NextGenPSD2 Conference 2017

Size: px

Start display at page:

Download "NextGenPSD2 Conference 2017"

Avice McKinney
6 years ago
Views:

1 THE Berlin GROUP A EUROPEAN STANDARDS INITIATIVE NextGenPSD2 Conference 2017 Payment Initiation Service, PIS Oliver Bieser, Deutsche Bank Ortwin Scheja, SRC ««««««««««««

2 Content 1 Payment Types 2 Payment Initiation Interfaces Interfaces to be defined by the specification Interfaces out of scope 3 JSON and XML Structures 4 Combined Services AIS/PIS 5 Status Requests Copyright Berlin Group 2

3 XS2A interface: Payment Initiation Service Focus of the work of the Berlin Group Copyright Berlin Group 3

4 Use cases Wallet vs. Payment Initiation only TPP - Wallet Payment Initiation Service (Online Shop) Payment Service User (PSU) TPP Wallet Consolidated view of all Payment Accounts Payment Initiation 1. Consent Mgmt. 2. Get Accounts 3. Payment Initiation ASPSP Payment Service User (PSU) Online Shop TPP 1. Payment Initiation ASPSP Use Case: Use Case: n This TPP provides the PSU a consolidated view of his payment accounts across all banks and allows the initiation of payments from these accounts. n Regular usage of this service by the PSU, based on a contract between PSU and TPP. Payment Initiation n In case of a TPP-Wallet, all PSU data needed for the payment Initiation are available on TTP side. n The main purpose of this service is a payment initiation for an online Shop. n The PSU uses this Service only on demand, no permanent relationship between PSU and TPP Payment Initiation n The TPP needs for the Payment Initiation additional information from the PSU or the ASPSP (e.g.: IBAN). To be captured by the PSU or via an additional AIS request provided by the ASPSP. Deutsche Bank Copyright Berlin Group 4

USD Payment DE-US 2. EUR Payment DE-ES. 1. EUR Payment DE-DE 4.

5 Payment Flows 9. SEK (Krona) Payment SE-SE 3. EUR Payment DE-SE 8. PLN (Zloty) Payment PL-SE 6. USD Payment DE-DE USA 5. USD Payment DE-US 2. EUR Payment DE-ES. 1. EUR Payment DE-DE 4. HRK (Kuna) Payment DE-HR 7. EUR Payment HR-PL Deutsche Bank Copyright Berlin Group 5

6 Conceptual work flow of an SCT Instant payment (Source: SEPA INSTANT CREDIT TRANSFER (SCT INST) SCHEME RULEBOOK from EPC) Deutsche Bank Copyright Berlin Group 6

Impact Analysis Approach: required PIS Formats 1 2 3 Analyse current situation based on the client facing products Compare the elements per country and

n Identify which Payment Products are in Scope. n n n Identify the min.needed elements for payment initiation in all countries.

Solution: n n Extend JSON with additional fields ISO 200022 XML (for corporates) n Compile complete list of all European payment formats supported by the PSD2

7 Impact Analysis Approach: required PIS Formats Analyse current situation based on the client facing products Compare the elements per country and channel Result: List with supported payment Formats in SEPA/per Country n Mapping of all fields in the client facing products to ISO20022 elements. n Identify which Payment Products are in Scope. n n n Identify the min.needed elements for payment initiation in all countries. Issue: If an ASPSP online banking offers additional fileds, this breaks the non-discrimination rule, but covers 99% of the business needs. Solution: n n Extend JSON with additional fields ISO XML (for corporates) n Compile complete list of all European payment formats supported by the PSD2 interface. n Target: one simplified JSON format for each basic payment product. n Additional payment types published (products for single markets, e.g dedicated format for tax payments). Deutsche Bank Copyright Berlin Group 7

Typical Online Banking Screen SEPA Credit Transfer (SCT) 12 Mapping to ISO20022 n Captured by the PSU ISO20022 XML Tags n Name <Cdtr><Nm> n IBAN n Amount n Remittance Information n End to End ID

8 Typical Online Banking Screen SEPA Credit Transfer (SCT) 12 Mapping to ISO20022 n Captured by the PSU ISO20022 XML Tags n Name <Cdtr><Nm> n IBAN n Amount n Remittance Information n End to End ID <CdtrAcct><Id><IBAN> <Amt><InstdAmt> <RmtInf><Ustrd> <PmtId><EndToEndId> n Selected by the PSU n Name (Ordering Party) n IBAN (Ordering Party) 12 n Address (Ordering Party) <Dbtr><Nm> <DbtrAcct><Id><IBAN> <Dbtr><AdrLine> Deutsche Bank Copyright Berlin Group 8

9 SEPA Credit Transfer Screens (examples) Deutsche Bank Copyright Berlin Group 9

10 Impact Analysis Result per Payment Product (SEPA SCT) Beneficiary Name Beneficiary Account Amount Country Product Client DE SCT Retail man. man. man. opt. opt. man. man. n/a n/a n/a n/a n/a DE SCT Corporate man. man. man. opt. opt. man. man. opt. opt.? n/a n/a ES SCT Retail man. man. man. opt. opt. man. man. opt. n/a n/a n/a n/a BE SCT Retail man. man. man. opt. opt. man. man. n/a n/a n/a opt. opt. PL SCT Retail man. man. man. opt. opt. man. man. opt. opt. n/a opt. opt. IT SCT Retail man. man. man. man. opt. man. man. n/a n/a n/a n/a n/a Remittance Information End to End ID Ordering Party Name Ordering Party Account SCT based on minimum needed ISO20022 fields Purpose Code Category Purpose Code Ordering Party Account Cur. Beneficiary Address Ordering Party Address Deutsche Bank Copyright Berlin Group 10

11 Tax Payment F24 in Italy Deutsche Bank Copyright Berlin Group 11

Payment Types/Endpoints n Simple JSON structures e.g.

for corporate customers n Typical private customers SEPA

corporate XML endpoint e.g. /payments/pain.

12 Payment Types/Endpoints n Simple JSON structures e.g. for retail business n Full SEPA XML structures e.g. for corporate customers n Typical private customers SEPA payment initiation endpoints /payments/sepa-credit-transfers /payments/instant-sepa-credit-transfers /payments/target-2-payments /payments/crossborder-credit-transfers n Typical corporate XML endpoint e.g. /payments/pain.001-sepa-credit-transfers PISP XS2A Interface ASPSP Supported payment endpoints are published by ASPSP. Can differ for retail and corporates. PSU Account Deutsche Bank Copyright Berlin Group 12

13 Extending JSON Structures n Usage of Berlin Group specified JSON-Scheme for initiating a standard payment at a standard endpoint. n Usage of ASPSP specific JSON for specific transactions or specific markets Extensions by new optional fields Make mandatory fields optional e.g. ultimate entries, structured remittance information n Extended JSON Schemes will apply to standard endpoints too. PISP Payment Initiation Extension fields Berlin Group JSON Scheme ASPSP specific JSON Scheme ASPSP Deutsche Bank Copyright Berlin Group 13

14 Example for JSON SCT SCT Endpoint Format information Processing IDs Device Data for Risk Management Processing Date/Time POST Content-Encoding gzip Content-Type application/json Process-ID 3dc3d5b f5400a64e80f Request-ID 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 PSU-IP-Address PSU-Agent Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/ Firefox/54.0 Date Sun, 06 Aug :02:37 GMT https Body: Payment Data { } "instructed_amount" : {"currency" : "EUR", "amount" : "123"}, "debtor_account" : { "iban" : "DE "}, "creditor" : { "name" : "Merchant123"}, "creditor_account" : {"iban" : "DE "}, "remittance_information_unstructured" : "Ref Number Merchant" Deutsche Bank Copyright Berlin Group 14

15 XML Definitions n EPC pain.001 schemes will be supported on endpoint /payments/pain.001-sepa-credit-transfers /payments/pain.001-instant-credit-transfers n Community specific pain.001 structures will be additionally supported on these endpoints. References to community specific specifications will be contained in the Berlin Group specification. n No generic pain.001 scheme available for crossborder-payments, Berlin Group specification relies on community specific specifications Copyright Berlin Group 15

16 Instant Payment Workflow and Status Concept 2. Payment Processing & Clearing 1. Payment Initiation 1 Bank A Response Step Description Payment Status 4 Bank B max. 10 sec. overall timeout e.g.: 20 sec. 1 Payment Initiation (Bank A) - PSU Authorization - Limit & compliance checks - Block amount on PSU account 2 Payment Processing and Clearing (Bank A) - Settlement Process (Clearing House) 3 Payment Processing (Bank B) - Compliance Checks (Bank B) - Made funds available to payee (Bank B) 4 Response to Bank A - OK: final booking on the payer account - NOK: delete PreNote - OK - Payment accepted & amount blocked - NOK - Payment rejected (e.g. not enough funds) - NOK - Payment rejected (e.g. Clearing failure) Out of Scope for PIS (Bank A) - Optional: Bank B provides Info to Payee - NOK Payment rejected (e.g. unknown account) Optional: - OK Bank B made the funds available to payee Deutsche Bank Copyright Berlin Group 16

17 Payment Status Definitions Batch booking banks Online booking banks Instant Payments Transaction Status Meaning Received Payment initiation has been received by the ASPSP. AcceptedTechnicalValidation Authentication and syntactical and semantical validation are successful. AcceptedCustomerProfile In addition, Customer profile check was also successful (Limits etc.) AcceptedSettlementInProcess The payment initiation has been accepted for execution. AcceptedSettlementCompleted Settlement on the debtor's account has been completed. (For instant payment only.) Pending Payment initiation or individual transaction included in the payment initiation is pending, e.g. where a second PSU must authorise the transaction. Rejected Payment initiation has been rejected n Detailed transaction status will be part of every response of ASPSP during the payment initiation process. n Modelling is following ISO20022 encoding. Deutsche Bank Copyright Berlin Group 17

18 Combination of AIS and PIS (Consent ID or optional OAuth2) n TPP can always combine AIS and PIS results in the TPP/PSU interface, e.g. in a wallet like TPP solution, where recurring account access is supported. n In addition, a combination of AIS and PIS is supported in the standard e.g. for batch booking banks to also support easy access and risk management solutions of TPPs. n This is an optional function for the ASPSP in the standard. TPP 1. AIS Service with combined service flag 2. Consent-ID or OAuth2-Token 3. PIS Service with Consent-ID or OAuth2-Token without additional PSU authentication ASPSP Enables ASPSP to implement same behaviour in Online-Banking and XS2A. Deutsche Bank Copyright Berlin Group 18

19 High Level Overview: Bank Systems for Online Banking and API Dedicated Interface Client Facing Interfaces Client PSU Client PSU TPP 3 rd Party Provider Website Certificate (e-idas) TLS (one way) Mutual TLS API Website Certificate Firewall (DMZ) Firewall (Reverse Proxy) Website Certificate ASPSP Online Banking http-server Payments WebServices Account Information WebServices Payment WebServices Account Information WebServices Online Banking Services Strong Customer Autentication PSD2 Exemptions Payment Initiation Account Informations Copyright Berlin Group 19

20 THE Berlin GROUP A EUROPEAN STANDARDS INITIATIVE ««««««««««««Example Prototype Payment Initiation Service 20

Beneficiary: John Smith DE12123456781234567891 Amount: 100.

35 Beneficiary: John Smith DE Amount: EUR Created: 10/23/2017 Initiated via PayZooo Payer: Andrei Meyer DE

37 THE Berlin GROUP A EUROPEAN STANDARDS INITIATIVE Thank you for your attention ««««««««««««

PSD2 - Second Payment Services Directive. Information Set

PSD2 - Second Payment Services Directive Information Set PSD2: at the starting line February 2017 EBA published the final draft RTS on SCA November 2017 EC published the final RTS on SCA January 13 2018