Meeting the March 2019 PSD2 Compliance Deadline with WSO2 Open Banking

We’re reaching the final stretch of the PSD2 timeline. However, before targeting the final deadline, the Regulatory Technical Standards (RTS) also specifies an earlier deadline set on March 14, 2019. This will open doors to open banking by letting interested third parties explore the open banking ecosystem and start developing applications around it. As defined by the RTS, implementers should open up a sandbox environment ready to onboard third parties where testing can be done without exposing any sensitive information — a safe playground to kickstart open banking.

Regulatory Requirements

We’ll explore the essential building blocks that you’ll need to meet the March deadline. With WSO2 Open Banking it’s possible to meet these regulatory requirements out of the box and gain regulatory compliance in just over a month.

Open APIs

The main interface for consuming payment services is through APIs. Third parties bearing the roles of “payment initiation service providers”, “account information service providers” or both, will consume two types of exposed resources — accounts read-only API or payments read-write API.

Apart from exposing Open APIs, WSO2 Open Banking comes with fully-fledged API management capabilities that were positioned as a leader in The Forrester Wave^TM: API Management Solutions, Q4 2018 report. This allows easy lifecycle management with pre-defined templates to support UK, Berlin Group and STET API specifications.

Strong Customer Authentication

The aforementioned APIs are protected with PSD2 Strong Customer Authentication (SCA) which is based on two or more authentication methods categorized under knowledge-based and possession-based factors. A solid SCA implementation will ensure that only authorized parties are consuming the APIs with explicit user consent.WSO2 Open Banking provides an out of the box SCA solution that is aligned with the PSD2 regulatory requirements. Also provided are identity and access management capabilities that allow seamless integration with legacy user stores.

Consent Management

The mediator between the Open APIs and SCA is consent management, which governs the access of user information by third-party providers. Access to this sensitive information is only retrievable with the user's explicit consent. WSO2’s PSD2 compatible consent management module handles the heavy lifting while providing portals for customer care and self-consent revocation, therefore, allowing banks and users to manage their consent.

The task of consent management is to capture a user’s consent with fine grain details of transactions that ensures the user is informed of and has authorized the transactions. Consent can be of different types. For example, consent can either be given per transaction or for a recurring payment (where the consent is long-lived). The implementer’s consent management system should be able to handle a multitude of consent types while giving users and banks the ability to revoke and manage consent.

Transaction Risk Analysis

SCA provides a great layer of trust for open banking but handicaps user experience. This view was shared by many when the first drafts of the RTS were presented. The answer to this was Transaction Risk Analysis (TRA) — a context-aware rule-based system that makes sure SCA is exempted in low-risk scenarios thus increasing customer experience.

The solution ties TRA with a strong analytics and stream processing engine allowing accurate risk analysis and fraud detection. Proper implementation of this component is crucial to be PSD2 compliant and will promote better user experience with SCA.

Third Party Provider Onboarding (TPP)

The prior mentioned components build the fundamental open banking solution, but this won’t be any good if third parties are not able to onboard and consume its functionality. The system needs to be able to onboard third parties manually or through dynamic client registration, where third parties are on-boarded instantly with the backing of a competent authority.

WSO2 Open Banking provides customizable workflows for third-party onboarding and lifecycle management. External trust anchor integration allows dynamic client registration.

Regulatory Reporting

Each competent authority specifies certain statistical information to be reported regularly. WSO2 provides reporting tools to export required regulatory statistics.

Conclusion

By getting all these components together, banks will be prepped and ready for the external testing deadline in March. Additionally, this preparation provides strong guidance for meeting the September deadlines of the RTS. WSO2 Open Banking is equipped to help you meet both these deadlines within reasonable time frames and minimal effort from the bank.

For more information on how we can help you get ready for the March 2019 deadline, drop us a note at [email protected]. You can also download an effort estimate to understand how we can help you meet the deadline in just over a month and check out our webinar for more information.