Securing PSD2 APIs

Banks must prepare for PSD2 by exposing secure APIs that Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs) can use, despite the fact that existing bank IT components are often not readily accessible through APIs. A structured PSD2 readiness program should begin with understanding the required API calls, identifying the internal account-holding and transaction-servicing systems those calls must reach, and designing secure web-tier and intermediate-tier layers that safely bridge external third parties to internal infrastructure. In parallel, banks need consumer identity and access management (CIAM) capabilities that support KYC and AML obligations and enable strong, risk-adaptive customer authentication.

PSD2 introduces new competitive dynamics by formalizing AISP and PISP roles that have traditionally been fulfilled by banks, creating opportunities for non-traditional, non-banking entrants. These parties, alongside banks, will increasingly rely on mobile applications and associated authentication methods such as mobile biometrics. Despite regulatory momentum—including Regulatory Technical Standards published in 2017 and PSD2 taking effect in January 2018—many banks have not yet begun the practical steps needed for compliance.

A layered security architecture for externally facing PSD2 APIs is emphasized. Core elements include edge network security (DDoS protection, web application firewall, and threat detection/prevention), a highly available and load-balanced web tier, and an API gateway that authenticates and authorizes AISPs/PISPs while validating requests. Additional controls may include SAML and/or TLS mutual authentication for inbound connectivity, fine-grained authorization to back-end systems using XACML, and cyber threat intelligence-informed detection at both network and server levels. Risk-adaptive authentication options include OTP via email/phone/SMS, mobile push apps, mobile biometrics, user behavioral analytics, tokens, and electronic IDs.

• PSD2 defines Payment Initiation Service Providers (PISPs) that can initiate payment processes directly between consumers and merchants.
• PSD2 defines Account Information Service Providers (AISPs) that can aggregate account information about consumers and businesses.
• Many banks have not yet begun to take steps to comply with PSD2 requirements.
• Regulatory Technical Standards for PSD2 were published in 2017.
• PSD2 took effect in January 2018.
• The Regulatory Technical Standards were expected to come into force in the second half of 2019.
• The Open Banking Project provides standard REST-based API calls for bank interaction with AISPs and PISPs.
• The Berlin Group provides API standards for “Access To Accounts” (XS2A).
• API security gateways can authenticate inbound connection requests via SAML and/or TLS mutual authentication.
• Fine-grained authorization for access to back-end systems can be implemented using XACML.

• “Banks must prepare for PSD2 by creating APIs for AISPs and PISPs to use.”
• “Competition in the financial sector within these newly defined roles could emerge from non-traditional, non-banking types of businesses.”
• “Banks will increasingly become targets of DDOS attacks, as well as more sophisticated application layer attacks.”
• “API security gateways can and should validate the contents of each API request.”
• “Consumer IAM systems enable banks to better know their customers (KYC) and comply with AML regulations.”
• “Use risk adaptive authentication techniques, such as OTP, UBA, mobile apps, and mobile biometrics, to meet PSD2 strong authentication requirements.”
• “Design secure web-tier and intermediate-tier systems for providing PSD2 API support between external AISPs and PISPs and internal infrastructure.”
• “Starting with Edge Network Security, deploy components that can mitigate DDOS and application layer attacks.”
• “Use threat detection and prevention tools that reside at both the network and server level that are informed by cyber threat intelligence channels.”
• “Both these new PISPs and AISPs as well as traditional banks and financial service enterprises will increasingly utilize mobile apps, and correspondingly, mobile biometrics for authentication.”