Operational Guidelines
This version is:
Published 5 years ago 20 Dec 2019A detailed list of changes from V3.1.3 to V3.1.4
Other pages in this section
A detailed list of changes from V3.1.3 to V3.1.4
Changes are indicated as follows. Copy which has been removed is struck out and copy which has been added is in blue.
| Item | Section Reference | Description of Change | Reason for Change | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Section Security | |||||||||
| 1 | Introduction | To protect the confidentiality, integrity and availability of information and data in the Open Banking Ecosystem, all Participants should ensure that security is given sufficient profile and influence in their organisation and operations in order to meet both obligations under PSD2 and data protection laws. | OBIE internal review | ||||||
| 2 | Effective Information Security Management | Develop, maintain and implement an Information Security Policy, ensuring adequate resources, processes, technology, people and budget are allocated. Regulatory Consequences: Poor information security could lead to revocation of your regulatory permissions as well as enforcement action and/ or fines arising out of data protection breaches. Revenue Consequences: Poor information security will compromise trust in your business , create reputational risk and could lead to adverse publicity and | OBIE internal review | ||||||
| 3 | Protecting Against Data Breach | Classify data and assets. Understand what data you hold, assess the sensitivity and protect according to the threat likelihood and distinguish personal data from other confidential and classified data and impact. Regulatory Consequences: A data breach must be reported to the Data Breaches: Beware of Guidance from the ICO on dealing with a data breach can be found here: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ | OBIE internal review | ||||||
| 4 | Developing a Data Breach Policy & Procedure Data Breach Policy | Amongst other policies and procedures and in accordance with data protection laws, TPPs should create a data breach policy statement and operate to the following recommended set of policies: • Prevent: Operate regular risk assessment and risk monitoring in order to anticipate potential data threats, hazards and impacts. | OBIE internal review | ||||||
| 5 | Technical Security | Always maintain the ability of the user to verify the authenticity of the site they are entering, i.e. maintain the ability to see the Practical Guide to IT Security from ICO can be found here: https://ico.org.uk/media/for-organisations/documents/1575/it_security_practical_guide.pdf | OBIE internal review | ||||||
| Section Counter Fraud Measures | |||||||||
| 6 | Introduction | Ensuring the security of payments is at the core of PSD2. Participants are obliged to ensure that they have an established framework to manage their operational and security risks". Participants must also be mindful of the interplay with other statutory obligations, such as ensuring the security and protection of personal data, including financial data, in accordance with data privacy laws. The minimisation of fraud risk within the Open Banking Ecosystem is considered of fundamental importance by the Open Banking Implementation Entity to ensure the protection of customers and the security of transactions. Recommendations are based on the EBA has recently published Guidelines on ICT and security risk management which will repeal and replace the current EBA Guidelines on the security measures for operational and security risks of payment services under PSD2 which come into force on 30 June 2020. | OBIE internal review | ||||||
| 7 | Counter Fraud Strategy & Operations | Regulatory Consequences: High fraud levels could | OBIE internal review | ||||||
| Section Operational Excellence | |||||||||
| 8 | Issue Resolution Service Requests | As part of our continuous improvement initiative, we are also looking to automate this page. | OBIE internal review | ||||||
| 9 | Dispute Management System | OBIE internal review | |||||||
| Section Testing | |||||||||
| 10 | Introduction | Introduction The Open Banking Implementation Entity (OBIE) would like to ensure all Participants and Technical Service Providers (TSPs) looking to operate within the Open Banking Ecosystems | OBIE internal review | ||||||
| 11 | The Approach | The Approach
*TPPs obtaining QTSP issued eIDAS Test QWAC and QSEAL certificates can be uploaded onto the OBIE Sandbox Directory. | OBIE internal review | ||||||
| 12 | Participant Journey | Communications | OBIE internal review | ||||||
| 13 | Test Phase Engagement | Entities new to Open Banking (including those that do not have regulatory permissions) will be encouraged to take advantage of all test phases so that they can embed and refine their Open Banking knowledge and proposition as they progress through each phase. | OBIE internal review | ||||||