Open Banking is a worldwide phenomenon.

Throughout the globe, multiple initiatives have emerged, some led by regulation and others by the market. This publication focuses on the regulatory-driven markets, all of which have approved competent authorities that authorise and supervise market players. Nonetheless, OBE also tracks market-driven initiatives and will represent them whenever possible. 

Despite its name, Open Banking does not make financial information widely accessible to anyone. Accessing banking information is only possible in controlled and secure environments due to value, confidentiality, and risk issues. For a party to retrieve financial data, it has to be authorised, identify itself to the data holders, and have the permissions of the data owners. This piece focuses on the identification of the parties to the data holders. 

After being issued with their license, API Users (Fintechs) must prove their identity to the Financial Institutions that provide APIs. To do this, Fintechs can rely on public-key certificates for electronic signatures and website authentication. To enable interoperability, the players should follow standards. The European Telecommunications Standards Institute (ETSI) developed the TS 119 495, the reference in Europe. Recognising the need for a global standard, ETSI updated their technical standard to make it global. OBE advocates using ETSI’s Technical Standard 119 495 for Open Banking trust certificates, as it is proven and widely used. Our work focuses on the TS 119 495. 

Section 5.2.1 of TS 199 495 defines the requirements of the Authorisation Number issued by the “National Competent Authority” (NCA). The standard defines three components that should be included, as follows: 

• 2 character ISO 3166-1 [8] country code representing the NCA country 
• 2-8 character NCA identifier without country code (A-Z uppercase only, no separator) 
• PSP identifier (authorisation number as specified by the NCA. There are no restrictions on the characters used). 

The first component is defined by ISO 3166-1, the scope of which is global. The PSP identifier is determined locally by each NCA according to their local regulations. However, the NCA Identifier is not as clear. In Europe, the European Banging Authority manages and publishes the NCA codes for the European Economic Area (EEA). Nonetheless, there is nothing that specifies the codes for other areas. 

This document defines the NCA codes to be used by Trust Service Providers when issuing Open Banking identity certificates. The paper is divided by regions: Europe, Asia and Oceania, Americas, Middle East and Africa.  The European section incorporates proposals for countries outside the EEA. OBE has put forward a recommendation for the remaining geographies. 

OBE will actively update and maintain this document and welcomes input from National Competent Authorities, API Providers, API Users and Trust Service Providers. To mitigate legacy issues, OBE will follow strict versioning rules and has in place a rigorous change process.