Versions Compared

Old Version 47

changes.mady.by.user Praveen Ponnumony

Saved on

compared with

New Version 48

changes.mady.by.user Edward Lisley

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Panel
titleColorBlack
borderStyledashed
titleOB Standards

This Section applies to ASPSPs that have implemented OB Standards

Page Properties
iconfalse
idTC-OB Standards


-Have you Implemented OB Standards?
  •  Yes
  •  No

Open Data - Which version have you Implemented?
  •  None
  •  V2.2
  •  V2.3
  •  V2.4

Read/Write API Specification Implemented or planning to implement

(Lowest version = Current, Highest version = Planned)

  •  V3.0
  •  V3.1
  •  V3.1.1
  •  V3.1.2
  •  V3.1.3
  •  V3.1.4
  •  V3.1.5
  •  V3.1.6
  •  V3.1.7
  •  V3.1.8
  •  V3.1.9
  •  V3.1.10
  •  V3.1.11

Read/Write API - Which date are you planning to implement your latest version?

Dynamic Client Registration - Which version have you Implemented or planning to implement?

(Lowest version = Current, Highest version = Planned)

  •  None
  •  V3.1
  •  V3.2
  •  V3.3

DCR - Which date are you planning to implement your latest version?

Have you implemented Trusted beneficiaries, if not date planned to Implement?

  •  Already Implemented
  •  Planning to implement
  •  Not planning to implement 

Have you implemented Reverse Payments, if not date planned to Implement?

  •  Already Implemented
  •  Planning to implement
  •  Not planning to implement 

Have you implemented ECA Standard?

  •  Already Implemented
  •  Planning to implement
  •  Not planning to implement 

ECA Implementation details


Contact: [enter contact details for the relevant person(s) at your organisation]

[You can use this space to provide your status with respect to the Standard]

Have you implemented Bulk/File Payments?

  •  Already Implemented
  •  Planning to implement
  •  Not planning to implement 

Have you implemented VRP – Sweeping, if not date planned to Implement?

  •  Already Implemented
  •  Planning to implement
  •  Not planning to implement 

Have you implemented VRP non-Sweeping, if not date planned to Implement?

  •  Already Implemented
  •  Planning to implement
  •  Not planning to implement 

Contact: [enter contact details for the relevant person(s) at your organisation]

[You can use this space to provide implementation details relevant to VRP]
PISP - Single Payment Limit£
PISP - Daily Payment Limit£
How many months of transaction do you provide?

Are you planning to implement TRIs(Transactional Risk Indicator enhancements included in v3.1.10), if so, implementation date?

What is your approach to Implementing TRIs?
  •  Accept payload with TRI fields – Process all fields
  •  Accept payload with TRI fields – Ignore all fields
  •  Reject payload with TRI fields – Error back to TPP
  •  Accept payload with TRI fields – Process few fields (Provide list of accepted fields)  



...

Panel
borderStyledashed
titleSCA-RTS 90-day reauth Implementation


Page Properties
idSCA-RTS


Which date are you planning on implementing the SCA reauthentication exemption?

30th September 2022

What is your approach to token management to enable application of the reauthentication exemption? (see link to FCA guidance)

Summary: We will refresh the expiry of Refresh tokens so long as Access Tokens are refreshed within a 90-day period.

Solution

  • Capital One UK already issues refresh tokens alongside access tokens, in response to requests from TPPs.
  • Going forward, whenever a TPP makes a request to us using an access token and refresh token that we have issued them, we’ll issue brand new refresh tokens with each response to a TPP.
  • The new refresh tokens will be issued with a validity period of 90 days from the date of issue. Once a new token is issued, the previously issued token will be invalidated.
  • During this 90 day validity period, the TPP can then get another refresh token for another 90 days - and so on.
  • This allows perpetual access, so long as the TPP fetches a new refresh token within the 90 day window.

Customer Experience

  • Customers will not generally need to re-authenticate with Capital One after 90 days so long as the TPP has fetched a new refresh token during the 90 day window that their previous token was valid for (e.g. via batch job).

TPP Changes

  • As a TPP integrating with Capital One UK, you should ensure that you are always capturing and storing the refresh_token from each request, rather than only capturing the initial refresh_token on a first time request for a given customer. This is in line with the Oauth standard recommendation. Only the most recent refresh token will ever be valid.
  • You should also ensure that you have fallback mechanisms in place to ensure that you fetch a new refresh token within the 90 day validity period, for as long as the customer has granted you consent.

Example approach:
Issue a long-lived refresh token during one final SCA, with refresh token rotation implemented.

[Please use this space to provide more details on your approach]

Article 10A - Endpoints exempt of SCA-RTS
  •  

    Accounts

  •  

    Transactions (90days)

  •  

    Balances

  •  

    Standing orders

  •  

    Direct debits

  •  

    Beneficiaries

  •  

    Products

  •  

    Offers

  •  

    Parties

  •  

    Scheduled Payments

  •  

    Statements


Article 10A - Endpoints not exempt of SCA-RTS
  •  

    Transactions (more than 90days)

  •  

    Standing orders

  •  

    Direct debits

  •  

    Beneficiaries

  •  

    Products

  •  

    Offers

  •  

    Parties

  •  

    Scheduled Payments

  •  

    Statements

Live from 24th August 2023Statements of greater than 90 days will require an SCA 
Article 10A - Maximum time period after authentication
Please specify the time period in minutes
SCA-RTS implementation status (updated by OBIE PS team only)

Status
colourGreen
titleImplemented




...

Panel
titleColorBlack
borderStyledashed
titlePSD2


Page Properties
idTC-PSD2


-Which Directory are you using as your Trust Framework?Open Banking
Are you caching the Directory?Yes
Transaction IDs SupportedTBC

Are you enrolled to Dispute Management System?

  •  Yes
  •  No

Are you Seeking Fallback Exemption?

  •  Yes
  •  No


Article 10 - Maximum time period after authentication10 5 minutes
Article 10 - Endpoints exempt of SCA

Accounts, Balances, Transactions (90 days), Statements (90 days)


Major Milestones

Brand(s)Capital One, Post Office, Ocean, Think Money, Littlewoods, Very, Luma, Thimbl




Panel
titleColorBlack
borderStyledashed
titleASPSP Dev Portal and Contact Details


Page Properties
idTC-C


Location of Well Known Endpoints

OB Technical Directory and Dev Portal

Modified Customer Interface URL (if applicable)



Dev Portal URLhttps://open-banking-developer.capitalone.co.uk/
Test Facility URLhttps://developer.capitalone.co.uk/docs/sandboxTesting/index.html
Brand Landing Pages URL
[You can use this space to explain your guidance on using Brand logos]

ASPSP Support Desk Email or Phone Number

(including queries about consent success rates) 

ukdevelopersupport@capitalone.com



...