ForgeRock Identity Platform for PSD2 & API Security

Short Summary

PSD2 is positioned as a transformative shift in EU banking comparable to the impact ATMs had on customer self-service, aiming to strengthen the single EU payments market by making transactions cheaper, safer, faster, and more transparent. A central mechanism is regulated, consent-based data sharing: once customers approve, Third Party Providers (TPPs) can access account data and initiate payments through secure bank APIs. Technically, PSD2 drives two major capability areas: opening and securing new financial services APIs, and implementing Strong Customer Authentication (SCA) alongside transactional risk analysis and malware mitigation.

PSD2 introduces new roles and market structure: banks become Account Servicing Payment Service Providers (ASPSPs), while TPPs include Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs). Functions historically handled by banks are explicitly opened to competition, potentially from non-traditional businesses, raising both innovation potential and security exposure. Many EU banks are described as underprepared for secure, programmatic, high-volume third-party access, especially given legacy core systems protected by layered internal defenses that were not designed for external API exposure. Consequently, banks must build new TPP-facing interface layers and defense-in-depth infrastructure, including API gateways, web application firewalls, traffic analysis, certificate-based trust, authorization services, and national/international trust frameworks (including eIDAS certificates).

Standardization efforts such as UK Open Banking and Berlin Group NextGenPSD2 aim to reduce fragmentation by defining API and security approaches; UK Open Banking specifies OAuth 2.0 more directly, while PSD2 is technology-agnostic. ForgeRock is presented as an identity and API security platform supporting consent, OAuth2/OIDC/UMA, SAML, policy enforcement, monitoring, and conformance tooling (Test Directory and Model Bank) to help banks and TPPs meet PSD2 and related standards under tight implementation deadlines.

Interesting Facts

• EU PSD2 took effect in January 2018.
• The PSD2 Regulatory Technical Specifications govern Strong Customer Authentication and Secure Communications.
• The deadline for PSD2 test interfaces was March 14, 2019.
• The deadline for PSD2 implementation was September 14, 2019.
• PSD2 defines banks as Account Servicing Payment Service Providers (ASPSPs).
• PSD2 defines Third-Party Providers (TPPs), including Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs).
• The Open Banking regulation requires specific UK banks to provide APIs to other banks and TPPs.
• Berlin Group NextGenPSD2 is a standardization initiative for PSD2 Access to Account (XS2A) APIs.
• The European Banking Authority ruled that qualified eIDAS certificates can be used to identify ASPSPs and TPPs.
• UK Open Banking has been in operation since January 2018.

Notable Quotes

• “Like ATMs, PSD2 has the potential to radically change the financial sector in the EU”
• “Opening core banking functions via API will be a challenge and a risk for banks under PSD2”
• “Banks and TPPs will need formal trust relationships established”
• “Flexibility is critical when considering the right platform to use”
• “How the EU will interact with financial services and make payments is changing dramatically for the better through more secure and transparent transactions.”
• “One thing is for sure, across Europe the way of accessing and interacting with Banking institutions will change.”
• “To enable a new and secure financial ecosystem, APIs are being refined and standardized in an open source manner.”
• “This new infrastructure must be designed with defense-in-depth principles, including data, network and API security, as well as a trust framework for regulated external service providers and related identity and access management.”
• “PSD2 does not dictate which technologies to use or what an API should look like.”
• “Banks and TPPs should begin deploying their PSD2 solution architecture as soon as possible, in order to comply with PSD2.”