POST-BREXIT Certificate Implementation Status (updated by OBIE IES team)
Implementation
Directory?
Preta
Preta connection exists but currently the services are not activated.
Location of Well Known Endpoints?
Dev Portal
API Standard Implemented?
Berlin Group Standards XS2A 1.3
Name of Account Holder Implementation Date?
Completed -
Date of Current eIDAS Implementation?
The dedicated interface has been designed for TPPs to connect where they have obtained a QWAC from QTSP
Current Certificates used for Identification?
QWAC
QWAC
Current Certificates used for Transport?
QWAC
Current Certificates used for Signing?
Date of Future eIDAS Implementation?
No future update currently planned.
Future Certificates used for Identification?
Future Certificates used for Transport?
Future Certificates used for Signing?
Major Milestones
API Live for wide usage
Brand(s)
Security Profile?
Security Profile Certification?
No
CIBA
No
Using Open Banking as your eIDAS Trust Framework?
No
Are you caching the Directory?
No
Transaction IDs
AISP - Option 4
PISP - Option 1
For AISP, no transaction ID available to TPP. For PISP, a unique transaction ID is generated by the bank.
ASPSPs provide a Unique, Immutable TransactionID from their core system
ASPSPs generate a Unique TransactionID from a set of Immutable fields
ASPSPs specify field(s) for TPP to generate a Unique Transaction Identifier
ASPSPs provide neither a TransactionID nor the method by which TPPs can generate one
Customer Journey
Implementing Customer Experience Guidelines?
No
Based on Berlin Group Standards
Current CEG Version?
Next CEG Version?
Next Version Implementation Date
Implementing Bespoke User Journeys?
No
Implementing App to App?
No (See Note)
No. However, the National Bank of Belgium has requested this feature for Puilaetco Belgium, another affiliate of KBL group. Therefore, the functionality will be implemented for all group affiliates once further guidance from NBB will be provided.
App to App Implementation Date?
N/A
Options on 90 day re-authentication?
90 Day Re-authentication
Yes - Consent has a validity date which is maximum 90 days. Once it has been validated via the redirection mechanism, the AISP can use it until it expires for accessing the account data without having to initiate a SCA from the client.
Support Embedded Flow?
No
PSD2
Dispute Management System?
No
FCA Adjustment Period - Maintaining Screen Scraping?
Yes
Seeking Fallback Exemption?
Yes
Adjusted or Fallback Interface?
No
A fallback interface plan is currently under investigation, should the exemption be rejected. Fallback interface would be the PSU interface
Please specify the location of the guidance that explains your strategy and plans for when your dedicated interface is unavailable. This should be a URL to your dev portal or artefact that provides TPPs with the information they require
Article 10 - Maximum time period after authentication?
Please specify how long the AISP has from the time when they receive the access token (after PSU authentication). This is the period the AISP must submit their first request before SCA will be re-applied to endpoints NOT exempt of SCA under Article 10. ASPSPs should consider that this timeline is consistent with the time limit applied by the ASPSP in the existing online PSU interface (i.e. before the PSU is logged out)
Article 10 - Endpoints exempt of SCA
Please specify which AIS endpoints will be exempt from SCA under Article 10. (delete as appropriate): Accounts, Balances, Transactions, Beneficiaries, Direct Debits, Standing Orders, Products, Offers, Parties, Scheduled Payments, Statements
Authentication Method - Open Banking Channel (Browser)?
Username, Pin code and OTP (generated from smartcard)
Authentication Method - Open Banking Channel (APP)?