Submitted for certification and awaiting response.
CIBA
No
Using Open Banking as your eIDAS Trust Framework?
Yes
Are you caching the Directory?
No
Transaction IDs
No
No transaction IDs provided in transaction response, consistent with online/mobile channels.
Panel
Page Properties
id
ID-Production
Commence support for eIDAS QWAC certificates
Live
Commence support for eIDAS QSEAL certificates
Live
Commence support for OBIE QWAC-like certificates
Live
Commence support for OBIE QSEAL-like certificates
Live
Cease support for OBIE non eIDAS-like certificates for transport
Not currently planned
Cease support for OBIE non eIDAS-like certificates for signing
Not currently planned
Support for MTLS token endpoint authentication
Live
Support for private_key_jwt token endpoint authentication
n/a
Cease support for client id and client secret token endpoint authentication
n/a
Panel
borderStyle
dashed
title
Implementation
Page Properties
id
TC-IMP
Directory?
Open Banking
Location of Well Known Endpoints?
OB Technical Directory and OB Implementation Guide
API Standard Implemented?
Open Banking
Name of Account Holder Implementation Date?
Completed -
Name of account holder is returned via the party endpoint
Date of Current eIDAS Implementation?
MTLS
Current Certificates used for Identification?
Current Certificates used for Transport?
OB Transport (non-eIDAS-like)
Current Certificates used for Signing?
OB Signing (non-eIDAS-like)
Date of Future eIDAS Implementation?
No future update currently planned.
Future Certificates used for Identification?
No future update currently planned.
Future Certificates used for Transport?
No future update currently planned.
Future Certificates used for Signing?
No future update currently planned.
Major Milestones
SCA is already in place at log in for the existing Online and Mobile channels and was in place pre-PSD2.
Production date for SCA in the Open Banking channel to be provided.
SCA-RTS
Which date are you planning on implementing the SCA reauthentication exemption?
27 September 2022
27 September 2022
What is your approach to token management to enable application of the reauthentication exemption?(see link to FCA guidance)
We will implement the exemption by issuing refresh tokens with no expiry date.
We will implement the exemption by issuing refresh tokens with no expiry date.
Existing consents
The first time that the 90 day refresh token is exchanged for an access token following our change, the new refresh token issued will have an unlimited expiry. Subsequent refresh tokens issued for the consent will continue to have unlimited expiry. The TPP can then go on to access exempt data for the consent on an ongoing basis, subject to consent expiry or revocation.
As long as the ‘old’ refresh token is exchanged before its original 90 day expiry, the customer will not need to re-authenticate with us. If it has been more than 90 days since the customer authenticated for the consent, we will not allow the refresh token to be exchanged for a new non-expiring one.
We will continue to ask for SCA when accessing non-exempt data under the consent, if it has not been done within 5 minutes.
New consents
Consents set up and authorised after our change goes live will use non-expiring refresh tokens for their lifetime. We will still require customers to complete SCA with us at authorisation, but customers will no longer need to come back to us every 90 days to re-authenticate.
We will ask for SCA when accessing non-exempt data under the consent, if it has not been done within 5 minutes.
We will continue to request SCA for non-exempt data requests.
Article 10A - Endpoints exempt of SCA-RTS
Accounts
Transactions (90days)
Balances
Standing orders
Direct debits
Beneficiaries
Products
Offers
Parties
Scheduled Payments
Statements
Article 10A - Endpoints not exempt of SCA-RTS
Transactions (more than 90days)
Standing orders
Direct debits
Beneficiaries
Products
Offers
Parties
Scheduled Payments
Statements
Article 10A - Maximum time period after authentication
Please specify the time period in minutes
SCA-RTS implementation status(updated by OBL PS team only)
Status
colour
Green
title
Implemented
Panel
titleColor
Black
borderStyle
dashed
title
Security Profile
Page Properties
id
ID-Production
-Which Security profile have you Implemented or planning to implement?
(Lowest version = Current, Highest version = Planned)
OB Security Profile (Legacy)
FAPI (ID2)
FAPI 1 Advanced
Other (Please define)
Security Profile - Next Planned Version Implementation Date
CIBA Profile - Implemented or planning to implement
(Lowest version = Current, Highest version = Planned)
None
CIBA
CIBA FAPI Profile
CIBA Profile - Next Planned Version Implementation Date
Security Profile Certification date?
Token Endpoint Authentication Methods Supported
client_secret_post
client_secret_basic
client_secret_jwt
tls_client_auth
Private_key_jwt
Planned date to Cease support for client id and client secret token endpoint authentication
n/a
POST-BREXIT POST TRANSITION - Certificates Accepted (from 1st Jul 2021)
eIDAS QWAC
eIDAS QSealC
OB legacy (obtransport, obsigning)
OBWAC
OBSeal
Other (Please define)
Panel
titleColor
Black
borderStyle
dashed
title
Customer Journey
Page Properties
id
TC-CJ
-What is your approach to Implementing OBL Customer Experience Guidelines
?
Yes
Current CEG Version?
1.2
Next CEG Version?
tbc
Next Version Implementation Date
tbc
Implementing Bespoke User Journeys?
No
Closely aligned to CEG v1.2
Implementing App to App?
Yes
App to App Implementation Date?
tbc
Options on 90 day re-authentication?
Yes
Re authentication will be required after 90 days.
Will also be required in scenarios that imply risk and therefore SCA is deemed appropriate by Tesco Bank.
Support Embedded Flow?
No
(CEG)?
(tick all that apply)
Already Implemented
Planning to implement or upgrade
Not planning to implement CEG
Which version have you implemented or planning to implement?
(Lowest version = Current, Highest version = Planned)
V3.1.2
V3.1.3
V3.1.4
V3.1.5
V3.1.6
V3.1.7
V3.1.8
v3.1.9
v3.1.10
V3.1.11
V4.0
Which date are you planning to implement your latest CEG version?
TBC
Redirection Model
App to App redirection
Decoupled authentication
Embedded Flow
Bespoke User Journeys
Panel
titleColor
Black
borderStyle
dashed
title
PSD2
Page Properties
id
TC-PSD2
Dispute Management System?
Yes
FCA Adjustment Period - Maintaining Screen Scraping?
