Nationwide Building Society

OB Standards

Implement Open Data v2.2	Live
Implement Read/Write API Specification v3.1	14 Jun 2019
Implement Customer Experience Guidelines v1.1	Mobile 14 Mar 2019 Browser 14 Jun 2019
Implement App-to-App Redirection	14 Mar 2019
Implement OB Security Profile Implementer's Draft v1.1.2	19 Feb 2019
Implement FAPI Profile Implementers Draft 2
Implement CIBA Profile Implementers Draft 1	N/A
Implement Dynamic Client Registration v1.1	Live
Implement Dynamic Client Registration v3.1	14 Jun 2019	Current known issue with DCR v3.1 where NBS are expecting the aud value to be the registered URI (issuer) in the NBS WKEP. OBIE DCR Specs stats this should be the unique identifier for the ASPSP (Org_ID). We will be correcting this when we uplift to DCR v3.3 in Q1 2021
Decommission Read/Write API Specification v1.x/2.x	AIS v1.1 20th January 2020 AIS v2.0 4th May 2020	Change of date for the AIS v2.0 decommission from 20th April to 4th May due to Covid-19 and re-planning the change schedule
Decommission OB Security Profile Implementer's Draft v1.x	Complete

Method of Identification

Commence support for eIDAS QWAC certificates	Sep 2020
Commence support for eIDAS QSEAL certificates	Sep 2020
Commence support for OBIE QWAC-like certificates	14 Sep 2019
Commence support for OBIE QSEAL-like certificates	14 Sep 2019
Cease support for OBIE non eIDAS-like certificates for transport		We will continue to accept the OB Certificate at the end of the adjustment period in March provided the TPP has identified itself to OBIE using an eIDAS certificate
Cease support for OBIE non eIDAS-like certificates for signing		We will continue to accept the OB Certificate at the end of the adjustment period in March provided the TPP has identified itself to OBIE using an eIDAS certificate
Support for MTLS token endpoint authentication		14 Sep 2019
Support for private_key_jwt token endpoint authentication		14 Sep 2019
Cease support for client id and client secret token endpoint authentication	14 Sep 2019

Post Brexit Certificate Implementation

PRE-BREXIT - Certificates Accepted (until 31st Dec 2020)	eIDAS QWAC eIDAS QSealC OB legacy (obtransport, obsigning) OBWAC OBSeal Other (Please define)
POST-BREXIT TRANSITION - Certificates Accepted (1st Jan 2021 - 30th Jun 2021)	eIDAS QWAC eIDAS QSealC OB legacy (obtransport, obsigning) OBWAC OBSeal Other (Please define)
POST-BREXIT POST TRANSITION - Certificates Accepted (from 1st Jul 2021)	eIDAS QWAC eIDAS QSealC OB legacy (obtransport, obsigning) OBWAC OBSeal Other (Please define)
Planned Implementation Date to Satisfy FCA's Post Transition		This date is still being planned by our programme team and the date will be communicated in the new year giving at least 90 days notice
TPP PSU Migration Outcomes Supported		TPP’s registered with tls_client_auth authentication method to update their subject DN information using DCR PUT method (PUT endpoint will be live post our DCR v3.3 release in March 2021.
POST-BREXIT Certificate Implementation Status (updated by OBIE IES team)	READY

Implementation

Directory?	Open Banking
Location of Well Known Endpoints?	OB Technical Directory
API Standard Implemented?	Open Banking
Name of Account Holder Implementation Date?	14 June 2019 (single account holder) November 2019 (multiples account holders)
Date of Current eIDAS Implementation?	14 Sep 2019
Current Certificates used for Identification?	Nationwide Issued Client Id, SSA and MATLS
Current Certificates used for Transport?	OB Transport / OBWAC
Current Certificates used for Signing?	OB Signing / OBSEAL
Date of Future eIDAS Implementation?	June 2020
Future Certificates used for Identification?	Nationwide Issued Client Id, SSA and MATLS
Future Certificates used for Transport?	OB Transport / OBWAC / QWAC
Future Certificates used for Signing?	OB Signing / OBSEAL / QSEAL
Major Milestones	V3.1 14 June 2019 Offers endpoint 14 Sep 2019	(Inc Other Products, API Updates, API Deprecations, etc)
Brand(s)
Security Profile?
Security Profile Certification?		Security Profile Certificate: Nationwide 2019
CIBA	No
Using Open Banking as your eIDAS Trust Framework?	Yes
Are you caching the Directory?	Yes, 24hrs
Transaction IDs	March 2019 - Option 1 Supported	ASPSPs provide a Unique, Immutable TransactionID from their core system

Customer Journey

Implementing Customer Experience Guidelines?	Yes
Current CEG Version?	v3.1.2
Next CEG Version?	v3.1.3
Next Version Implementation Date	September 2020
Implementing Bespoke User Journeys?	No
Implementing App to App?	Yes
App to App Implementation Date?	End March 2019
Options on 90 day re-authentication?	OBIE Standard until 13 September, then in line with A10 SCA RTS.
Support Embedded Flow?	No

PSD2

Dispute Management System?	Yes
FCA Adjustment Period - Maintaining Screen Scraping?	Yes	Non-SCA methods will be maintained beyond September with non-SCA access gradually withdrawn between November 2019 and March 2020
Seeking Fallback Exemption?	Exemption Granted - 12 Jul 2019
Adjusted or Fallback Interface?	None at present
Adjusted or Fallback URL?
Contact Email or Phone Number?	NationwideOpenBanking@nationwide.co.uk
Dev Portal URL?	www.nationwidedeveloper.co.uk
Test Facility Implementation Date?	13 Mar 2019
Production Interface Implementation Date?	13 Mar 2019
Contingency Measures		N/a as Nationwide has obtained its exemption
Article 10 - Maximum time period after authentication?	1 Hour	When Strong Customer Authentication (SCA) is completed, you will be able to access all account information the customer has agreed they can access during the initial session (1 hour duration). For subsequent requests we will support requests for accounts, balances and for up to 90 days history of transactions data for 90 days following the authentication (provided the customer has allowed access for this period to the TPP)
Article 10 - Endpoints exempt of SCA	14th September 2019 GET /Accounts GET /accounts/{AccountId} GET /accounts/{AccountId}/balances GET /accounts/{AccountId}/transactions Access to accounts endpoints allows retrieval of the AccountId to call balance and transaction endpoints	Once initial SCA has been completed you will be able to access the following account information endpoints without SCA (provided the customer has allowed access on an enduring basis to the TPP) GET /Accounts GET /accounts/{AccountId} GET /accounts/{AccountId}/balances GET /accounts/{AccountId}/transactions Access to accounts endpoints allows retrieval of the AccountId to call balance and transaction endpoints
Authentication Method - Open Banking Channel (Browser)?	Redirect auth using SCA method that aligns with digital channels.
Authentication Method - Open Banking Channel (APP)?	App to App auth using SCA method that aligns with digital channels.
Authentication Method - Private Channel (Browser)?	As they stand today with further auth methods that may be delivered in the future
Authentication Method - Private Channel (APP)?	As they stand today with further auth methods that may be delivered in the future
Authentication Method Implementation Date (Open Banking Channel)?	Methods detailed are currently live in production
Authentication Method Implementation Date (Private Channel)?	Methods detailed are currently live in production
SCA Implementation Date?	14 Sep 2019 (See Notes)	Updated IB authentication screens were implemented on 10^th September. This provides members the choice to authenticate using SCA access methods (Card Reader or IB Passnumber and OTP) or maintain access (including via screenscrapers) by continuing to use non-SCA methods of authentication (memorable data). The new log-in screens also now require members to enter their date of birth. In line with the FCA’s six-month adjustment period we intend to gradually remove the ability of our members to utilise non-SCA methods over this time period as TPPs make the transition to open banking APIs. These changes will also be reflected in our OB browser authentication screens. The process of removing the ability to login using non-SCA access starts in November and is primarily focused on members who have been dormant or habitually use SCA methods to login. This activity will run until early December with the majority of active members who utilise non-SCA methods to login then scheduled to be switched to SCA-only login options throughout January to March 2020
SCA Scope? (will it inhibit non PSD2 accounts)	SCA will be delivered to cover the requirements of Reg 100 PSRs

Key Implementations

High Cost Credit	Nationwide - HCC.xlsx

After Waiver 7 Expiry (16/06/20) option supported: Option 1 - The parameter b64 being set to FALSE OR Option 2 - The b64 claim not being in the header	-	Implemented Monday 3rd August 2020 to enable B64 signature validation aligning with Option 2 - the claim not being in the header.