Norms and Standards

1What is the new PSD2 regulation and what opportunities does it offer?

The Second Payment Services Directive (PSD2) poses a new scenario in the banking and payments sector, as it obliges banks to grant access to their customers’ accounts to Third Party Providers (TPPs). PSD2 opens up enormous opportunities, both for new entities and organizations that want to enter the banking and payment services sector, as well as for the banks themselves. The directive is in keeping with the spirit of open banking and promotes competition. To make this approach possible, the PSD2 Directive imposes very strict security requirements on financial technologies. One of the requirements imposed by the directive itself is the obligation for participating institutions to use qualified certificates of Electronic Seal and Web Authentication, both with PSD2 character.

2What are the requirements for external providers?

To use the bank’s interface, external providers require a license for access rights. This license is issued by the National Competent Authority (NCA). Once granted, the provider requires a web authentication certificate to secure its communication. This allows you to identify yourself to the bank as the holder of an NCA license. The bank may also require the additional use of an electronic seal to ensure the integrity of the signed data.

3What are qualified certificates?

They are certificates that comply with Regulation (EU) No 910/2014 of July 23, 2014, on electronic identification and trust services for electronic transactions in the internal market (eIDAS). They can only be issued by Qualified Trust Service Providers accredited for this service, as is ANF Autoridad de Certificación. ANF AC, as a qualified provider, guarantees that its certificates are qualified and comply with the eIDAS Regulation.

4Why is eIDAS (qualified certificates) relevant for PSD2?

Article 34 of the Regulatory Technical Standards (RTS) for strong customer authentication and secure communications under PSD2 indicates that eIDAS certificates should be used for the identification of Payment Service Providers (PSPs), and refers to two types of existing qualified certificates:

Qualified Certificate of Electronic Seal (QSealC).
Qualified Web Page Authentication Certificate (QWAC).

It also contains the following attributes required by the RTS:

Authorization number of the PSP, issued by the National Competent Authority (NCA).
PSP Role
Name of the National Competent Authority where the PSP is registered.

ANF Autoridad de Certificación’s PSD2 certificates are in full compliance with the RTS and with the Royal Decree-Law 19/2018, of November 23, on payment services and other urgent measures in financial matters, which transposes Directive (EU) 2015/2366 on payment services in the internal market (PSD2).

5When is it appropriate to use each PSD2 certificate?

The RTS allows the use of qualified certificates of Electronic Seal (QSealC) and Web Page Authentication (QWAC) for identification. Each certificate is designed to fulfill a very specific function, in the different security protocols set by the Directive. The use and handling of a QsealC or a QWAC certificate is not an arbitrary choice, but depends on the way the certificates are used in the interface design. A QWAC certificate secures communication between banks and external providers at the data transmission level. It is used by the payment service to authenticate itself as the holder of an NCA registration number at the bank providing the account. The QWAC contains information about the company’s function as well as its registration ID with the Financial Supervisory Authority. In addition, QWACs encrypt all communication between the bank, the payment service provider and the user. QSEALs secure data at the application level. This is especially useful for determining, in case of damage, who has accessed the API. QSEALs makes this process much easier. In principle, a bank can require a third-party provider to use qualified electronic seals. It also documents all requests from the service provider and protects the signed data against modification.

6What is a Registration Number or Identifier?

In all systems identifiers are used to uniquely identify who is who in a system. In the PSD2 framework, Article 34 of the RTS for strong customer authentication and common and secure communications under PSD2, makes it clear that the number issued by the National Competent Authority (in the case of Spain, the Bank of Spain), will be the identifier to be used. When is it appropriate to use each PSD2 certificate?

7What is the Payment Service Provider Role?

There are 4 possible roles to include in the PSD2 certificate:

Account Servicing
Payment Initiation
Account information
Issuing of Card-Based Payment Instruments (Issuing of Card-Based Payment Instruments)

8Is it possible to edit the content of the certificates?

There is no possibility to edit the fields of an existing certificate. If there is a change in the information contained in the certificate, e.g. the name of the PSP, the old certificate must be revoked and a new one issued.

Client Area

Norms and Standards

In order to guarantee the interoperability of our solutions and products, our engineering department follows the international technical reference standards.

PARTNERS

Conviértete en PARTNER