FDX API Overview (Dinesh).pdf
- 1. The Industry Standard for Consumer Access to Financial Records FDX API and Security Overview Dinesh Katyal – 7/20/20
- 2. The Industry Standard for Consumer Access to Financial Records FDX Confidential. All rights reserved. Agenda 2 Organization Overview The FDX API Portfolio - FDX API 4.1 - Control Consideration for Consumer Financial Account Aggregation 3.1 - User Experience Guidelines – Account Information 1.0 - Use Cases Q & A
- 3. The Industry Standard for Consumer Access to Financial Records FDX Confidential. All rights reserved. Mission 3 The Financial Data Exchange (FDX) mission is to promote and enhance a common interoperable standard and operating framework to efficiently and securely share consumer and business financial data. FDX operates as an independent subsidiary of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and took up the work of the FS-ISAC Aggregation Working Group. FDX launched on 18 October 2018.
- 4. Financial Data Exchange (FDX) The current Board comprises 11 Financial Institutions, 5 Permissioned Parties, 5 Aggregators, 2 Industry Groups & the FS-ISAC. The Industry Standard for Consumer Access to Financial Records Open Membership | ¼ of members are Fin-Tech firms | 2/3 are not banks | FDX is not a policy or lobbying group. 118 Member Organizations
- 5. The Industry Standard for Consumer Access to Financial Records FDX Confidential. All rights reserved.
- 6. The Industry Standard for Consumer Access to Financial Records FDX Technical Organization Security & Authentication User Experience & Consent API / Data Structures Qualification & Certification OFX Working Groups Every Working Group, Committee and the Board are co-chaired by a Financial Institution and a Non-Financial Institution Technology Review Committee E2E Encryption Task Forces Cert Model Directory Tax Forms Intermediary ID UX Guidelines Taxonomy Money Movement FDX Staff Director Product +
- 7. The Industry Standard for Consumer Access to Financial Records FDX Confidential. All rights reserved. FDX API 7 • Secure authentication - Tokenized access to data - No login credentials used/ held by aggregator/ apps • Authorization and consent standard - Owner approves what is shared, its use, and duration - UX guidelines 1.0 will cover consent for account information services • API specification - Replaces screen scraping - JSON/ REST - Comprehensive coverage of account information services and tax forms (US) - Free to access and royalty free to use
- 8. The Industry Standard for Consumer Access to Financial Records FDX Confidential. All rights reserved. Supported Accounts and Documents ■ Deposit: ■ Lines of Credit: Checking (DDA) Credit Cards Savings LOC (retail) Money Market Accounts LOC (Commercial) Time Deposits (CD) HELOC Other Other ■ Loans: ■ Investments Loans (Installment) IRA Mortgages TAXABLE Loans (Commercial) TRUST Other Other ■ Insurance: ■ Annuities: ● Statements ● Tax Documents: US Tax Forms ● Images (receipts or check images)
- 9. The Industry Standard for Consumer Access to Financial Records • FALL 2020 Release Timeline • Sep 7 – RFC cutoff for release inclusion • Sep 21: • Spec 4.2 (tax ‘20) – 14-day member notice • Spec 4.5 (non-tax RFCs) – WG notification • Oct 5 (60 days prior) – • Spec 4.2 (tax ‘20) - GA • Spec 4.5 (non-tax RFCs) – 60-day member notice • Dec 3 – Spec 4.5 GA Note: Tax and non-tax will be aligned from Fall 2021 onwards shifting general release schedule up by 2 months Release Calendar
- 10. The Industry Standard for Consumer Access to Financial Records FDX Confidential. All rights reserved. Control Considerations 10 • Conceptual security architecture stack - Federated user authentication interoperability with OpenID Connect 1.0 - Delegated user authorization using OAuth 2.0 - Specific user identification pattern using FIDO 1.2 UAF • Communication; - TLS for all communications - NIST recommended encryption algorithms - Recommended key lengths and host name verification enabled • API Security Profile - Normative references to FAPI part 1 – read only security profile - FAPI part 2 – read-write security profile OAuth 2.0
- 11. The Industry Standard for Consumer Access to Financial Records FDX Confidential. All rights reserved. Questions