By Mark Haine (Open Banking Limited)

1. © RAIDIAM 2018.All Rights Reserved.
RAiDiAM
TrustFrameworks and Open Banking
July2018 Information Classification: Confidential © RAIDIAM 2018. All Rights reserved.

2. © RAIDIAM 2018.All Rights Reserved.
About RAiDiAM
Strictly Confidential 2
Created to help with identity focused aspects of Open Banking and PSD2
regulatory challenges.
Provides business and technology consulting and project delivery services
focused on customer identity using an architecture that is modular and
scalable.
We have delivered services to Open Banking, other regulatory bodies,
various large UK financial services organizations, and a number of
software vendors.
RAiDiAM is engaged with various clients and the wider ecosystem to
promote understanding of what Open Banking and PSD2 mean to
businesses and how best to deliver technical solutions to those business
challenges.

3. © RAIDIAM 2018.All Rights Reserved. 3
Ralph Bragg
CTO, Founder
IAM Consultant
Standardsspecialist
Barry
O’Donohoe
CIO, Founder
IAM Consultant
Mark Haine
CEO, Founder
IAM Consultant
Daryl Searle
OperationsDirector and
ProgrammeManager

4. © RAIDIAM 2018.All Rights Reserved.
What’s Changing – European context
4
Financial Services APIs
Open Banking & PSD2
• The banking services landscape is being radically transformed to promote increased
competition and innovation.
• This transformation is being driven by industry and regulatory directives that envisions
Open Banking APIs – UK CMA & EBA
• Third Party Providers (TPPs) will consume standard banking APIs to provide Account
Information and Payment Initiation Services
• TPP access to accounts (XS2A) must be secured by Banks’ using Strong Customer
Authentication (SCA) per technical standard, RTS
• With traditional security perimeters dissolving, a new approach is needed to ensure
security postures remain within risk appetite.
• Enabling this vision Open Banking has delivered identity-centric security model
underpinned by open international standards - OAuth2 & OIDC
• PSD2 solutions are emerging
Data privacy
EU - General Data Protection
Regulation
• The GDPR in full force since 25th May 2018 for all
EU countries, including the UK despite Brexit being
underway.
• This will present major implications for Consumer
IAM platforms in dealing with customer (data
subject) consent.
• Consents need to be ‘freely given, specific,
informed and unambiguous’ – IAM will be on the
front line in dealing with this.
• Fine-grained consent management and its
enforcement is non-trivial.

5. © RAIDIAM 2018.All Rights Reserved.
What’s Changing – Globally
5
• Breaches and perceived abuse of customer data is becoming a
topic of wider interest e.g. Facebook and Cambridge Analytica
• As a result, being a “good custodian” of customer data is of
more interest to companies as it could give a competitive
advantage
• The on-going arms race between attackers and defenders has
been moving to more and more complex layers of the
application
• Identity and associated context is one of the next “battlefields”
• The number of identities interacting has been continuing to
increase partly due to APIs and IoT
Financial Services APIs Data privacy
• Various jurisdictions are looking to achieve similar opening up
of banking services and are at different levels of maturity
• Europe
• Australia
• Japan
• New Zealand
• Singapore
• Mexico
• The interplay between the various laws, regulations,
implementations and standards will mean that there will be
significant complexity to deal with particularly between
jurisdictions

6. © RAIDIAM 2018.All Rights Reserved.
Identity and Authorization
6
• Individual FSCustomers
• Corporate FS Customers
• Agents of Customers
• Account & Payments services companies
• Merchants
• People who work for companies
• Technicalcomponentsbelonging to FS
companies
• Technology providersto companies
While there are
significant benefits to
opening up access to
financial services, we
must look after customer
data and must not share it
with unauthorized
parties.
The consumer wantsto understand
when they areinteracting with
their bank, and when they are
interacting with a third party.
Who are we interacting with?
What are they permitted to do?
Ecosystem Actors
Customers

7. © RAIDIAM 2018.All Rights Reserved.
Trust Framework
Strictly Confidential 7
We need a quick cost effective way of establishing who a
request is coming from and whether they are authorized
Clearly specified and standardised
interfaces are easier to useand result in:
• Quicker integration
• Better interoperability
• Cheaper for everyone
• Better for customers
Standardization
A Trustframework can beimplemented in
many ways butthe topology is an
important consideration.
The choices are hub-and spoke, full mesh
or a hybrid
Ecosystem Topology

8. © RAIDIAM 2018.All Rights Reserved.
Open Banking
Strictly Confidential 8
An independent company “Open Banking Implementation Entity” was created by the banks but
driven by CMA order to deliver the “Open Banking remedies”.
The primary objective was to increasecompetition by opening up access to data and services that
werepreviously exclusiveto the UK banks.
There werea number of parallel workstreams on topics such as legal framework, customer
experience, functional APIs and Security
The technical workstreamsresulted in a decision to focus on a modern API based ecosystemin a
standardized fashion (screen scraping would notdo).
The security workstream agreed OAuth2 & OpenID Connectstandards as thebasis for the ecosystem
interactions .
The legal and security workstreamsagreed a trust framework forcompanies in the ecosystemwould
be required to underpin the security standards implementation. This was a good startbecause it
allowed focus on a subsetof the identities involved in the whole ecosystem.

9. © RAIDIAM 2018.All Rights Reserved.
Open Banking Trust Framework topology choice
Strictly Confidential 9
• The complexities of a full mesh topology meant that it
was unlikely to result in success.
• The level of trustrequired meant that robust
processes would berequired
• Each entity involved in the ecosystemwould need to
manage links of somesort to many other entities
• Maintenance of those links would be onerous on all
parties
• A hub-and-spoketopology requires an a hub entity, but in
the caseof Open Banking the Implementation entity was
already in place and could performthat role
• The Open Banking trustmodel is transitive as the sourceis
the regulators
• All banks and authorized third parties can have their status
validated by the Open Banking Directory
• Open Banking regularly runs the verification processes on
behalf or all participants in the ecosystem

10. © RAIDIAM 2018.All Rights Reserved.
Open Banking Trust Framework value
Strictly Confidential 10
• Runs regular process to ensure up-to-dateinformation about companies and
their attributes
• It means each company does not need to validateidentityand authorization
for each other entity in the ecosystem
• Provides a single pointof integrationfor all parties
• Provides informationvia variousstandardinterfaces
• Additionallyprovidesan strongly authenticatedIdentityprovider for
authorised people in the ecosystem

11. © RAIDIAM 2018.All Rights Reserved.
The Open Banking Directory – Actors
11
Open Banking ecosystem Actors:
• Regulators
• Authorised Companies(Banks
and third parties)
• People representing those
companies
• Technicalcomponents
belonging to those companies
Entity Relationships in
the directory
Open Banking ecosystem
Actors:

12. © RAIDIAM 2018.All Rights Reserved.
The Open Banking Directory – a trust framework
Strictly Confidential 12
Key concept
• The FS customer does not interact directly with Open Banking
• Open Banking systems are NOT in the transaction flow
2 Phases
• On-Boarding – prior to customer engagement
• Transacting – after customer is engaged

13. © RAIDIAM 2018.All Rights Reserved.
The Open Banking Directory – On-Boarding
Strictly Confidential 13
For on-boarding each authorized company must go through
a process to create the necessary records, credentials and
certificates required to interact with other members of the
ecosystem. These credentials are issued by OB.
The on-boarding process checks the identity of the human
actors and the status of them and the claimed organization.
The OB credentials and certificates provided need to be
configured in the technical components belonging to the
company in question.
Additionally Fintechs must then also use their OB
credentials to register their applications with each of the
banks that they wish to transact. This would result in
credentials for Fintech -> Bank interactions.

14. © RAIDIAM 2018.All Rights Reserved.
The Open Banking Directory – Transacting
Strictly Confidential 14
Once the onboarding has been performed the
Fintech will be able to engage with customers who
wish to share their data and permit a fintech to
transact on their behalf.
There is detailed documentation of how that flow
works but from the perspective of the directory
the only involvement is checking the authorization
of entities and their associated credentials.
In practice this means that a Bank can check the validity of claims presented by a
Fintech and visa-versa.
Customer identity claims, consent and authorization are primarily handled by each
Bank and do not involve the Open Banking Directory.

15. © RAIDIAM 2018.All Rights Reserved.
The Directory – Future changes
15
eIDAS certificates as
identity source
New journey for
on-boardinga
new company
basedon eIDAS
identity
Directory providing
attributesfor eIDAS
identities
Changesthattighten
up the OpenBanking
security profile in
line with FAPI
PSD2
alignment
API only on-
boarding
Directory as
attribute provider
• With the challengingtimescales, Open Banking hadto consider thatsome requirementscouldnotbe achieved by
the original CMA deadline
• The following itemsare some of the changes that are planned for the OpenBankingDirectory and ecosystem
Next steps
FAPI-OB
convergence

16. © RAIDIAM 2018.All Rights Reserved.
Reference materials
Strictly Confidential 16
https://www.openbanking.org.uk/providers/directory/
https://openbanking.atlassian.net/wiki/spaces/DZ/overview

17. © RAIDIAM 2018.All Rights Reserved. 17
www.raidiam.com
+44 (0) 203 504 6440
50 Brook Street,
Mayfair,London.
W1K 5DR
info@raidiam.com
Get in touch