{"id":29804,"date":"2021-11-18T13:29:38","date_gmt":"2021-11-18T12:29:38","guid":{"rendered":"https:\/\/stage.dataductus.com\/helping-banks-meet-psd2-and-the-continued-implementation-of-open-banking-regulations\/"},"modified":"2024-09-26T10:12:42","modified_gmt":"2024-09-26T09:12:42","slug":"helping-banks-meet-psd2-and-the-continued-implementation-of-open-banking-regulations","status":"publish","type":"post","link":"https:\/\/ductus.global\/sv\/helping-banks-meet-psd2-and-the-continued-implementation-of-open-banking-regulations\/","title":{"rendered":"Helping banks meet PSD2 and the continued implementation of open banking regulations"},"content":{"rendered":"\n
<\/span>\"\"
\n

INSIGHT<\/p>\n\n\n\n

Helping banks meet PSD2 and the continued implementation of open banking regulations<\/h1>\n<\/div><\/div>\n\n\n\n
<\/div>\n\n\n\n

With the introduction of Payment Services Directive Two (PSD2) regulations, banks were forced to reassess their architectures and develop new processes and systems to support open banking for secure third-party payments and improve data transparency for users. We speak to Senior IT Security Consultant Per-Gustaf Stenberg <\/strong>about his experiences from developing PSD2 solutions for Scandinavian banks.<\/p>\n\n\n\n

<\/p>\n\n\n\n

What is PSD2?<\/strong>
In a nutshell, it\u2019s an EU regulation for digital payment services that was proposed in 2013, was passed by all member states in 2018 and went live at the end of 2020 \u2013 giving banks the opportunity to roll out solutions. It was developed to promote security and improve data transparency for consumers \u2013 and specifically who can access their data \u2013 while supporting the increased use of APIs from third-party providers. It was also designed to boost innovation in the financial sector. Secure authorization and authentication are a central part of it.<\/p>\n\n\n\n

How did the banks react to the planned implementation of PSD2 regulations?<\/strong>
It depends on a bank\u2019s size, really. Most of the bigger banks put together large-scale, highly-qualified teams to implement the necessary changes. However, many of the small to medium sized banks didn’t have the inhouse expertise to do this, which is where we could support them \u2013 our first PSD2 started back in 2019. Interestingly, in conjunction with this, a lot of banks took the opportunity to analyze their architectures and see how they could re-invent them and develop new products as part of open banking. After all, it\u2019s no secret that too much reliance on legacy systems is a security concern, especially for older banks and those that have grown through acquisition and as a result have multiple systems to manage.<\/p>\n\n\n\n

How have Ductus been helping banks with PSD2?<\/strong>
At Ductus we have a number of consultants who are experts in exposing APIs and digital services securely online, and having a good understanding of how to implement the PSD2 regulation is essential to this. This is just one part of our larger Secure Your Digital Services solution offering<\/a>, that we offer across all industries. When it comes to PSD2, we\u2019ve been focusing on authorization and authentication for open banking, and in particular, the technology and processes that revolve around data owners giving consent to third-party providers. Typically, this has meant deploying the OAuth2 RFC standard and specification with an existing identity solution from our partner Curity<\/a>, which involves integrations with API management and API portals.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\n

”At Ductus we have a number of consultants who are experts in exposing APIs and digital services securely online, and a good understanding of how to implement the PSD2 regulation is essential to this.”<\/em><\/p>\n<\/blockquote>\n\n\n\n

How close is the collaboration with banks?<\/strong>
We work closely together, often as part of a bigger PSD2 project involving teams of integrators, API developers, and mainframe support, along with legal experts who have been interpreting the new regulation. In our role, we often bridge the gap between legal\u2019s interpretation of the regulation and the needs of those wanting to onboard new third party payment providers and expose the APIs to the public. This is a complex technical process consisting of multiple components including TLS handshakes, tokenization and certificate verifications \u2013 that must run smoothly. This is further complicated by the fact that it involves the banks, third-party providers, and users who must give their approval for account access to take place, every 90 days.<\/p>\n\n\n\n

Has the process been standardized?<\/strong>
Since it\u2019s a relatively new regulation, the processes are still being refined. The Berlin Group \u2013 A European Standards Initiative \u2013 is developing a PSD2 framework but this is a work in process. What they have published is helpful and it\u2019s regularly updated but it doesn\u2019t answer all the questions. This is something that we are doing while developing and maintaining solutions for our bank customers.<\/p>\n\n\n\n

How do Ductus services support the PSD2 and open banking process?
<\/strong>Essentially, we help ensure that tokens within a bank\u2019s system are issued correctly based on the third-party provider in question. They extract information in certificates including finance institution IDs and roles, as well as TLS fingerprints and compare them with the information in tokens before granting or denying authorization. Much of the work involves tailoring this to fit the specific architecture of a bank.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n
\n
\n
\"\"<\/figure>\n<\/div>\n\n\n\n
\n

Ductus is typically involved in supporting banks with steps 3 to 5.

Step 3 re-directs the PSU (end-user) through a standard oauth2 flow to issue a consent for a given action to be used by the third party provider, such as perform payment-transaction or fetch account information.<\/p>\n\n\n\n

In step 4, a third party provider provides a valid certificate (mutual TLS) issued with certain roles AISP\/PISP for a token to be issued with the correct permissions.<\/p>\n\n\n\n

The certificate is presented again in step 5. when the third party provider requests the data (open banking) and matches it with the previously issued token.<\/p>\n<\/div>\n<\/div>\n<\/div><\/div>\n\n\n\n

<\/div>\n\n\n\n

How many banks have you supported with PSD2?<\/strong>
We\u2019ve worked with quite a number of banks throughout Scandinavia, for example Collector Bank. For some, it was a question of helping meet compliance, while for others it\u2019s been helping them to use PSD2 as a gamechanger for the types of services they offer customers. This usually comes down to the size of the bank and what their customers require of them. But regardless of their plans, as soon as a bank customer requests a third-party service, the bank is obliged to provide it, which means they most probably require a PSD2 solution.<\/p>\n\n\n\n

What can we expect to see in the future?<\/strong>
Like many regulations, the launch of PSD2 is just the beginning. New financial OAuth2 and Open ID standards are being developed continuously by the community to improve the open banking experience. These standards will need to be implemented in existing PSD2 solutions to ensure compliance. Our long running relationships with our banking customers means we will be ready to help them as and when they need it.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n\n\n\n
\n
\"\"<\/figure>
\n

About Per-Gustaf Stenberg, Senior IT Security Consultant at Data Ductus<\/strong><\/h4>\n\n\n\n

Per-Gustaf has been working at Ductus for six years. Originally working with \u2018classic\u00b4 development, over time he has moved into automating operations with a strong focus on security. He has helped multiple banks implement a successful PSD2 solution.<\/p>\n<\/div><\/div>\n\n\n\n

<\/div>\n<\/div><\/div>\n\n\n
\n\t
Contact Us<\/a><\/div><\/div>\n\n\n\n
<\/div>\n\n\n\n
\n
<\/div>\n\n\n\n
\n\t
\n\t\t\n\t\t\t\t\n\n
\n\t\n \t\t\n \"Managing\n <\/figura>\n Webinar <\/span><\/span>\n \t\t
\n\t\t\tManaging Identities and App Security Consistently in a Complex IT Environment<\/span>\n\t\t\t

Many large organizations face a major security challenge due to the many and varied authentication and authorization solutions deployed across their IT environments. The mix of tools, services and applications, in the cloud and on-premise…<\/p>\n\t\t<\/div>\n\t<\/a>\n<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t<\/section>\n\n\n\n

<\/p>\n\n\n\t\t

\n\t\t\t
\n\t\t\t\t