ISO/TR 21941:2017

Financial services — Third-party payment service providers

ISO/TR 21941:2017 reports the findings of research into the interface between third-party payment service providers (TPPs) and account servicing payment service providers (ASPSPs).

Services financiers — Prestataires de services de paiement tiers

General Information

• Status: Published
• Publication Date: 20-Jul-2017
• ICS: 03.060 - Finances. Banking. Monetary systems. Insurance
• Technical Committee: ISO/TC 68/SC 2 - Financial Services, security
• Drafting Committee: ISO/TC 68/SC 2 - Financial Services, security
• Current Stage: 6060 - International Standard published
• Completion Date: 21-Jul-2017

Standards Content (Sample)

TECHNICAL ISO/TR
REPORT 21941
First edition
2017-07
Financial services — Third-party
payment service providers
Services financiers — Prestataires de services de paiement tiers
Reference number
ISO/TR 21941:2017(E)
©
ISO 2017

---------------------- Page: 1 ----------------------
ISO/TR 21941:2017(E)

COPYRIGHT PROTECTED DOCUMENT
© ISO 2017, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. [phone]
Fax [phone]
[e-mail]
www.iso.org
ii © ISO 2017 – All rights reserved

---------------------- Page: 2 ----------------------
ISO/TR 21941:2017(E)

Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviated terms . 1
4 Overview of the current TPP landscape . 3
4.1 General . 3
4.2 Europe . 5
4.2.1 Europe and the revised Payment Services Directive . 5
4.2.2 Advantages of a common standard . 5
4.2.3 Contents of the standard . 6
4.3 Asia . 6
4.3.1 Korea . 6
4.3.2 Japan . 7
4.3.3 China . 7
4.4 America . 9
4.4.1 Canada . 9
4.4.2 Brazil .10
4.4.3 USA .12
4.5 Oceania — Australia .13
4.6 Africa — South Africa .14
5 Reference models and architecture .15
5.1 General .15
5.2 Example from Norway .16
6 Further potential developments .17
Bibliography .19
© ISO 2017 – All rights reserved iii

---------------------- Page: 3 ----------------------
ISO/TR 21941:2017(E)

Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www .iso .org/ patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO’s adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: w w w . i s o .org/ iso/ foreword .html.
This document was prepared by Technical Committee ISO/TC 68, Financial services, Subcommittee SC 2,
Financial Services, security.
iv © ISO 2017 – All rights reserved

---------------------- Page: 4 ----------------------
ISO/TR 21941:2017(E)

Introduction
This document was initiated 2 years ago with the aim of conducting research into the interface between
third-party payment (TPP) and account servicing payment service providers.
As TPP is a fast-developing area, it was critical to provide guidance quickly.
This document gives an overview of the situation in different regions as it was at the end of 2015 and
the beginning of 2016. There have been new developments in several of the regions since then.
For the purposes of this document, payment initiation service providers (PISP) and account information
service providers (AISP) are commonly named as TPPs. Furthermore, while there could be other
relevant documents to choose from in other markets with regard to terms, definitions and abbreviated
[2]
terms, the choice has fallen on PSD2 , as a key reference, as this document can be seen as a good place
to start. It should also be noted that the verbal forms are used and interpreted as follows:
— “should” indicates a recommendation;
— “can” indicates a possibility or a capability;
— “must” indicates an external constraint.
NOTE External constraints are not requirements of the document. They are given for the information of the
user. Examples of external constraints are laws of nature and legal requirements.
© ISO 2017 – All rights reserved v

---------------------- Page: 5 ----------------------
TECHNICAL REPORT ISO/TR 21941:2017(E)
Financial services — Third-party payment service
providers
1 Scope
This document reports the findings of research into the interface between third-party payment service
providers (TPPs) and account servicing payment service providers (ASPSPs).
2 Normative references
There are no normative references in this document.
3 Terms, definitions and abbreviated terms
3.1 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at http:// www .iso .org/ obp
— IEC Electropedia: available at http:// www .electropedia .org/
3.1.1
account information service
online service to provide consolidated information on one or more payment accounts (3.1.7) held by
the payment service user (3.1.2) with either another payment service provider or with more than one
payment service provider
[SOURCE: Directive (EU) 2015/2366, definition 16]
3.1.2
payment service user
natural or legal person making use of a payment service in the capacity of payer, payee, or both
[SOURCE: Directive (EU) 2015/2366, definition 10]
3.1.3
account servicing payment service provider
payment service provider providing and maintaining a payment account (3.1.7) for a payer
[SOURCE: Directive (EU) 2015/2366, definition 17]
3.1.4
authentication
procedure which allows the payment service provider to verify the identity of a payment service user
(3.1.2) or the validity of the use of a specific payment instrument (3.1.9), including the use of the user’s
personalized security credentials (3.1.6)
[SOURCE: Directive (EU) 2015/2366, definition 29]
© ISO 2017 – All rights reserved 1

---------------------- Page: 6 ----------------------
ISO/TR 21941:2017(E)

3.1.5
strong customer authentication
authentication (3.1.4) based on the use of two or more elements categorized as knowledge (something
only the user knows), possession (something only the user possesses) and inherence (something the
user is) that are independent, in that the breach of one does not compromise the reliability of the others,
and is designed in such a way as to protect the confidentiality of the authentication data
[SOURCE: Directive (EU) 2015/2366, definition 30]
3.1.6
personalized security credentials
personalized features provided by the payment service provider to a payment service user (3.1.2) for
the purposes of authentication (3.1.4)
[SOURCE: Directive (EU) 2015/2366, definition 31]
3.1.7
payment account
account held in the name of one or more payment service users (3.1.2) which is used for the execution of
payment transactions
[SOURCE: Directive (EU) 2015/2366, definition 12]
3.1.8
payment initiation service
service to initiate a payment order at the request of the payment service user (3.1.2) with respect to a
payment account (3.1.7) held at another payment service provider
[SOURCE: Directive (EU) 2015/2366, definition 15]
3.1.9
payment instrument
personalized device(s) and/or set of procedures agreed between the payment service user (3.1.2) and
the payment service provider and used in order to initiate a payment order
[SOURCE: Directive (EU) 2015/2366, definition 14]
3.1.10
sensitive payment data
data, including personalized security credentials (3.1.6) which can be used to carry out fraud
Note 1 to entry: For the activities of payment initiation service providers and account information service
providers, the name of the account owner and the account number do not constitute sensitive payment data.
[SOURCE: Directive (EU) 2015/2366, definition 32, modified — Part of the definition has been formatted
as Note 1 to entry.]
3.1.11
third-party payment service provider
payment service provider offering payment initiation services (3.1.8) or account information services
(3.1.1) on accounts where they are not the account-servicing payment service provider themselves
3.1.12
interface
device or program for connecting two items of hardware or software so that they can be operated
jointly or communicate with each other
2 © ISO 2017 – All rights reserved

---------------------- Page: 7 ----------------------
ISO/TR 21941:2017(E)

3.1.13
gatekeeper
function that ensures that admittance is limited to third-party payment service providers (3.1.11) who
comply with regulatory and technical requirements
Note 1 to entry: This function can be provided by individual banks or a common actor within finance industry.
Note 2 to entry: The third-party payment service provider itself can provide the gatekeeper function if certified.
3.2 Abbreviated terms
ACH automated clearing house
AISP account information service provider
API application program interface
ASPSP account servicing payment service provider
ATM automated teller machine
EFT electronic funds transfer (or e-funds transfer)
OAuth open authentication
PISP payment initiation service provider
PSD2 Payment Services Directive II
PSP payment service provider
PSU payment service user
SAML security assertion markup language
TPP third-party payment service provider
4 Overview of the current TPP landscape
4.1 General
There are two main types of third-party payment service provider:
a) payment initiation service providers (PISPs);
b) account information service providers (AISPs).
Much taxonomy describing third-party services also consider payment instrument issuing providers,
who are financial institutions other than those servicing the account of the customer, and who issue a
payment card or a payment instrument.
The idea behind third-party providers is for customers (payment service users) to perceive them as
added value to the service of their account servicing payment service provider. Added value could
be new online payment services and more variety in payments instruments, better or simpler user
experience, etc.
One of the main points of attention is related to security, especially strong customer authentication and
secured communication, which is key to achieving the objective of enhancing consumer protection and
promoting innovation. Ensuring the security of payments and the protection of sensitive payment data
are a critical part of the infrastructure of robust payment systems knowing all actors should act on
© ISO 2017 – All rights reserved 3

---------------------- Page: 8 ----------------------
ISO/TR 21941:2017(E)

the same level playing field, i.e. the new players should ensure the actual highest levels of security are
implemented. Security recommendations are designed for TPPs and ASPSPs and include matters, such as
— segregation of duties in information technology,
— hardening servers with secure configurations,
— applying “least privilege” principles to access control,
— limiting login attempts,
— end-to-end encryption, and
— non-sharing user credentials.
One of the key points is that strong authentication for customers when registering cards, making credit
transfers and/or making card payments should be implemented.
Third-party access to accounts, the use of APIs to connect merchant and the bank directly and the ability
to consolidate account information in a unique portal are likely to affect payment services around the
world. With external APIs, customers will have more options to interact with their TPPs or ASPSPs,
next to usual online and mobile banking applications.
PISPs and AISPs can be any type of PSP authorized to offer payment initiation services or account
information services and thus could be, for example, a credit institution or a payment institution. TPPs
in the context of payment initiation services and account information services are not just the ASPSP in
terms of the accounts to which they are obtaining access. In other markets, TPPs may not themselves
offer payment accounts, but gather information or perform payment initiation functions where they
require access to the payment account. The interface between the TPP and the ASPSP is considered
security sensitive; this applies both to AISPs and PISPs. This is due to the following.
a) Entity authentication: the PISP and AISP should provide authentication ensuring that the TPP
trying to access an account is an agreed TPP and is approved by the ASPSP in advance based on a
contractual relationship or listed on a public authority white list.
b) Strong customer authentication: the PSU should be authenticated in a way that ensures the account
servicing payment service providers that the correct PSU is present and has given its consent
to the transaction and given access to its account to a third party. The split of information and
authentication functions between TPP and ASPSP might be organized in several ways. Nevertheless,
user credentials should always be protected and should never be stored. Security standards and
protocols such as OAuth or SAML can be used, without the need to store credentials.
c) Authorization: the ASPSP should authorize the PSU’s transaction or operation request before
execution.
d) Confidentiality: the TPPs get lots of information about the PSUs and this should be handled
according to privacy laws and good practice for banking.
e) Integrity: deletion, manipulation or insertion of information should not occur. In particular, a
payment transaction submitted by a PSU should be protected all the way from initiation to ASPSP.
f) Availability: the TPPs should not influence negatively upon availability and uptime of the ASPSP.
The relation between TPP and ASPSP may be bilateral using a contractual agreement between the
parties, it may be part of a multilateral scheme or an alternative. A multilateral scheme should give the
ASPSP full control and knowledge about which TPPs have access to which types of services.
Management of the multilateral scheme may be performed by the financial supervisory authority of
a jurisdiction, by the ASPSPs themselves or by another body. To be approved as a participant in the
scheme may require a formal evaluation of the third party, licensing based on a self-assessment or
simply a registration. A number of models are possible for this. If the scheme is managed by a financial
4 © ISO 2017 – All rights reserved

---------------------- Page: 9 ----------------------
ISO/TR 21941:2017(E)

supervisory authority, it is likely that they will give a set of rules with supplementary technical
regulatory guidelines.
[6]
A working paper from SWIFT points out that there is currently no global unified approach regarding
regulatory initiatives concerning TPPs. The first challenge is getting to a common understanding of
terminology and characteristics of the various TPPs as a foundation for future standardization and
definition of regulatory environment.
4.2 Europe
4.2.1 Europe and the revised Payment Services Directive
The revised EU Payment Services Directive (PSD2) entered into force in January 2016 and is intended
to be transposed into member states’ national law and applied by 13 January 2018. It will enable third-
party payment service providers to access customer payment accounts. Account-servicing payment
service providers will be required to make available access and all relevant information to third-party
payment service providers. Specifically, this covers the following three services:
a) payment initiation services;
b) account information services;
c) “confirmation on the availability of funds” checking services.
With regard to the electronic interface, the European Banking Authority (EBA) is required to draft
and present to the European Commission regulatory technical standards (RTSs) for strong customer
authentication and secure communication within 12 months after the entry into force of PSD2.
Following their adoption by the Commission, the market will have a period of 18 months to implement
[3]
them. In this regard, the EBA sent out a discussion paper in December 2015, inviting stakeholders to
submit their views on a number of identified issues key to the development of the technical standards.
Among the stakeholders consulted were the European Payments Council (EPC) and the European
Banking Federation (EBF). Their replies to the discussion paper may be of interest for further reading.
An official consultation will follow this summer.
There are several options when it comes to implementation. Uniform and interoperable communication
between third-party payment service providers and banks in Europe would be preferable. However,
this, in turn, presupposes a common interface standard or schema.
4.2.2 Advantages of a common standard
Recital 93 of PSD2 says: “In order to ensure secure communication between the relevant actors in the
context of those services, EBA should also specify the requirements of common and open standards
of communication to be implemented by all account servicing payment service providers that allow
for the provision of online payment services. This means that those open standards should ensure
the interoperability of different technological communication solutions.” Ideally, interoperability of
interacting market participants is achieved through standardization. Open standards are standards
that can be developed jointly by all interested market participants.
As there is no international account interface standard at present and EBA will merely define generic
requirements, uniform EU-wide implementation cannot be ensured. There are no plans either for EBA
to mandate a standard-setter such as European Committee for Standardization (CEN) or International
Organization for Standardization (ISO) to draft specifications for an interface.
Implementation of the technical requirements will ultimately be left to the market. This harbours the
danger that both banks and third-party payment service providers would have to support several
different standards, which immediately raises the question of interoperability. While external parties
could provide appropriate transmission services, they would certainly not do so free of charge. In a
worst-case scenario, there could, however, be a large number of different interfaces if banks and third-
© ISO 2017 – All rights reserved 5

---------------------- Page: 10 ----------------------
ISO/TR 21941:2017(E)

party payment service providers offer proprietary solutions that meet EBA’s generic requirements.
This would not be in the interests of either banks or third-party payment service providers.
Standardization makes sense whenever it is a question of uniting many different parties to form a
networked industry, for example, the payments sector. Communication via a common interface cuts
development, maintenance and enhancement costs for every single party and only requires one-time
implementation. All banks in Europe could be reached with a standard. The aim of standardization is
thus not walled-off markets but uniform access to these markets.
4.2.3 Contents of the standard
An interface standard should cover the following points, among others:
— the legally defined business transactions;
— formats needed for the exchange of messages;
— security requirements.
The purpose of the standard would be to meet the statutory requirements of PSD2. At the same time, it
should be designed openly enough so that further services based on it are possible and it can be adapted
to accommodate future extensions or requirements.
4.3 Asia
4.3.1 Korea
The Korean “e-Financial Transaction Act” (Article 28) allows the third-party payment service provider,
which is defined as an “e-financial business operator” in Korea, to undertake the following:
— e-funds transfer (EFT) services;
— issuance and management of e-debit payment means;
— issuance and management of e-prepayment means;
— e-payment agent services (e.g. payment gateway services for internet shopping mall);
— other e-financial services determined by presidential decree.
The third-party payment service providers have to register for the above services via the banks’
sponsoring relationship.
The relationship between the banks and the third-party payment service providers can be described as
follows.
— The third-party payment service provider must become a corporate client of the bank.
— When a customer gets a loss due to an incident, the bank or the third-party payment service
provider is liable for indemnifying the customer for the loss (Article 9). Who is responsible for the
loss depends on the cause of the incident and the contract between the bank and the third-party
payment service provider.
— Both the bank and the third-party payment service provider must fulfil the duty of good management
to ensure the safe processing of e-finance transactions and they must meet the government
standards (Article 21).
Article 21 of the e-Financial Transaction Act is very important to the third-party payment service
provider in terms of information security in Korea.
6 © ISO 2017 – All rights reserved

---------------------- Page: 11 ----------------------
ISO/TR 21941:2017(E)

4.3.2 Japan
Table 1 gives an overview of major third-party payment services in Japan.
Table 1 — Major third-party payment services in Japan
Payment gateway service Personal finance management
Provides e-commerce merchants with a Aggregates balance/transaction information
gateway for payments via credit cards. on various accounts (e.g. banking accounts,
credit card accounts, electronic money ac-
Some of the TPPs provide a service which
Service overview
counts, investment accounts) and provides it
enables payments using a proxy (e.g. email
to the account holder in a single table.
address, ID for the TPP’s service) of a payer’s
credit card number.
TPPs transfer payment information from TPPs collect balance/transaction informa-
an e-commerce merchant’s website to the tion from the ASPSPs which have been regis-
Relationship
relevant ASPSP (a credit card acquirer of the tered beforehand by the account holder.
with ASPSP
merchant).
Some ASPSPs offer an API to TPPs.
PayPal Money Forward
LINE Pay Moneytree
Example of the
service
PAY.JP Freee
Zaim
Security PCI-DSS Version 3.0 PCI-DSS Version 3.0
[7]
With regard to regulation, the TPPs must adhere to the Act on the Protection of Personal Information
but they are not supervised by a competent authority. ASPSPs are supervised by the Financial Service
Authority or the Ministry of Economy, Trade and Industry. Examples of regulations in force are as
follows.
[8]
— Bank: The Banking Act ;
[9]
— Credit card: The Installment Sales Act ;
[10]
— Electronic money: Payment Services Act .
4.3.3 China
4.3.3.1 Requirements and conditions of business permission
The People’s Bank of China (PBC) has formally issued the “Administrative Measures for the Payment
Services Provided by Non-financial Institutions” [PBC Decree No. 2 (2010) hereinafter referred to as
“Decree No. 2”] in June 2010, which has established a supervision and administration mechanism for
the payment services provided by non-bank financial intermediaries from the perspective of business
permission, clients’ reserves and service specification.
The term “payment services provided by non-bank financial intermediaries” as mentioned in these
measures refers to the monetary capital transfer services provided by non-financial institutions as the
middlemen between payers and payees. Business types are as follows:
— payment through the network;
— issuance and acceptance of prepaid cards;
— bank card acquiring;
— other payment services as specified by the PBC.
© ISO 2017 – All rights reserved 7

---------------------- Page: 12 ----------------------
ISO/TR 21941:2017(E)

Concerning the requirements for payment business permission, the non-financial institutions to
provide payment services must meet the following conditions.
a) Commercial presence: it is a limited liability company or joint-stock company legally formed inside
the People’s Republic of China and it is the corporate body of a non-financial institution.
...