Implement OB Security Profile Implementer's Draft v1.1.2
14 Sept 2019
Implement FAPI Profile Implementers Draft 2
N/A
Implement CIBA Profile Implementers Draft 1
N/A
Implement Dynamic Client Registration v1.1
N/A
Implement Dynamic Client Registration v3.1
14 Sept 2019
Decommission Read/Write API Specification v1.x/2.x
N/A
Decommission OB Security Profile Implementer's Draft v1.x
N/A
Method of Identification
Commence support for eIDAS QWAC certificates
N/A
As per agreement between OBIE and FCA we will allow TPP's to register with OBIE Directory using eIDAS and swap these out for OBIE certs for communications with us. This is referred to as the Open Banking eIDAS Trust Framework.
Commence support for eIDAS QSEAL certificates
N/A
As per agreement between OBIE and FCA we will allow TPP's to register with OBIE Directory using eIDAS and swap these out for OBIE certs for communications with us. This is referred to as the Open Banking eIDAS Trust Framework.
Commence support for OBIE QWAC-like certificates
14 Sept 2019
Commence support for OBIE QSEAL-like certificates
14 Sept 2019
Cease support for OBIE non eIDAS-like certificates for transport
N/A
Will cease support for OBIE non eIDAS-like certificate for transport when OBIE cease support for non eIDAS-like certificate
Cease support for OBIE non eIDAS-like certificates for signing
N/A
Will cease support for OBIE non eIDAS-like certificate for signature when OBIE cease support for non eIDAS-like certificate
Support for MTLS token endpoint authentication
N/A
Support for private_key_jwt token endpoint authentication
14 Sept 2019
Cease support for client id and client secret token endpoint authentication
Not Planned
Implementation
Directory?
Open Banking
Location of Well Known Endpoints?
OB Technical Directory
API Standard Implemented?
Open Banking
Name of Account Holder Implementation Date?
Completed -
Date of Current eIDAS Implementation?
14 Sept 2019
OBWAC/OBSeal, As per agreement between OBIE and FCA we will allow TPP's to register with OBIE Directory using eIDAS and swap these out for OBIE certs for communications with us. This is referred to as the Open Banking eIDAS Trust Framework.
Current Certificates used for Identification?
OBWAC / OB Transport Certificate
Current Certificates used for Transport?
OBWAC / OB Transport Certificate
Current Certificates used for Signing?
OBSeal / OB Signing Certificate
Date of Future eIDAS Implementation?
N/A
Future Certificates used for Identification?
N/A
Future Certificates used for Transport?
N/A
Future Certificates used for Signing?
N/A
Major Milestones
Brand(s)
Security Profile?
Security Profile Certification?
Yes
CIBA
No
Using Open Banking as your eIDAS Trust Framework?
Yes
Are you caching the Directory?
No
Transaction IDs
Option 2
ASPSPs provide a Unique, Immutable TransactionID from their core system
ASPSPs generate a Unique TransactionID from a set of Immutable fields
ASPSPs specify field(s) for TPP to generate a Unique Transaction Identifier
ASPSPs provide neither a TransactionID nor the method by which TPPs can generate one
Customer Journey
Implementing Customer Experience Guidelines?
Yes
Implemented as of 14th of June 2019
Implementing Bespoke User Journeys?
No
Implementing App to App?
Yes
App to App Implementation Date?
30 Nov 2020
Options on 90 day re-authentication?
Yes
Support Embedded Flow?
No
PSD2
Dispute Management System?
Yes
FCA Adjustment Period - Maintaining Screen Scraping?
Please specify the location of the guidance that explains your strategy and plans for when your dedicated interface is unavailable. This should be a URL to your dev portal or artefact that provides TPPs with the information they require
Article 10 - Maximum time period after authentication?
Please specify how long the AISP has from the time when they receive the access token (after PSU authentication). This is the period the AISP must submit their first request before SCA will be re-applied to endpoints NOT exempt of SCA under Article 10. ASPSPs should consider that this timeline is consistent with the time limit applied by the ASPSP in the existing online PSU interface (i.e. before the PSU is logged out)
Article 10 - Endpoints exempt of SCA
Please specify which AIS endpoints will be exempt from SCA under Article 10. (delete as appropriate): Accounts, Balances, Transactions, Beneficiaries, Direct Debits, Standing Orders, Products, Offers, Parties, Scheduled Payments, Statements
Authentication Method - Open Banking Channel (Browser)?