Introduction to OBIE Payment Initiation Service (PIS) and Confirmation of Funds (CoF) APIs
This module covers the APIs for the Payment Initiation Service (PIS) and the CBPII Confirmation of Funds (CoF). It includes the requests for domestic, international, recurring and scheduled payments. Some OBIE conditional/optional APIs may not be included.
Click here to understand the terms and abbreviations used in this module.
This module covers the following interface or regulation version:
- OBIE v3.1.
- UK Open Banking Specification 3.1.
The module interfaces with Temenos Infinity/Spotlight for user management.
Open Banking is the adoption of common standards for collaboration between banks and other players within the banking eco-system of third parties such as developers, customers, and partners like fintech, telecoms, retailers, or other banks.
The Open Banking standard supports the international payments, international scheduled payments and international standing order. Open Banking standard had provided API's which will enable PSU's to place the international payments from a PISP. This module provides the solution through which international payment, international scheduled payment and international standing order can be placed through the Open Banking standard API's.
When an international payment is initiated by PSU, the TPP will send an instruction to create the consent for an international payment with Salt Edge. Salt Edge creates the consent resource and provides the consent Id to TPP. Then, Salt Edge initiates the redirect to authorise URL which will trigger the Temenos Transact user agent to retrieve the consent and payment details from Salt Edge.
For the Customer Data Protection (CDP) please refer to core User Guides.
Payment Initiation Service (PIS)
Temenos Transact Payment Initiation Services APIs help customers to initiate payments through authorised Third Party Providers (TPPs) that are connected to the bank. TPPs can access the service through APIs based on the UK OBIE (Open Banking Implementation Entity) standards as defined as part of the PSD2 (Revised Payment Service Directive).
A TPP that allows Payment Service Users (PSUs) initiating payments is denoted as PISP (Payment Initiation Service Provider). The bank that owns the debit account and executes the payment is denoted as ASPSP (Account Servicing Payment Service Provider).
The Payment Service User has to provide consent as the account holding ASPSP in order initiate as payment through a TPP.
When a Payment Service User (PSU) requests the Payment Initiation Service Provider (PISP) to initiate a payment, the PISP request consent from the ASPSP, that is the Temenos client, before the payment will be placed. For this purpose, the PISP issues a payment-consent request via an API to the Temenos client which already contains the payment details. This API request has to be handled by a 3rd party API Gateway in the first stage, that will return a redirection URL for leading the PSU to an User Agent for confirming the payment. Only after the PSU has reviewed the payment details, selected a debit account and authorised the consent request the PISP will place the payment in Temenos Transact.
After Temenos Transact has accepted the payment initiation it checks the permissions, limits, available funds and if further authorisations are required. Only if all checks have been successfully accomplished and all approval have been obtained the payment will be handed over to the Temenos payment system for execution.
The module provides a set of APIs to support the Temenos client offering payment initiation services for TPPs according to the UK standards. The APIs allows a TPP to create consent resource and payment resources and request the status of both. The initiation of the following payment types is supported:
- Domestic Payments.
- Domestic Scheduled Payments.
- International Payments.
- International Scheduled Payments.
- Domestic Standing Orders.
- International Standing Orders.
Single domestic payments (immediate and scheduled) can be initiated through BACS, FPS and CHAPS clearing. SWIFT and SEPA are supported for single international payments (immediate and scheduled).
Please note that only the APIs listed in the APIs section are currently supported. The module interfaces with Temenos Infinity or Spotlight for PSU management and payment authorisation. The following components and third party software are required in addition to this module for the implementation of an end-to-end infrastructure:
- UK OBIE Payment Initiation API Gateway (e.g. SaltEdge Gateway). Application that interface the APIs to the internet. It covers the TPP registration, fraud detection and security. Identity provider such as HID Global: Performs Strong Customer Authentication (SCA) to identify a PSU at the Account Servicing Payment Service Provider (ASPSP).
- User Agent: Online screens that allows account selection and leads the PSU through the process of payment consent authorisation.
CBPII Confirmation of Funds (CoF)
The Confirmation of Funds service allows Card Based Payment Instrument Issuers (CBPIIs) to check the availability of sufficient funds for a card payment on the card settlement account hold at the Temenos Client in the role of an ASPSP.
When a PSU performs a card payment this payment must be authorised by the card provider first. The CoF service enables card providers to check available funds at the time the PSU want to make the payment to decide if the authorisation is granted or not. For this purpose, CBPII invokes an API at the holding institution of the card settlement account to enquire if the account has still sufficient balance to perform the payment. The API returns either a “Yes” or “No” as an answer.
There are some preconditions for processing such an enquiry:
- Temenos Client must be an Open Banking participant and registered as an ASPSP.
- CBPII must be registered as a TPP at the Temenos client.
- PSU must have provided consent for CoF requests at the Temenos client.
The Temenos UKOBPX module provides a set of APIs to support the Temenos client offering CoF services for CBPIIs according to the UK Open Banking standards. The APIs allows a CBPII to create consent resource and enquire the availability of funds.
The APIs implementation follow version v3.1 of the OBIE standard.
Only the APIs listed in the APIs section are currently supported.
Integration with Infinity
Temenos Transact Online Banking modules help customers to accomplish their role as an Account Servicing Payment Service Provider (ASPSP) to comply with the PDS2 (Revised Payment Service Directive) regulation.
The scope of this module, depends on the online banking features, offered by the respective financial institution. As a common rule, all the services offered for payment accounts to customers have to be available through APIs to Third Party Providers. Payments accounts are basically DDA accounts hence savings and loan accounts are excluded as well as wealth management products.
Third Party Providers (TPPs) can access the service through APIs based on the UK Open Banking Implementation Entity (OBIE ) standards as defined as part of the PSD2.
These modules do not provide an end-to-end solution and additional components are required for the implementation.
The OBIE Payment Initiation APIs (PISP) module provides a set of APIs to support the Temenos client offering Payment Initiation and Confirmation of Funds Services (PIS and CoF) according to the UK standards. This module interfaces with Temenos Infinity or Spotlight for user management and payment authorisation. Additional customisation is required for an integration with other Online Banking systems. Furthermore, the other Online Banking systems must provide screens for the consent management. The Temenos modules enable AISP and CoF consent management by appropriate consent enquiry and deletion APIs.
Please note that the UKOBPX module does not support variable recurring payments (VRP payments) and no consent management APIs are available for this.
The figure below is a high-level functional overview of the Temenos scope and the additional components that are required. The Restful APIs are used for interfacing between those components.
While the boxes and arrows in blue show the functionalities and interfaces in scope of the OBIE Account Information APIs (AISP) and OBIE Payment Initiation APIs (PISP) modules, boxes and arrows in yellow are the additional components and interfaces.
Components
The components below are required for the OBIE Account Information APIs (AISP) module:
Core Banking System -Temenos Transact /IRIS Integration Framework
The Core Banking system stores the static and transactional data. The data is published by restful APIs through the IRIS Interaction Framework. The OBIE Account Information APIs (AISP) provide the interface functionality for the consent creation, accessing data and payment initiation.
Online Banking System -Temenos Infinity /Fabric Framework
The OBIE Account Information APIs (AISP )module interface the with Temenos Infinity for the user permission check and payment initiation. The integration of different Online Banking Systems requires a customisation.
The Consent Access Dashboards (AIS and CoF) and payment initiation APIs are not available as Infinity Core developments. Those have to be implemented as client specific enhancement during the implementation.
API Gateway
Before TPPs are eligible to invoke the APIs request, they have to be certified and onboarded as per requested services and APIs by the ASPSP. The ASPSP will ensure that only the APIs requests of the registered TPPs are accepted and processed. The payload of the APIs have to match with the respective OBIE specification.
As Temenos does not provide this functionality hence the implementation of an API Gateway is required. The API Gateway acts like a proxy and will be the technical point of contact for the TPP. It must only forward well-formed requests to Temenos that come from registered TPP and active TPPs.
User Agent
The User Agent provides the workflow and screens for the consent creation. TPPs will redirect the user to the User Agent for authentication by the ASPSP and providing consent to the requested operation (i.e. account and transactions enquiry, payment initiation or funds confirmation).
Identity Provider- HID
An Identity Provider (IDP) is a software component, that ensures that the user is the person he or she claims to be. PSD2 rules and the UK Open Banking require a Strong Customer Authentication (SCA) to ensure the confidentiality and integrity of the security personalised credentials of the Payment Service User.
Interfaces
The interfaces details are provided below:
- Interface between Online Banking and Core Banking system: There is already an existing interface between the OBS and Temenos Transact. The interface has to cover at least the following functionalities:
- Linking Temenos Transact customers and accounts to OLB users.
- Handover the account details, balances and transactions for online enquiry by the user.
- Creation of payment orders in the Temenos Payment Order (PO) module based on online payment initiations.
Optionally the interface can also enable the OBL to enquire or manage the beneficiaries, standing orders, direct debits or future payments.
- Permission Check and Payment Interface: This modules offer APIs for the user permission check, consent management and payment initiation by Interaction Framework (IRIS) orchestration. The API based payments are routed to the OLB for further validation (e.g. online payment limits) and multi-authorisation.
The OLB will “place” any authorised API initiated payment as a payment order through interface (1) after the full validation and authorisation.
- User Agent Interface to API Gateway: Ths client has to implement an interface between the User Agent and the API Gateway to retrieve the details of the AIS/PIS/CoF consent creation requests, once the TPP has redirected the user to the User Agent. After the user has provided or denied consent, the User Agent must update the API Gateway about the success or failure of the Consent Resources creation.
- Consent and Payment Resources Creation Interface: This module provides various APIs that allows the User Agent to create the consent and payment resources in Temenos Transact. A payment resource is used to store the payment details that comes with the payment consent creation request after user has made a payment at the TPP.
- User Authentication Interface: The user has to be authenticated by SCA before approving the creation of a Consent Resource.
The IDP solution is already in place which protects and secures the online banking access.
- User and Account Details Interface: Once the user has been authenticated, the User Agent must retrieve the additional information from the OLB like the username and eligible (according to the respective service) accounts. Temenos Infinity provides the respective Fabric APIs that can be used by the User Agent for this purpose.
- OBIE Account Information APIs Request Interface: Published Temenos IRIS APIs according to the OBIE API specification. These APIs come with this module. The API Gateway will forward the TPP request according to the supported OBIE API version. If the API Gateway manages and publishes its own ConsentId, the ConsentId must be translated into the Temenos ConsentId. The Temenos APIs expects an authorisation token in the request header that has been issued to the API Gateway during consent creation.
Capture the External Consent ID and Consent Deletion API
Once the PSU provides the consent, the Account Information Service Provider (AISP) can request the account information from the Account Servicing Payment Service Provider (ASPSP). The validity of the consent can has-the current or an expiry date. If the consent expired the AISP will no longer have access to it.
If the PSU decides to revoke the consent before it expires, then the consent will be marked as a consent deletion. However, the consent resources held by the ASPSP are never physically deleted, their status will be changed to Revoked instead to allow enquiry of historic data.
User Agent provides the Salt Edge ConsentId to Temenos during the creation of the Temenos Consent Resource. The Salt Edge ConsentId is stored in the AA consent arrangement for the purpose of the consent deletion at the Online Banking Access Dashboard. Temenos returns the Temenos ConsentId to Salt Edge after is created in Temenos Transact.
Whenever a PSU deletes the consent at the AISP, the AISP must send an OBIE consent request deletion to the ASPSP. The ConsentId received by the AISP from the ASPSP during the consent creation is used for the identification as a path parameter.
Temenos clients acting as an ASPSP using the Salt Edge as an API Gateway will allow the AISP Open Banking access. The API Gateway is liable for the TPP onboarding and validation of the TPP requests.
Both systems, the Salt Edge and Temenos, maintain their own consent resources hence uses different ConsentIds for the same connection. The TPP, in this case AISP, will only use the Salt Edge ConsentId for communication. For forwarding requests to Temenos, Salt Edge needs to translate the Salt Edge ConsentId into the Temenos ConsentId.
Whenever the AISP invokes a deletion of a consent request at Salt Edge, Salt Edge will forward the request by translating the Salt Edge ConsentId into the Temenos ConsentId and invoking the appropriate OBIE API at Temenos IRIS.
This functionality allows the Payment Service User (PSU) to view and revoke consent at the Account Information Service Provider (AISP).
In this topic