This Section applies to ASPSPs that have implemented OB Standards
Page Properties
icon
false
id
TC-OB Standards-Production
Implement Open Data v2.2
Live
Implement Read/Write API Specification v3.1
Implement Customer Experience Guidelines v1.1
Mobile
Browser
Implement App-to-App Redirection
Implement OB Security Profile Implementer's Draft v1.1.2
Implement FAPI Profile Implementers Draft 2
Implement CIBA Profile Implementers Draft 1
N/A
Implement Dynamic Client Registration v1.1
Live
Implement Dynamic Client Registration v3.1
Decommission Read/Write API Specification v1.x/2.x
AIS v1.1 31st October 2019
Planning to decommission v1 APIs in end of October once TPPs have completed migration.
Decommission OB Security Profile Implementer's Draft v1.x
Complete
-Have you Implemented OB Standards?
Yes
No
Open Data - Which version have you Implemented?
None
V2.2
V2.3
V2.4
Read/Write API Specification Implemented or planning to implement
(Lowest version = Current, Highest version = Planned)
V3.0
V3.1
V3.1.1
V3.1.2
V3.1.3
V3.1.4
V3.1.5
V3.1.6
V3.1.7
V3.1.8
V3.1.9
V3.1.10
V3.1.11
V4.0
We are on 3.1.11 and currently working on uplifting to 4.0
Read/Write API - Which date are you planning to implement your latest version?
Have you implemented v4.0 information flows, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
We continue to evaluate the non-mandatory changes relating to information flows. Details of any changes made as part of our V4 uplift will be provided via our developer portal once confirmed
Dynamic Client Registration - Which version have you Implemented or planning to implement?
(Lowest version = Current, Highest version = Planned)
None
V3.1
V3.2
V3.3
DCR - Which date are you planning to implement your latest version?
Have you implemented Trusted beneficiaries, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
Have you implemented Reverse Payments, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
Have you implemented ECA Standard?
Already Implemented
Planning to implement
Not planning to implement
ECA Implementation details
Have you implemented Bulk/File Payments?
Already Implemented
Planning to implement
Not planning to implement
Have you implemented VRP – Sweeping, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
Have you implemented VRP non-Sweeping, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
Reviewing potential to offer non-sweeping VRP
Contact: nationwideopenbanking@nationwide.co.uk
PISP - Single Payment Limit
New Payee - £25,000
Existing Payee - £25,000
Established Payee - £100,000
Low Risk - £100,000
High Risk (i.e Crypto) - £5,000
PISP - Daily Payment Limit
New Payee - £25,000
Existing Payee - £100,000
Established Payee - £100,000
Low Risk - £100,000
High Risk (i.e Crypto) - £5,000
There is an aggregate payment limit of £100,000 per day from a single account
How many months of transaction do you provide?
15months at initial authorisation, after that it is 90 days with additional data available via our statements API
CC data is limited to 90 days.
Have you implemented TRIs (Transactional Risk Indicators), if not, date planned to Implement?
We have plans to but no date confirmed just yet
What is your approach to Implementing TRIs?
Accept payload with TRI fields – Process all fields
Accept payload with TRI fields – Ignore all fields
Reject payload with TRI fields – Error back to TPP
Accept payload with TRI fields – Process few fields (Provide list of accepted fields)
Panel
borderStyle
dashed
title
Method of IdentificationSCA-RTS 90-day reauth Implementation
Page Properties
id
ID-Production
Commence support for eIDAS QWAC certificates
Q1 2020
Commence support for eIDAS QSEAL certificates
Q1 2020
Commence support for OBIE QWAC-like certificates
Commence support for OBIE QSEAL-like certificates
Cease support for OBIE non eIDAS-like certificates for transport
Cease support for OBIE non eIDAS-like certificates for signing
Support for MTLS token endpoint authentication
TBC
Support for private_key_jwt token endpoint authentication
TBC
Cease support for client id and client secret token endpoint authentication
panel
SCA-RTS
Which date are you planning on implementing the SCA reauthentication exemption?
20th September 2022
What is your approach to token management to enable application of the reauthentication exemption?(see link to FCA guidance)
AIS consents created after the implementation of the changes will remain valid until the Consent Expiry Date, if set. They will not normally need to be reauthenticated.
Existing AIS consents will require a final reauthentication, at which point they will remain valid until the Consent Expiry Date, if set. No further reauthentication will normally be required.
There are scenarios where a reauthentication may be necessary, including but not limited to:
Suspected fraud or unauthorised access
Where a Nationwide Member has revoked the access via our digital and/or mediated channels
Article 10A - Endpoints exempt of SCA-RTS
Accounts
Transactions (90days)
Balances
Standing orders
Direct debits
Beneficiaries
Products
Offers
Parties
Scheduled Payments
Statements
Article 10A - Endpoints not exempt of SCA-RTS
Transactions (more than 90days)
Standing orders
Direct debits
Beneficiaries
Products
Offers
Parties
Scheduled Payments
Statements
Article 10A - Maximum time period after authentication
Please specify the time period in minutes
SCA-RTS implementation status(updated by OBL PS team only)
Status
colour
Green
title
Implemented
Panel
titleColor
Black
borderStyle
dashed
title
ImplementationSecurity Profile
Page Properties
id
TCID-IMP
Directory?
Open Banking
Location of Well Known Endpoints?
OB Technical Directory
API Standard Implemented?
Open Banking
Name of Account Holder Implementation Date?
14 June 2019 (single account holder)
November 2019 (multiples account holders)
Supported identification method?
Current view is OBWAC/OBSEAL via agency arrangement
Client Secret until Sep 2019, then MTLS as the token auth method
Major Milestones
V3.1 14 June 2019
Offers endpoint target date 14 Sep 2019
(Inc Other Products, API Updates, API Deprecations, etc)
ASPSPs provide a Unique, Immutable TransactionID from their core system
Are you Seeking Fallback Exemption?
Yes
No
Article 10 - Maximum time period after authentication
?
1 Hour
When Strong Customer Authentication (SCA) is completed, you will be able to access all account information the customer has agreed they can access during the initial session (1 hour duration). For subsequent requests we will support requests for accounts, balances and for up to 90 days history of transactions data for 90 days following the authentication (provided the customer has allowed access for this period to the TPP)
Article 10 - Endpoints exempt of SCA
14th September 2019
GET /Accounts
GET /accounts/{AccountId}
GET /accounts/{AccountId}/balances
GET /accounts/{AccountId}/transactions
Access to accounts endpoints allows retrieval of the AccountId to call balance and transaction endpoints
Once initial SCA has been completed you will be able to access the following account information endpoints without SCA (provided the customer has allowed access on an enduring basis to the TPP)
GET /Accounts
GET /accounts/{AccountId}
GET /accounts/{AccountId}/balances
GET /accounts/{AccountId}/transactions
Access to accounts endpoints allows retrieval of the AccountId to call balance and transaction endpoints
Authentication Method - Open Banking Channel (Browser)?
Redirect auth using SCA method that aligns with digital channels.
Authentication Method - Open Banking Channel (APP)?
App to App auth using SCA method that aligns with digital channels.
As they stand today with further auth methods that may be delivered in the future
Authentication Method - Private Channel (APP)?
As they stand today with further auth methods that may be delivered in the future
Authentication Method Implementation Date (Open Banking Channel)?
Methods detailed are currently live in production
Authentication Method Implementation Date (Private Channel)?
Methods detailed are currently live in production
SCA Implementation Date?
TBC (See Notes)
We are planning to implement updated IB authentication screens w/c 9th September. These will provide members the choice to authenticate using SCA access methods (Card Readeror IB Passnumber and OTP) or maintain access (including via screenscrapers) by continuing to use non-SCA methods of authentication (memorable data). The new log-in screens will also now require members to enter their date of birth. In line with the FCA’s six-month adjustment period we intend to gradually remove the ability of our members to utilise non-SCA methods over this time period as TPPs make the transition to open banking APIs. These changes will also be reflected in our OB browser authentication screens.
SCA Scope? (will it inhibit non PSD2 accounts)
SCA will be delivered to cover the requirements of Reg 100 PSRs
