Key Phase Dates

Phase 1: Retrospective and Backlog Grooming - 9th July 2020 commencement. 2 weeks duration

Phase 2: Consultation - 22nd July 2020 commencement. 4 weeks duration

Phase 3: Approvals and Documentation - 19th August 2020 commencement. 2 week duration

Please contact [email protected] for an invite to the series

Regarding the pushed authorization request endpoint which needs to be exposed by DH. The RFC states that the endpoint needs to be protected with authentication

The standards documentation doesn't mention how this endpoint will be protected. We need to understand if there will be an access token issued though client credentials grant with client assertion JWT and then use this access token for calling pushed auth. request endpoint. If so, what would be the scope that would be used to get access token using client credentials grant?

where an uaccredited entity is the initial recipient of consumer requess/ consents that it is then passed onto a ADR or its outsouced provider what is the initial compliance responsibility and who is responsible and then 2. where the ADR receives data from an ADH but then shares consumer requested data to the downstream entity

re above question same applies for cancellation or renewal of consent. our view they stay with the accredited ADR who would then be responsible through contracts and third party management for the initial entity and anyone they provide the data. . appreciate confirmation

Will ADRs be requesting to Authorise scopes that are not in scope for non-majors in Phase 1? The following authorisation scopes are not “in-scope” for non-majors in Phase 1
• Common:customer:detail:read
• Bank:regular_payments:read
• Bank:payees:read

We wanted to check whether ADRs will be requesting for these from us (particularly during the overlap between big banks and non-majors). If yes, what is the guidance from ACCC? Do we:
1. Inform the customer that these scopes are not available but continue to collect their consent for these scopes so they can be shared in phase 2?
2. Remove these scope items in the Account Confirmation screens – i.e. not allow the customer to have these and make the customer re-apply when the scopes are available?

The CX Guidelines state that ‘Data holders SHOULD prioritise information that is important to consumers. This MAY include using tabs (e.g. active, pending, archived), or presenting key details up front, such as when consent was granted.’

The pending example does not refer explicitly to a consent. ‘Pending’ may apply broadly to any situation where an action or activity relating to an authorisation is pending. It may be where disclosure itself is paused or interrupted because an ADR has been suspended, or the DH pauses disclosure due to suspicious activity. It may refer to an action required by the user, such as a joint account election needing to be approved. Or it may be that an ‘empty authorisation’ exists where a consent is active, but no data is being shared because no accounts are associated with that consent. The use of ‘pending’ does not necessarily mean that the consent itself is technically ‘pending’. The term ‘pending’ is only an example and should not be seen as prescriptive. How the previous examples are visually implemented are at the discretion of the DH.

Where the consumer dashboards should reside? From what has been suggested by Brian below, customers should access consumer dashboards from the existing digital channels such as Mobile Banking and Online Banking. After considering below two scenarios, I just want know whether we can place the dashboard outside of the existing channels and only protected by OTPs (new OTPs every time):
• If a loan product as a DR, which needs customers’ previous transactions from other financial institutions, before the loan has been approved and accepted, customers don’t have access to the digital channels and haven’t setup any online banking passwords. How do they manage their consents after their previous data has been imported?
• If customers left the bank and closed their accounts, therefore lost their access to the digital channels, how do they manage their authorizations from our bank after they share their data with other financial institutions?