Dedicated Interface

A dedicated interface is a technical channel, almost always an API, that a bank or other account provider builds specifically so that licensed third parties can access customers' payment accounts with their consent. The term comes from the European Union's regulatory technical standards on strong customer authentication and common and secure communication, which accompany PSD2. Under those rules, an account servicing payment service provider (ASPSP) must give account information service providers and payment initiation service providers a secure way to access accounts, either through a dedicated interface or by adapting the interface its own customers use.

In practice, nearly all banks chose the dedicated interface route, offering an open banking API. The alternative, a modified customer interface, would let third parties use the bank's online banking website with additional identification. The dedicated interface model replaced much of the screen scraping that third parties relied on before PSD2.

The rules are set out in Commission Delegated Regulation (EU) 2018/389, the regulatory technical standards drafted by the European Banking Authority, which applied from 14 September 2019. The United Kingdom kept equivalent rules after leaving the EU, now overseen by the Financial Conduct Authority. The standards require ASPSPs to ensure that the dedicated interface offers at all times the same level of availability and performance as the interfaces available to their own customers, to publish statistics on availability and performance, and to make technical documentation and a testing facility available to third parties in advance.

• Identification. Third parties must identify themselves to the bank, typically using qualified certificates issued under the EU's eIDAS framework, a form of digital certificate.
• Authentication. The interface must allow third parties to rely on the bank's strong customer authentication procedures, through redirection, embedded or decoupled authentication approaches.
• Data parity. Third parties must receive the same information about accounts and payments that is available to the customer when accessing the account directly.
• No obstacles. The interface must not create obstacles, such as requiring extra registration, unnecessary checks of consent or mandatory redirection to the bank's login without justification.
• Communication of errors. The interface must send clear messages explaining unexpected events or errors.

As a safeguard, a bank with a dedicated interface must normally offer a contingency mechanism, often called a fallback, that lets third parties use the customer-facing interface if the dedicated interface is not working properly. National authorities can exempt a bank from the fallback requirement if its dedicated interface meets conditions on performance, testing, wide use by third parties and prompt resolution of problems. The EBA published guidelines describing these conditions, and many large banks obtained exemptions, which encouraged them to invest in reliable APIs.

The regulation does not prescribe a technical standard, so several industry standards emerged. In the UK, the largest banks were required by the Competition and Markets Authority to implement a common Open Banking Standard, maintained by Open Banking Limited. In continental Europe, the Berlin Group's NextGenPSD2 framework became the most widely used specification, alongside others such as STET in France. Many banks rely on API hubs or aggregators to reach third parties, and third parties often use API aggregation providers to connect to many banks through one integration. Directories, such as an open banking directory, help banks verify that a third party is authorised.

Banks must monitor the availability and response times of their dedicated interfaces and publish quarterly statistics, so that third parties and supervisors can compare them with the bank's own customer channels. Supervisors use these statistics, together with complaints from third parties, to decide whether a fallback exemption should be kept or withdrawn. Problems that affect the interface must be reported and resolved without delay, and banks are expected to notify third parties in advance of planned changes and maintenance.

Third-party providers have complained about uneven quality, downtime, inconsistent implementations and obstacles such as excessive authentication steps, particularly in the early years. Banks have pointed to the cost of building and running interfaces without being able to charge for access to regulated services. The European Commission's proposals for a Payment Services Regulation and a third Payment Services Directive aim to strengthen interface performance requirements and remove obstacles, while the proposed framework for financial data access would extend data sharing beyond payment accounts. In the UK, work on premium APIs and commercial variable recurring payments explores how banks might charge for services that go beyond the regulatory minimum.

• European Banking Authority
• The Berlin Group