ISO/TS 12812-3:2017
(Main)Core banking — Mobile financial services — Part 3: Financial application lifecycle management
Core banking — Mobile financial services — Part 3: Financial application lifecycle management
ISO/TS 12812-3:2017 specifies the interoperable lifecycle management of applications used in mobile financial services. As defined in ISO 12812‑1, an application is a set of software modules and/or data needed to provide functionality for a mobile financial service. This document deals with different types of applications which is the term used to cover authentication, banking and payment applications, as well as credentials. Clause 5 describes the basic principles required, or to be considered, for the application lifecycle management. Because several implementations are possible with impacts on the lifecycle, this document describes the different architectures for the location of the application and the impacts of the different scenarios regarding the issuance of the secure element when present (see Clause 6), the different roles for the management of the application lifecycle and the domains of responsibilities (see Clause 7). It also specifies functions and processes in the application lifecycle management (see Clause 8) and describes scenarios of service models and roles of actors (see Clause 9).
Opérations bancaires de base — Services financiers mobiles — Partie 3: Gestion du cycle de vie des applications financières
General Information
Standards Content (Sample)
TECHNICAL ISO/TS
SPECIFICATION 12812-3
First edition
2017-03
Core banking — Mobile financial
services —
Part 3:
Financial application lifecycle
management
Opérations bancaires de base — Services financiers mobiles —
Partie 3: Gestion du cycle de vie des applications financières
Reference number
©
ISO 2017
© ISO 2017, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO 2017 – All rights reserved
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 2
5 Basic principles for application lifecycle management . 2
5.1 General . 2
5.2 Portability of MFSs . 2
5.3 Entities involved in the application lifecycle management . 3
5.4 Security and privacy . 3
5.5 Risk assessment . 3
5.6 Support of multiple applications and multiple MFSPs . 3
5.7 User Interface and branding. 3
5.8 Customer relationship management . 3
5.9 Common APIs . 4
5.10 Terms of service . 4
6 Location of the application . 4
6.1 General . 4
6.2 Different types of secure environments . 4
6.3 Scenarios for mobile proximate payments . 4
6.4 Scenarios for mobile remote payments . 5
6.4.1 General. 5
6.4.2 Payment credentials . 5
6.4.3 Application . 5
6.5 Scenarios for mobile banking . 5
7 Service management roles . 5
7.1 General . 5
7.2 MFSP domain roles . 6
7.3 SE provider domain roles . 7
8 Application lifecycle: functions and processes . 7
8.1 General . 7
8.2 Functions . 7
8.3 Processes . 8
9 Scenarios for service models . 9
9.1 General . 9
9.2 Scenario 1: UICC . 9
9.3 Scenario 2: Embedded secure element . 9
9.4 Scenario 3: Secure micro SD card .10
9.4.1 General.10
9.4.2 Secure micro SD card provided by the MFSP .10
9.4.3 Secure micro SD card provided by a third party .10
9.4.4 Secure micro SD card for contactless payment .10
9.5 Scenario 4: Trusted execution environment .10
9.6 Scenario 5: Mobile application located in the mobile device host .11
9.7 Scenario 6: Mobile application on a secured server .11
Bibliography .12
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www .iso .org/ patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO’s adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: w w w . i s o .org/ iso/ foreword .html.
This document was prepared by Technical Committee ISO/TC 68, Financial Services, Subcommittee
SC 7, Core Banking.
A list of all the parts in the ISO 12812 series can be found on the ISO website.
iv © ISO 2017 – All rights reserved
Introduction
The use of mobile devices to conduct financial services (i.e. payments and banking) is occurring
following the steady rise of the number of customers using the Internet for these services. As an
evolving market, mobile financial services are being developed and implemented on various bases
throughout the different regions of the world and also among the various providers of such services.
In these conditions, the purpose of the ISO 12812 series is to facilitate and promote interoperability,
security and quality of mobile financial services while making sure that stakeholders in the services
can benefit from the evolution, and service providers remain as commercially free and competitive as
possible to design their own implementations in pursuing their own business strategies. This document
addresses the interoperability only at the technical layer by considering the impact of new components
and/or interfaces induced by the introduction of a mobile device in financial services. The intentions of
the ISO 12812 series are:
a) to advance interoperability of mobile financial services globally by defining requirements based
on a common terminology and basic principles for the design and operation of mobile financial
services;
b) to define technical components and their interfaces, as well as roles that may be performed by
different actors in addition to mobile financial service providers (e.g. mobile network operators,
trusted service managers). These components and their interfaces, as well as roles, are defined
according to identified use cases. Future use cases may be considered during the maintenance of
the ISO 12812 series;
c) to identify existing standards on which mobile financial services should be based, as well as
possible gaps.
Standardization effort in this area is beneficial for a sound development of the mobile financial services
market because it will:
— facilitate and promote interoperability between the different components or functions building
mobile financial services;
— build a safe environment so that consumers and merchants can trust the service and allow the
mobile financial service providers to manage their risks;
— promote consumer protection mechanisms including fair contract terms, rules on transparency of
charges, clarification of liability, complaints mechanisms and dispute resolution;
— enable the consumer to choose from different providers of devices or mobile financial services
including the possibility to contract with several mobile financial service prov
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.