Versions Compared

Old Version 65

changes.mady.by.user Sam Blackaby

Saved on

compared with

New Version 66

changes.mady.by.user Praveen Ponnumony

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Panel
titleColorBlack
borderStyledashed
titleOB Standards

This Section applies to ASPSPs that have impletemented OB Standards


Page Propertiesinfo
iconfalse
idStandards-Production
Implement Open Data v2.2 Please note we intend to depreciate v 2.1 as of 17th January 2020 (3 month notice has been issued)
Implement Read/Write API Specification v3.1 
Implement Customer Experience Guidelines v1.1

  

Sandbox full consent journey doesn’t form part of RTS scope.  Prodn - deployments staggered weekly from 1st March to end of April.
Implement App-to-App Redirection Live in Production
Implement OB Security Profile Implementer's Draft v1.1.2 Implement FAPI Profile Implementers Draft 2TBC - Currently undertaking a infrastructure migration and as such our provisional target is to be FAPI compliant in our new Sandbox towards the end of 2020 / early 2021.Implement CIBA Profile Implementers Draft 1N/AImplement Dynamic Client Registration v1.1N/AImplement Dynamic Client Registration v3.1TBC


Have you Implemented OB Standards?
  •  Yes
  •  No

Open Data - Which version have you Implemented?
  •  None
  •  V2.2
  •  V2.3
  •  V2.4

Read/Write API Specification Implemented or planning to implement

(Lowest version = Current, Highest version = Planned)

  •  V3.0
  •  V3.1
  •  V3.1.1
  •  V3.1.2
  •  V3.1.3
  •  V3.1.4
  •  V3.1.5
  •  V3.1.6
  •  V3.1.7
  •  V3.1.8

Read/Write API - Which date are you planning to implement your latest version?

Dynamic Client Registration - Which version have you Implemented or planning to implement?

(Lowest version = Current, Highest version = Planned)

  •  None
  •  V3.1
  •  V3.2
  •  V3.3
Dynamic registration implementation is in progress. Date TBC
Decommission Read/Write API Specification v1.x/2.xTBCDecommission date for v1 AIS Production (v1 not supported in sandbox) will be triggered when less than 5% usage. Currently 7.5%
Decommission OB Security Profile Implementer's Draft v1.xTBCNeed to understand security profiles - Eidas/Fapi & CIBA - dates not currently known
Panel
DCR - Which date are you planning to implement your latest version?

Have you implemented Trusted beneficiaries, if not date planned to Implement?

  •  Already Implemented
  •  Planning to implement
  •  Not planning to implement 

Have you implemented Reverse Payments, if not date planned to Implement?

  •  Already Implemented
  •  Planning to implement
  •  Not planning to implement 

PISP - Single Payment Limit£
PISP - Daily Payment Limit£
How many months of transaction do you provide?




Panel
titleColorBlack
borderStyledashed
titleMethod of IdentificationSecurity Profile


Page Properties
idID-Production
Commence support for eIDAS QWAC certificates13th Sept 2019PROD rollout ready to progress with TPP's - no certs yet received
Commence support for eIDAS QSEAL certificates
Not supported
We do not plan on supporting QSEALs.

Commence support for OBIE QWAC-like certificates

LiveCurrently already supporting these certificates
Commence support for OBIE QSEAL-like certificatesLiveCurrently already supporting these certificates
Cease support for OBIE non eIDAS-like certificates for transport30th June 2021Cease support for OBIE non eIDAS-like certificates for signing30th June 2021Support for MTLS token endpoint authenticationAlready LiveSupport for private_key_jwt token endpoint authenticationN/A


Which Security profile have you Implemented or planning to implement?

(Lowest version = Current, Highest version = Planned)

  •  OB Security Profile (Legacy)
  •  FAPI
  •  Other (Please define) 

Security Profile - Next Planned Version Implementation Date

CIBA Profile - Implemented or planning to implement

(Lowest version = Current, Highest version = Planned)

  •  None
  •  CIBA
  •  CIBA FAPI Profile

CIBA Profile - Next Planned Version Implementation Date
 

Security Profile Certification date?
 

Token Endpoint Authentication Methods Supported
  •  
    client_secret_post
  •  
    client_secret_basic
  •  
    client_secret_jwt
  •  
    tls_client_auth
  •  Private_key_jwt

Planned date to Cease support for client id and client secret token endpoint authentication
TBC


Following discussion with OBIE, agreed not to stop supporting Client Secret for all certificate types pending stabilisation of eIDAS. Date TBC.





Panel
titleColorWhite
titleBGColor#6180c3
borderStyledashed
titlePost Brexit Certificate Implementation


PRE-BREXIT - Certificates Accepted (until 31st Dec 2020)
Page Properties
idStandards-Production


  •  eIDAS QWAC
  •  eIDAS QSealC
  •  OB legacy (obtransport, obsigning)
  •  OBWAC
  •  OBSeal
  •  Other (Please define) 
POST-BREXIT TRANSITION - Certificates Accepted (1st Jan 2021 - 30th Jun 2021)
  •  eIDAS QWAC
  •  eIDAS QSealC
  •  OB legacy (obtransport, obsigning)
  •  OBWAC
  •  OBSeal
  •  Other (Please define) 

POST-BREXIT POST TRANSITION - Certificates Accepted (from 1st Jul 2021)
  •  eIDAS QWAC
  •  eIDAS QSealC
  •  OB legacy (obtransport, obsigning)
  •  OBWAC
  •  OBSeal
  •  Other (Please define) 
Only change is to remove support of OB legacy certificates. 
Planned Implementation Date to Satisfy FCA's Post Transition

30th June  


TPP PSU Migration Outcomes Supported (see eIDAS Migration Playbook)

N/A - We support client_secret_post

Certificate is not bound to consent so no migration is required other than to use a compliant certificate.

If a TPP needs any support in this process please contact us at openbankingAPI@santander.co.uk. 
POST-BREXIT Certificate Implementation Status (updated by OBIE IES team)

Status
colourGreen
titleREADY

Ready

  • Ready – ASPSP accept eIDAS certs and OB Certs(OBWAC/OBSeal)




Panel
titleColorBlack
borderStyledashed
titleImplementationCustomer Journey


Future Certificates used for Signing?
Page Properties
idTC-IMP

Directory?

Open Banking

Location of Well Known Endpoints?

OB Technical Directory

API Standard Implemented?

Open Banking

Name of Account Holder Implementation Date?

Completed -  Date of Current eIDAS Implementation? Current Certificates used for Identification?OB Transport + ClientID + Secret
OBWAC
QWAC		Current Certificates used for Transport?OB Transport
OBWAC
QWAC		Current Certificates used for Signing?OB Signing
OBSEAL		Date of Future eIDAS Implementation?

No future update currently planned.

Future Certificates used for Identification?Future Certificates used for Transport?
CJ


What is your approach to Implementing OBIE Customer Experience Guidelines (CEG)?

(tick all that apply)

  •  Already Implemented
  •  Planning to implement or upgrade
  •  Not planning to implement CEG
Santander designs are looking to adhere to CEG but are also accounting for other regulatory commitments that fit outside of the CEG

Which version have you implemented or planning to implement?

(Lowest version = Current, Highest version = Planned)

  •  V3.1.2
  •  V3.1.3
  •  V3.1.4
  •  V3.1.5
  •  V3.1.6
  •  V3.1.7
  •  V3.1.8

Which date are you planning to implement your latest CEG version?TBC
Redirection Model
  •  App to App redirection
  •  Decoupled authentication
  •  Embedded Flow
  •  Bespoke User Journeys

Options on 90 day re-authentication?

90 day re-authentication




Panel
titleColorBlack
borderStyledashed
titlePSD2


Yes (for OB Standards
Page Properties
idTC-PSD2


Which Directory are you using as your Trust Framework?Open Banking
Are you caching the Directory?Yes
Transaction IDs Supported

Option 1 Supported

ALL Accounts (except Credit Cards) - Live

Credit Card Accounts -  Live 

ASPSPs provide a Unique, Immutable TransactionID from their core system

Are you enrolled to Dispute Management System?

  •  Yes
  •  No

Are you Seeking Fallback Exemption?

  •  Yes
  •  No


Article 10 - Maximum time period after authentication90 days
Article 10 - Endpoints exempt of SCA

Accounts, Balances, Transactions, Beneficiaries, Direct Debits, Standing Orders, Products, Offers, Parties, Scheduled Payments, Statements

We are continuing to allow Customer non present access to these data endpoints as long as a valid consent token exists.
Major Milestones

Credit Card Accounts (AIS): 14 Aug 2019

App-to-app: 27 Aug 2019

Corporate Customers >6.5m 12 Sept 2019

Savings Accounts: 13 Sept 2019

Cahoot Accounts: 13 Sept 2019

CHAPS Payments 13 Sept 2019

Dynamic Registration: TBC

CBPII Endpoints 14 Sept 2019

International Payments 14 Sept 2019

Credit Card Accounts (PIS): 29 Oct 2019

HCCR Update - In order to display  balance amount in accordance with the HCCR regulation Santander will add the Balance Including Pending and Overdraft Remaining elements in the JSON response for all balance requests for applicable Retail and Business accounts. Deployment date 10th December 2019







3.1.5 AIS is scheduled for launch 30/08/20.

Corporate functionality for Batch and BACS is due for end of July & Multi-Authorisation for end of September. If you or your Corporate customers want to access these services beforehand please contact openbankingAPI@santander.co.uk and we will discuss our contingency mechanism with you.

(Inc Other Products, API Updates, API Deprecations, etc)

The customer balance including the overdraft will be sent in the JSON file as type 'InterimAvailable'.The remaining overdraft will be returned to TPPs in the JSON file as a creditline item and mapped as follows:

OBCreditLine1

OBReadBalance1/Data/Balance/CreditLine/Included - this item will be set to "false".

OBReadBalance1/Data/Balance/CreditLine/Type - set to "Available"

OBReadBalance1/Data/Balance/CreditLine/Amount/Amount - set to the amount of the Overdraft Remaining

OBReadBalance1/Data/Balance/CreditLine/Amount/Currency - set to the currency code of the account balance

The creditline items for Pre-Agreed will remain as is but the item OBReadBalance1/Data/Balance/CreditLine/Included will be set to "false"


Brand(s
)
Security Profile?OB Standards Security Profile compliantProgressing to be compliant with the FAPI Profile supplied by the OpenID Foundation. Security Profile Certification?
)

CIBA

NoUsing Open Banking as your eIDAS Trust Framework?YesAre you caching the Directory?YesTransaction IDs

Option 1 Supported

ALL Accounts (except Credit Cards) - Live

Credit Card Accounts -  Live 

ASPSPs provide a Unique, Immutable TransactionID from their core system

Panel
borderStyledashed
titleCustomer Journey
App to App Implementation Date?
Page Properties
idTC-CJ

Implementing Customer Experience Guidelines?

YesSantander designs are looking to adhere to CEG but are also accounting for other regulatory commitments that fit outside of the CEG
Current CEG Version?Next CEG Version?v3.1.5Next Version Implementation DateDecember 2020

Implementing Bespoke User Journeys?

No

Implementing App to App?

Yes
 

Options on 90 day re-authentication?

90 day re-authentication

Support Embedded Flow?

No





Panel
titleColorBlack
borderStyledashed
titlePSD2ASPSP Dev Portal and Contact Details


Dev Portal URL?
Page Properties
idTC-PSD2

Dispute Management System?

Yes

FCA Adjustment Period - Maintaining Screen Scraping?YesAdjustment period now closed. Screen-scraping is no longer available. 

Seeking Fallback Exemption?

YesGranted exemption for Retail May 2020. Temporary solution for Corporate pending the delivery of payment types (see Major Milestones for more information). 

Adjusted or Fallback Interface?

NoGranted exemption for Retail May 2020. Temporary solution for Corporate pending the delivery of payment types (see Major Milestones for more information). 
Adjusted or Fallback URLN/AContact Email or Phone Number

Business/Technical: openbankingAPI@santander.co.uk

CJ


Location of Well Known Endpoints

OB Technical Directory

Modified Customer Interface URL (if applicable)



Dev Portal URL

https://developer.santander.co.uk

https://sandbox-developer.santander.co.uk/sanuk/external-sandbox/
Test Facility
Implementation Date?
 Production Interface Implementation Date?

AIS

V1  DEPRECATED

V2  DEPRECATED

V3.1  DEPRECATED

V3.1.2 13 Sept 2019

PIS

V1  DEPRECATED

V3.1  

CoF

V3.1.2 13 Sept 2019

Contingency MeasuresScreen scraping access remained until Q1 2020 for those TPP's who had not yet launched API Open Banking services - as per SCA deferment guidance from the FCA. For Contingency Measure please see Major Milestones section above.Article 10 - Maximum time period after authentication?90 days
Article 10 - Endpoints exempt of SCAAccounts, Balances, Transactions, Beneficiaries, Direct Debits, Standing Orders, Products, Offers, Parties, Scheduled Payments, StatementsWe are continuing to allow Customer non present access to these data endpoints as long as a valid consent token exists.

Authentication Method - Open Banking Channel (Browser)?

Retail & Business – OTP

Corporate – Hard token

Authentication Method - Open Banking Channel (APP)?

Retail – Biometric OR Security Number, AND Device Binding

Authentication Method - Private Channel (Browser)?

Retail & Business – OTP

Corporate – Hard Token

Authentication Method - Private Channel (APP)?

Retail – OTP

Authentication Method Implementation Date (Open Banking Channel)?

Live

Authentication Method Implementation Date (Private Channel)?

Live

SCA Implementation Date?

SCA Login for Retail - Completed 15th June

SCA Login for Cahoot - To be completed end of July

SCA Login for Corporate - To be completed end of July

SCA Scope? (will it inhibit non PSD2 accounts)

Yes - Non PSD2 accounts will not be accessible where new SCA login is launched/usedPSD2 Payment Accounts will continue to be accessible via our Open Banking API's
URL

ASPSP Support Desk Email or Phone Number

Business/Technical: openbankingAPI@santander.co.uk




Panel
titleColorBlack
borderStyledashed
titleKey Implementations


This has been changed due to not meeting the v3.1.4 PIS specifications in time for June 16th. Once we are ready with v3.1.4 PIS we will announce the change to Option 2 (if a TPP comes in with a b64 in the “crit” or as its own header “b64” we will error and fail the validation.)

Page Properties
idTC-HCC


High Cost Credit

Santander - HCC.xlsx

The customer balance including the overdraft will be sent in the JSON file as type 'InterimAvailable'.The remaining overdraft will be returned to TPPs in the JSON file as a creditline item and mapped as follows:

OBCreditLine1

OBReadBalance1/Data/Balance/CreditLine/Included - this item will be set to "false".

OBReadBalance1/Data/Balance/CreditLine/Type - set to "Available"

OBReadBalance1/Data/Balance/CreditLine/Amount/Amount - set to the amount of the Overdraft Remaining

OBReadBalance1/Data/Balance/CreditLine/Amount/Currency - set to the currency code of the account balance

The creditline items for Pre-Agreed will remain as is but the item OBReadBalance1/Data/Balance/CreditLine/Included will be set to "false"

View file
nameSantander - HCC.xlsx
height250

Page Properties
idTC-W7

After Waiver 7 Expiry (16/06/20) option supported: Option 1 - The parameter b64 being set to FALSE OR Option 2 - The b64 claim not being in the header

Option 1 -

Post the W007 expiry we will reinstate the signature validation. This means that if a TPP comes in with a B64 in the “crit” or as its own header “b64” it will need to be set to "false" otherwise it will error and fail the validation. We also plan to accept not sending the b64 claim also as description in Option 2).