This Section applies to ASPSPs that have implemented OB Standards
Page Properties
icon
false
id
TC-OB Standards-Production
Implement Open Data v2.2
September 2019
Implement Read/Write API Specification v3.1
September 2019
Implement Customer Experience Guidelines v1.1
September 2019
Implement App-to-App Redirection
N/A
N/A, as the mobile app is currently not in scope.
Implement OB Security Profile Implementer's Draft v1.1.2
September 2019
Implement FAPI Profile Implementers Draft 2
September 2019
Implement CIBA Profile Implementers Draft 1
N/A
Implement Dynamic Client Registration v1.1
Implement Dynamic Client Registration v3.1
Decommission Read/Write API Specification v1.x/2.x
Decommission OB Security Profile Implementer's Draft v1.x
-Have you Implemented OB Standards?
Yes
No
Open Data - Which version have you Implemented?
None
V2.2
V2.3
V2.4
Read/Write API Specification Implemented or planning to implement
(Lowest version = Current, Highest version = Planned)
V3.0
V3.1
V3.1.1
V3.1.2
V3.1.3
V3.1.4
V3.1.5
V3.1.6
V3.1.7
V3.1.8
V3.1.9
V3.1.10
V3.1.11
V4.0
Implemented version v. 3.1.11.
Planning to implement v. 4 by March 2025
Read/Write API - Which date are you planning to implement your latest version?
Planning to implement v. 4 by March 2025
Have you implemented v4.0 information flows, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
Dynamic Client Registration - Which version have you Implemented or planning to implement?
(Lowest version = Current, Highest version = Planned)
None
V3.1
V3.2
V3.3
DCR - Which date are you planning to implement your latest version?
Have you implemented Trusted beneficiaries, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
Delivery date TBD
Have you implemented Reverse Payments, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
Have you implemented ECA Standard?
Already Implemented
Planning to implement
Not planning to implement
ECA Implementation details
N/A
Contact: [enter contact details for the relevant person(s) at your organisation]
[You can use this space to provide your status with respect to the Standard]
Have you implemented Bulk/File Payments?
Already Implemented
Planning to implement
Not planning to implement
Have you implemented VRP – Sweeping, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
Have you implemented VRP non-Sweeping, if not date planned to Implement?
Already Implemented
Planning to implement
Not planning to implement
Contact: [enter contact details for the relevant person(s) at your organisation]
[You can use this space to provide implementation details relevant to VRP]
PISP - Single Payment Limit
£25,000.00
Per transaction and account
PISP - Daily Payment Limit
£100,000.00
How many months of transaction do you provide?
>5 years
Have you implemented TRIs (Transactional Risk Indicators), if not, date planned to Implement?
Yes
Delivered to PROD
What is your approach to Implementing TRIs?
Accept payload with TRI fields – Process all fields
Accept payload with TRI fields – Ignore all fields
Reject payload with TRI fields – Error back to TPP
Accept payload with TRI fields – Process few fields (Provide list of accepted fields)
Panel
borderStyle
dashed
title
Method of IdentificationSCA-RTS 90-day reauth Implementation
Page Properties
id
ID-Production
Will be implemented in line with PSD2 deadline.
Commence support for eIDAS QWAC certificates
14 Sept 2019
Commence support for eIDAS QSEAL certificates
N/A
Commence support for OBIE QWAC-like certificates
14 Sept 2019
Commence support for OBIE QSEAL-like certificates
14 Sept 2019
Cease support for OBIE non eIDAS-like certificates for transport
N/A
Presently supported. Pending stabilisation of eIDAS and confirmation with TPPs in order to plan ceasing the support
Cease support for OBIE non eIDAS-like certificates for signing
N/A
Presently supported. Pending stabilisation of eIDAS and confirmation with TPPs in order to plan ceasing the support
Support for MTLS token endpoint authentication
Support for private_key_jwt token endpoint authentication
Cease support for client id and client secret token endpoint authentication
Panel
titleColor
White
titleBGColor
#6180c3
borderStyle
dashed
title
Post Brexit Certificate Implementation
Page Properties
id
Standards-Production
PRE-BREXIT - Certificates Accepted (until 31st Dec 2020)
eIDAS QWAC
eIDAS QSealC
OB legacy (obtransport, obsigning)
OBWAC
OBSeal
Other (Please define)
EIDAS certificates will be validated using the OBIE directory.
POST-BREXIT TRANSITION - Certificates Accepted (1st Jan 2021 - 30th Jun 2021)
eIDAS QWAC
eIDAS QSealC
OB legacy (obtransport, obsigning)
OBWAC
OBSeal
Other (Please define)
SCA-RTS
Which date are you planning on implementing the SCA reauthentication exemption?
27/09/2022 (delivered to PROD)
What is your approach to token management to enable application of the reauthentication exemption?(see link to FCA guidance)
Issue a long-lived refresh token during one final SCA, with refresh token rotation implemented.
As part of our transitions for the 90 Day Re-auth Article 10 Changes, Cater Allen is planning to extend the refresh tokens for all TPPs with new long lived unlimited tokens. Date TBC
Article 10A - Endpoints exempt of SCA-RTS
Accounts
Transactions (90days)
Balances
Standing orders
Direct debits
Beneficiaries
Products
Offers
Parties
Scheduled Payments
Statements
Article 10A - Endpoints not exempt of SCA-RTS
Transactions (more than 90days)
Standing orders
Direct debits
Beneficiaries
Products
Offers
Parties
Scheduled Payments
Statements
Article 10A - Maximum time period after authentication
200 Years =105,120,000 Minutes
SCA-RTS implementation status(updated by OBL PS team only)
Status
colour
Green
title
Implemented
In-progress
Panel
titleColor
Black
borderStyle
dashed
title
Security Profile
borderStyle
dashed
title
Implementation
Page Properties
id
ID-Production
-Which Security profile have you Implemented or planning to implement?
(Lowest version = Current, Highest version = Planned)
OB Security Profile (Legacy)
FAPI (ID2)
FAPI 1 Advanced
Other (Please define)
Security Profile - Next Planned Version Implementation Date
N/A
CIBA Profile - Implemented or planning to implement
(Lowest version = Current, Highest version = Planned)
None
CIBA
CIBA FAPI Profile
CIBA Profile - Next Planned Version Implementation Date
N/A
Security Profile Certification date?
July 2021
Token Endpoint Authentication Methods Supported
client_secret_post
client_secret_basic
client_secret_jwt
tls_client_auth
Private_key_jwt
Planned date to Cease support for client id and client secret token endpoint authentication
POST-BREXIT POST TRANSITION - Certificates Accepted (from 1st Jul 2021)
eIDAS QWAC
eIDAS QSealC
OB legacy (obtransport, obsigning)
OBWAC
OBSeal
Other (Please define)
Planned Implementation Date to Satisfy FCA's Post Transition
Outcome 4: You can continue to use your OBseal for client authentication
Outcome 5: Continue using the key pair for client authentication
POST-BREXIT Certificate Implementation Status (updated by OBIE IES team)
Status
colour
Green
title
READY
Ready – ASPSP accept eIDAS certs and OB Certs(OBWAC/OBSeal)
Panel
Panel
titleColor
Black
borderStyle
dashed
title
Customer Journey
Page Properties
id
TC-CJ
-What is your approach to Implementing OBL Customer Experience Guidelines (CEG)?
(tick all that apply)
Already Implemented
Planning to implement or upgrade
Not planning to implement CEG
Which version have you implemented or planning to implement?
(Lowest version = Current, Highest version = Planned)
V3.1.2
V3.1.3
V3.1.4
V3.1.5
V3.1.6
V3.1.7
V3.1.8
V3.1.9
V3.1.10
V3.1.11
V4.0
Implemented version v. 3.1.11.
Planning to implement v. 4 by March 2025
Which date are you planning to implement your latest CEG version?
March 2025
Redirection Model
App to App redirection
Decoupled authentication
Embedded Flow
Bespoke User Journeys
Panel
titleColor
Black
borderStyle
dashed
title
PSD2
Page Properties
id
TC-PSD2
-Which Directory are you using as your Trust Framework?
Open Banking
Are you caching the Directory?
No
Transaction IDs Supported
No
Are you Seeking Fallback Exemption?
Yes
No
Article 10 - Maximum time period after authentication
N/A
It's immediate.
Article 10 - Endpoints exempt of SCA
N/A
For article 10 we are only going with the 90 days re-authentication but not restrictions on payment types (DDs, SOs) or data for more than 90 days away.
Please note: We do not display statements
Major Milestones
Version 3.1.10 was implemented in January 2023 and Security Conformance SUITE re-certification in progress.
This optional field has not been implemented yet but is planned for some time in the future.
Date of Current eIDAS Implementation?
14/09/19
Current Certificates used for Identification?
MTLS available. eIDAS QWAC/QSEAL.
EIDAS certificates will be validated using the OBIE directory
Current Certificates used for Transport?
OB Transport
OBWAC
QWAC
EIDAS certificates will be validated using the OBIE directory
Current Certificates used for Signing?
OB Signing
OBSEAL
EIDAS certificates will be validated using the OBIE directory
Date of Future eIDAS Implementation?
No future update currently planned.
Future Certificates used for Identification?
Future Certificates used for Transport?
Future Certificates used for Signing?
Major Milestones
Version 3.1 was implemented in June 2019 and Security Conformance SUITE certification was achieved on August 2019
(Inc Other Products, API Updates, API Deprecations, etc)
Brand(s)
Security Profile?
FAPI Open ID
Security Profile Certification?
Yes
CIBA
No
Using Open Banking as your eIDAS Trust Framework?
Yes
Are you caching the Directory?
No
Transaction IDs
Yes
The TransactionID is retrieved from our core system
Panel
borderStyle
dashed
title
Customer Journey
Page Properties
id
TC-CJ
Implementing Customer Experience Guidelines?
Yes
Current CEG Version?
v. 3.1.3
Next CEG Version?
v 3.1.6
Next Version Implementation Date
TBC
Implementing Bespoke User Journeys?
Yes (see notes)
Our payment journeys currently follow the exact journey as customer would get in their online banking. The Customer Experience Guidelines says they payment journeys should be 2 step. We will not be introducing the 2 step journeys until October 2019.
Implementing App to App?
N/A
App to App Implementation Date?
N/A
Options on 90 day re-authentication?
90 Days
A TPP can re-authentication any time up until the expiry date. The customer will be made to re-authenticate every 90 days otherwise access to the data will be removed.
Support Embedded Flow?
No
Panel
titleColor
Black
borderStyle
dashed
title
PSD2
Page Properties
id
TC-PSD2
Dispute Management System?
Yes
System implementation in line with OBIE implementation dates.
FCA Adjustment Period - Maintaining Screen Scraping?
For Production URL we are live with AIS, PIS and CBPII.
Full live proving has been provided for AIS and PIS. For CBPII endpoints we are in Managed Rollout phase testing. Please contact us for further information.
Test Facility
Implementation Date?
Production Interface Implementation Date?
- Currently Live AIS, PIS and CBPII
AIS: our APIs are live.
PIS: APIs are live and presently in Managed Roll-out phase.
CBPII: APIs are live and presently in Managed Roll-out phase.
NOTE:
“Cater Allen is pleased to inform that the final migration of customers to the new banking platform planned for this weekend has successfully completed.
As a consequence all customers will be able to use the OB services. Please contact us on caterallenopenbanking@santander.co.uk for further information”.
Contingency Measures
Subject to FCA exemption decision
Article 10 - Maximum time period after authentication?
N/A
No SCA applied on AISP
Article 10 - Endpoints exempt of SCA
N/A
For article 10 we are only going with the 90 days re-authentication but not restrictions on payment types (DDs, SOs) or data for more than 90 days away.
Please note: We do not display statements
Authentication Method - Open Banking Channel (Browser)?
Username, password and PAC (PAC is PIN code). The customer also has to do another factor using either a card & reader or a push notification to their mobile.
Authentication Method - Open Banking Channel (APP)?
Username, password and PAC (PAC is a PIN code). The customer also has to do another factor using either a card & reader or a push notification to their mobile.
Authentication Method - Private Channel (APP)?
N/A
N/A, as the mobile app is currently not in scope.
Authentication Method Implementation Date (Open Banking Channel)?
14 Sept 2019
Authentication Method Implementation Date (Private Channel)?
14 Sept 2019
SCA Implementation Date?
SCA Scope? (will it inhibit non PSD2 accounts)
No (see notes)
No. All Open Banking relevant accounts, e.g. private current accounts, commercial current accounts, debit and credit card accounts and currency accounts. Non PSD2 accounts are not exposed.
