Holder Implementation Date?
14 June 2019 (single account holder)
November 2019 (multiples account holders)
Date of Current eIDAS Implementation?
Current Certificates used for Identification?
Nationwide Issued Client Id, SSA and MATLS
Current Certificates used for Transport?
OB Transport / OBWAC
Current Certificates used for Signing?
OB Signing / OBSEAL
Date of Future eIDAS Implementation?
June 2020
Future Certificates used for Identification?
Nationwide Issued Client Id, SSA and MATLS
Future Certificates used for Transport?
OB Transport / OBWAC / QWAC
Future Certificates used for Signing?
OB Signing / OBSEAL / QSEAL
Major Milestones
V3.1 14 June 2019
Offers endpoint 14 Sep 2019
(Inc Other Products, API Updates, API Deprecations, etc)
ASPSPs provide a Unique, Immutable TransactionID from their core system
Are you enrolled to Dispute Management System?
Yes
No
Are you Seeking Fallback Exemption?
Yes
No
Article 10 - Maximum time period after authentication
?
SCA Implementation Date?
(See Notes)
Updated IB authentication screens were implemented on 10th September. This provides members the choice to authenticate using SCA access methods (Card Reader or IB Passnumber and OTP) or maintain access (including via screenscrapers) by continuing to use non-SCA methods of authentication (memorable data). The new log-in screens also now require members to enter their date of birth. In line with the FCA’s six-month adjustment period we intend to gradually remove the ability of our members to utilise non-SCA methods over this time period as TPPs make the transition to open banking APIs. These changes will also be reflected in our OB browser authentication screens. The process of removing the ability to login using non-SCA access starts in November and is primarily focused on members who have been dormant or habitually use SCA methods to login. This activity will run until early December with the majority of active members who utilise non-SCA methods to login then scheduled to be switched to SCA-only login options throughout January to March 2020
SCA Scope? (will it inhibit non PSD2 accounts)
SCA will be delivered to cover the requirements of Reg 100 PSRs
1 Hour
When Strong Customer Authentication (SCA) is completed, you will be able to access all account information the customer has agreed they can access during the initial session (1 hour duration). For subsequent requests we will support requests for accounts, balances and for up to 90 days history of transactions data for 90 days following the authentication (provided the customer has allowed access for this period to the TPP)
Article 10 - Endpoints exempt of SCA
14th September 2019
GET /Accounts
GET /accounts/{AccountId}
GET /accounts/{AccountId}/balances
GET /accounts/{AccountId}/transactions
Access to accounts endpoints allows retrieval of the AccountId to call balance and transaction endpoints
Once initial SCA has been completed you will be able to access the following account information endpoints without SCA (provided the customer has allowed access on an enduring basis to the TPP)
GET /Accounts
GET /accounts/{AccountId}
GET /accounts/{AccountId}/balances
GET /accounts/{AccountId}/transactions
Access to accounts endpoints allows retrieval of the AccountId to call balance and transaction endpoints
Authentication Method - Open Banking Channel (Browser)?
Redirect auth using SCA method that aligns with digital channels.
Authentication Method - Open Banking Channel (APP)?
App to App auth using SCA method that aligns with digital channels.