ISO TR 21941-2017 Financial services - Third-party payment service providers.pdf

1、 ISO 2017 Financial services Third-party payment service providers Services financiers Prestataires de services de paiement tiers TECHNICAL REPORT ISO/TR 21941 Reference number ISO/TR 21941:2017(E) First edition 2017-07 ISO/TR 21941:2017(E)ii ISO 2017 All rights reserved COPYRIGHT PROTECTED DOCUMENT

2、 ISO 2017, Published in Switzerland All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written per

3、mission. Permission can be requested from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Ch. de Blandonnet 8 CP 401 CH-1214 Vernier, Geneva, Switzerland Tel. +41 22 749 01 11 Fax +41 22 749 09 47 copyrightiso.org www.iso.org ISO/TR 21941:201

4、7(E)Foreword iv Introduction v 1 Scope . 1 2 Normative references 1 3 T erms, definitions and abbr e viat ed t erms 1 4 Overview of the current TPP landscape . 3 4.1 General . 3 4.2 Europe 5 4.2.1 Europe and the revised Payment Services Directive 5 4.2.2 Advantages of a common standard 5 4.2.3 Conte

5、nts of the standard . 6 4.3 Asia 6 4.3.1 Korea 6 4.3.2 Japan . 7 4.3.3 China . 7 4.4 America . 9 4.4.1 Canada 9 4.4.2 Brazil .10 4.4.3 USA 12 4.5 Oceania Australia 13 4.6 Africa South Africa .14 5 Reference models and architecture .15 5.1 General 15 5.2 Example from Norway .16 6 Further potential de

6、velopments .17 Bibliogr aph y .19 ISO 2017 All rights reserved iii Contents Page ISO/TR 21941:2017(E) Foreword ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normall

7、y carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the

8、work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization. The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the d

9、ifferent approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives). Attention is drawn to the possibility that some of the elements of this docu

10、ment may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www .iso .

11、org/ patents). Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement. For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as inform

12、ation about ISOs adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following URL: w w w . i s o .org/ iso/ foreword .html. This document was prepared by Technical Committee ISO/TC 68, Financial services, Subcommittee SC 2, Financial Services,

13、 security.iv ISO 2017 All rights reserved ISO/TR 21941:2017(E) Introduction This document was initiated 2 years ago with the aim of conducting research into the interface between third-party payment (TPP) and account servicing payment service providers. As TPP is a fast-developing area, it was criti

14、cal to provide guidance quickly. This document gives an overview of the situation in different regions as it was at the end of 2015 and the beginning of 2016. There have been new developments in several of the regions since then. For the purposes of this document, payment initiation service provider

15、s (PISP) and account information service providers (AISP) are commonly named as TPPs. Furthermore, while there could be other relevant documents to choose from in other markets with regard to terms, definitions and abbreviated terms, the choice has fallen on PSD2 2 , as a key reference, as this docu

16、ment can be seen as a good place to start. It should also be noted that the verbal forms are used and interpreted as follows: “should” indicates a recommendation; “can” indicates a possibility or a capability; “must” indicates an external constraint. NOTE External constraints are not requirements of

17、 the document. They are given for the information of the user. Examples of external constraints are laws of nature and legal requirements. ISO 2017 All rights reserved v Financial services Third-party payment service providers 1 Scope This document reports the findings of research into the interface

18、 between third-party payment service providers (TPPs) and account servicing payment service providers (ASPSPs). 2 Normative references There are no normative references in this document. 3 T erms, d efinitions and abbr e viat ed t erms 3.1 T erms and definition s For the purposes of this document, t

19、he following terms and definitions apply. ISO and IEC maintain terminological databases for use in standardization at the following addresses: ISO Online browsing platform: available at h t t p :/ www .iso .org/ obp IEC Electropedia: available at h t t p :/ www .electropedia .org/ 3.1.1 account info

20、rmation service online service to provide consolidated information on one or more payment accounts (3.1.7) held by the payment service user (3.1.2) with either another payment service provider or with more than one payment service provider SOURCE: Directive (EU) 2015/2366, definition 16 3.1.2 paymen

21、t service user natural or legal person making use of a payment service in the capacity of payer, payee, or both SOURCE: Directive (EU) 2015/2366, definition 10 3.1.3 a c c o u n t s e r v i c i n g p a y m e n t s e r v i c e p r o v i d e r payment service provider providing and maintaining a payme

22、nt account (3.1.7) for a payer SOURCE: Directive (EU) 2015/2366, definition 17 3.1.4 authentication procedure which allows the payment service provider to verify the identity of a payment service user (3.1.2) or the validity of the use of a specific payment instrument (3.1.9), including the use of t

23、he users personalized security credentials (3.1.6) SOURCE: Directive (EU) 2015/2366, definition 29 TECHNICAL REPORT ISO/TR 21941:2017(E) ISO 2017 All rights reserved 1 ISO/TR 21941:2017(E) 3.1.5 s t r o n g c u s t o m e r a u t h e n t i c a t i o n authentication (3.1.4) based on the use of two or

24、 more elements categorized as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect

25、 the confidentiality of the authentication data SOURCE: Directive (EU) 2015/2366, definition 30 3.1.6 personalized security credentials personalized features provided by the payment service provider to a payment service user (3.1.2) for the purposes of authentication (3.1.4) SOURCE: Directive (EU) 2

26、015/2366, definition 31 3.1.7 payment account account held in the name of one or more payment service users (3.1.2) which is used for the execution of payment transactions SOURCE: Directive (EU) 2015/2366, definition 12 3.1.8 payment initiation service service to initiate a payment order at the requ

27、est of the payment service user (3.1.2) with respect to a payment account (3.1.7) held at another payment service provider SOURCE: Directive (EU) 2015/2366, definition 15 3.1.9 payment instrument personalized device(s) and/or set of procedures agreed between the payment service user (3.1.2) and the

28、payment service provider and used in order to initiate a payment order SOURCE: Directive (EU) 2015/2366, definition 14 3.1.10 sensitive payment data data, including personalized security credentials (3.1.6) which can be used to carry out fraud Note 1 to entry: For the activities of payment initiatio

29、n service providers and account information service providers, the name of the account owner and the account number do not constitute sensitive payment data. SOURCE: Directive (EU) 2015/2366, definition 32, modified Part of the definition has been formatted as Note 1 to entry. 3.1.11 third-party pay

30、ment service provider payment service provider offering payment initiation services (3.1.8) or account information services (3.1.1) on accounts where they are not the account-servicing payment service provider themselves 3.1.12 interface device or program for connecting two items of hardware or soft

31、ware so that they can be operated jointly or communicate with each other2 ISO 2017 All rights reserved ISO/TR 21941:2017(E) 3.1.13 g a t ek e ep er function that ensures that admittance is limited to third-party payment service providers (3.1.11) who comply with regulatory and technical requirements

32、 Note 1 to entry: This function can be provided by individual banks or a common actor within finance industry. Note 2 to entry: The third-party payment service provider itself can provide the gatekeeper function if certified. 3.2 A bbr e viat ed t erms ACH automated clearing house AISP account infor

33、mation service provider API application program interface ASPSP account servicing payment service provider ATM automated teller machine EFT electronic funds transfer (or e-funds transfer) OAuth open authentication PISP payment initiation service provider PSD2 Payment Services Directive II PSP paymen

34、t service provider PSU payment service user SAML security assertion markup language TPP third-party payment service provider 4 Overview of the current TPP landscape 4.1 General There are two main types of third-party payment service provider: a) payment initiation service providers (PISPs); b) accou

35、nt information service providers (AISPs). Much taxonomy describing third-party services also consider payment instrument issuing providers, who are financial institutions other than those servicing the account of the customer, and who issue a payment card or a payment instrument. The idea behind thi

36、rd-party providers is for customers (payment service users) to perceive them as added value to the service of their account servicing payment service provider. Added value could be new online payment services and more variety in payments instruments, better or simpler user experience, etc. One of th

37、e main points of attention is related to security, especially strong customer authentication and secured communication, which is key to achieving the objective of enhancing consumer protection and promoting innovation. Ensuring the security of payments and the protection of sensitive payment data ar

38、e a critical part of the infrastructure of robust payment systems knowing all actors should act on ISO 2017 All rights reserved 3 ISO/TR 21941:2017(E) the same level playing field, i.e. the new players should ensure the actual highest levels of security are implemented. Security recommendations are

39、designed for TPPs and ASPSPs and include matters, such as segregation of duties in information technology, hardening servers with secure configurations, applying “least privilege” principles to access control, limiting login attempts, end-to-end encryption, and non-sharing user credentials. One of t

40、he key points is that strong authentication for customers when registering cards, making credit transfers and/or making card payments should be implemented. Third-party access to accounts, the use of APIs to connect merchant and the bank directly and the ability to consolidate account information in

41、 a unique portal are likely to affect payment services around the world. With external APIs, customers will have more options to interact with their TPPs or ASPSPs, next to usual online and mobile banking applications. PISPs and AISPs can be any type of PSP authorized to offer payment initiation ser

42、vices or account information services and thus could be, for example, a credit institution or a payment institution. TPPs in the context of payment initiation services and account information services are not just the ASPSP in terms of the accounts to which they are obtaining access. In other market

43、s, TPPs may not themselves offer payment accounts, but gather information or perform payment initiation functions where they require access to the payment account. The interface between the TPP and the ASPSP is considered security sensitive; this applies both to AISPs and PISPs. This is due to the f

44、ollowing. a) Entity authentication: the PISP and AISP should provide authentication ensuring that the TPP trying to access an account is an agreed TPP and is approved by the ASPSP in advance based on a contractual relationship or listed on a public authority white list. b) Strong customer authentica

45、tion: the PSU should be authenticated in a way that ensures the account servicing payment service providers that the correct PSU is present and has given its consent to the transaction and given access to its account to a third party. The split of information and authentication functions between TPP

46、 and ASPSP might be organized in several ways. Nevertheless, user credentials should always be protected and should never be stored. Security standards and protocols such as OAuth or SAML can be used, without the need to store credentials. c) Authorization: the ASPSP should authorize the PSUs transa

47、ction or operation request before execution. d) Confidentiality: the TPPs get lots of information about the PSUs and this should be handled according to privacy laws and good practice for banking. e) Integrity: deletion, manipulation or insertion of information should not occur. In particular, a pay

48、ment transaction submitted by a PSU should be protected all the way from initiation to ASPSP. f) Availability: the TPPs should not influence negatively upon availability and uptime of the ASPSP. The relation between TPP and ASPSP may be bilateral using a contractual agreement between the parties, it

49、 may be part of a multilateral scheme or an alternative. A multilateral scheme should give the ASPSP full control and knowledge about which TPPs have access to which types of services. Management of the multilateral scheme may be performed by the financial supervisory authority of a jurisdiction, by the ASPSPs themselves or by another body. To be approved as a participant in the scheme may require a formal evaluation of the third party, licensing based on a self-assessment or simply a registration. A