Sometimes re-authentication for CBPII access is required to allow the CBPII to continue making further confirmation of funds requests. CBPIIs should inform the PSU that they need to be re-authenticated by their ASPSP. CBPIIs present the original account details and expiration date. This journey establishes a new token which the CBPII can use to make subsequent CoF requests.
Other pages in this section Consent for Confirmation of Funds – CoF Confirmation of Funds Yes / No Resonse Re-Authentication of CoF Access at the ASPSP
This content is best viewed on a desktop browser. 1 CX Consideration 1CBPIIs should alert PSUs when re-authentication needs to be performed so that CBPII access at the ASPSP for CoF is restored. 2 CX Consideration 2CBPIIs should make it clear that PSUs are being asked to authenticate with theirASPSPs to restore the funds checking access of CBPIIs to their account. 3 CEG Checklist Requirements 3PSU Consent to CBPII CBPIIs must provide PSUs sufficient information to enable them to make an informed decision about whether to consent to the CBPII making CoF requests to their ASPSP accounts. For example, the CBPII should provide details on the purpose for which the funds checks will be used (including whether any other parties will have access to the information) and clear and reassuring messages about what information will be made available from the ASPSPs. This shouldinclude information such as the following: •Prior to making Confirmation of funds requests to their ASPSPs, CBPIIs must have been given explicit consent by PSUs. •CBPIIs will only received a ‘yes/no’ answer about the availability of funds at PSUs’ account, sufficient to cover a specific amount of a CBPII transaction. •The Confirmation of Funds Response will not be stored by CBPIIs. •Confirmation received by CBPIIs cannot be used for any other purpose than the execution of the transaction for which the request is made. •The period over which CoF consent is requested and the reasons why. •How PSUs will be able to revoke their consent through the CBPII environment. 4 CEG Checklist Requirements 4PSU Consent to CBPII CBPIIs must request for the PSUs’ consent to in a clear and specific manner. CBPIIs must display the following information in the consent screen: PSU payment Account Identification and/or the selected ASPSP Note 1: CBPIIs should mask the PSU payment Account details on the consent screen. Expiration Date & Time: Consent could be on-going or for set period of time. If this parameter is provided by CBPIIs, the consent will have limited life span and will expire on the specified date. CBPIIs could choose to align this expiry date with the expiration date of the card based instrument issued to PSUs. Alternatively, they could choose a different period for security or business reasons, or they could also allow PSUs to select their desired expiry date explaining however the implications this may have on the usage of their issued card. PSU payment Account name, if provided by PSUs in the original consent journey (as per Consent for Confirmation of Funds (CoF). 5 CX Consideration 5Generic CBPII to ASPSP redirection screen and message. Please refer to Section Effective use of redirection screens. 6 CEG Checklist Requirements 6Authentication ASPSPs must apply SCA. The ASPSP authentication must have no more than the number of steps that the PSU would experience when directly authenticating via the ASPSP channel. 7 CX Consideration 7Authentication ASPSPs could display a message to prompt PSUs to authenticate to continue with setting up Funds Check. 8 CEG Checklist Requirements 8ASPSP Consent Prior to receiving the first request from each CBPII, ASPSPs must obtain explicit consent from the PSU to provide confirmation of funds to CBPII requests. ASPSPs must be able to introduce an additional screen to display Information associated with the Confirmation of Funds consent. ASPSPs must display to PSUs all the information related to the CoF consent. This information includes the following: CBPII requesting CoF to the PSU account. PSU payment Account Name. PSU payment Account Identification. Consent Expiration Date & Time: (this could also be on-going). Note: PSU’s payment account details may be shown in account number and sort-code format in cases when PSU in item #1 provided account identification details in other formats such as a PAN, IBAN, Paym mobile number, etc., subject to CBPII offering these options. 9 CX Consideration 9ASPSP Supplementary Information ASPSPs should provide some supplementary information in relation to their obligations for CoF requests and how these will be handled. This may include but not limited to the following: ASPSPs will only respond with a ‘yes/no’ answer about the availability of funds at PSUs’ account, sufficient to cover a specific amount of a CBPII transaction. ASPSPs are not permitted to provide additional account information (such as the account balance) or block funds on the PSU’s account for the CBPII transaction. PSUs may be able to view their history of Confirmation of Funds requests including the identity of CBPIIs which made CoF requests and the provided response, using their Access Dashboard at their ASPSPs. How PSUs will be able to revoke their consent from the ASPSP Access Dashboard. 10 CX Consideration 10ASPSPs should allow PSUs to review as a part of the authentication process all the information related to the CoF. PSUs can either proceed with the CoF consent or cancel it, on the same screen with items #8 & #9,using %22equal weight%22 options. 11 CX Consideration 11Generic ASPSP to CBPII redirection Screen and message. Please refer to Section Effective use of redirection screens. 12 CX Consideration 12CBPII Confirmation CBPIIs should confirm to PSUs the successful completion of the Confirmation of Funds account access request. CBPIIs could also choose to display again: the PSU payment account identification details (this can now be in masked form). the expiration date of the Confirmation of Funds consent. Select to scroll left Select to scroll right
CEG Checklist Requirements & Customer Experience Considerations 1 CBPIIs should alert PSUs when re-authentication needs to be performed so that CBPII access at the ASPSP for CoF is restored. 2 CBPIIs should make it clear that PSUs are being asked to authenticate with their ASPSPs to restore the funds checking access of CBPIIs to their account. 3 PSU Consent to CBPII CBPIIs must provide PSUs sufficient information to enable them to make an informed decision about whether to consent to the CBPII making CoF requests to their ASPSP accounts. For example, the CBPII should provide details on the purpose for which the funds checks will be used (including whether any other parties will have access to the information) and clear and reassuring messages about what information will be made available from the ASPSPs. This should include information such as the following: Prior to making Confirmation of funds requests to their ASPSPs, CBPIIs must have been given explicit consent by PSUs. CBPIIs will only received a ‘yes/no’ answer about the availability of funds at PSUs’ account, sufficient to cover a specific amount of a CBPII transaction. The Confirmation of Funds Response will not be stored by CBPIIs. Confirmation received by CBPIIs cannot be used for any other purpose than the execution of the transaction for which the request is made. The period over which CoF consent is requested and the reasons why. How PSUs will be able to revoke their consent through the CBPII environment. 8 4 PSU Consent to CBPII CBPIIs must request for the PSUs’ consent to in a clear and specific manner. CBPIIs must display the following information in the consent screen: PSU payment Account Identification and/or the selected ASPSP Note: CBPIIs should mask the PSU payment Account details on the consent screen. Expiration Date & Time: Consent could be on-going or for set period of time. If this parameter is provided by CBPIIs,the consent will have limited life span and will expire on the specified date. CBPIIs could choose to align this expiry date with the expiration date of the card based instrument issued to PSUs. Alternatively, they could choose a different period for security or business reasons, or they could also allow PSUs to select their desired expiry date explaining however the implications this may have on the usage of their issued card. PSU payment Account name, if provided by PSUs in the original consent journey (as per Consent for Confirmation of Funds (CoF). 8 32 5 Generic CBPII to ASPSP redirection screen and message. Please refer to section Effective use of redirection screens. 6 Authentication ASPSPs must apply SCA. The ASPSP authentication must have no more than the number of steps that the PSU would experience when directly authenticating via the ASPSP channel. 1 7 Authentication ASPSPs could display a message to prompt PSUs to authenticate to continue with setting up Funds Check. 8 ASPSP Consent Prior to receiving the first request from each CBPII, ASPSPs must obtain explicit consent from the PSU to provide confirmation of funds to CBPII requests. ASPSPs must be able to introduce an additional screen to display Information associated with the Confirmation of Funds consent. ASPSPs must display to PSUs all the information related to the CoF consent. This information includes the following: CBPII requesting CoF to the PSU account. PSU payment Account Name. PSU payment Account Identification. Consent Expiration Date & Time: (this could also be on-going). Note: PSU’s payment account details may be shown in account number and sort-code format in cases when PSU in item #1 provided account identification details in other formats such as a PAN, IBAN, Paym mobile number, etc., subject to CBPII offering these options. 31 9 ASPSP Supplementary Information ASPSPs should provide some supplementary information in relation to their obligations for CoF requests and how these will be handled. This may include but not limited to the following: ASPSPs will only respond with a ‘yes/no’ answer about the availability of funds at PSUs’ account, sufficient to cover a specific amount of a CBPII transaction. ASPSPs are not permitted to provide additional account information (such as the account balance) or block funds on the PSU’s account for the CBPII transaction. PSUs may be able to view their history of Confirmation of Funds requests including the identity of CBPIIs which made CoF requests and the provided response,using their Access Dashboard at their ASPSPs. How PSUs will be able to revoke their consent from the ASPSP Access Dashboard. 10 ASPSPs should allow PSUs to review as a part of the authentication process all the information related to the CoF. PSUs can either proceed with the CoF consent or cancel it, on the same screen with items 8 & 9,using “equal weight” options. 11 Generic ASPSP to CBPII redirection Screen and message. Please refer to section Effective use of redirection screens. 12 CBPII Confirmation CBPIIs should confirm to PSUs the successful completion of the Confirmation of Funds account access request. CBPIIs could also choose to display again: The PSU payment account identification details (this can now be in masked form). The expiration date of the Confirmation of Funds consent.
Confirmation of Funds Yes / No Resonse Previous Related articles Please select API Specifications Consent Re-Authentication Dashboards Next