4 ms·
To connect directly to a European Bank's API you need to be PSD2 compliant, which costs about 100,000 EUR You need a partner who is PSD2 compliant. Nordigen is
by sjducb 4y ago
To connect directly to a European Bank's API you need to be PSD2 compliant, which costs about 100,000 EUR
You need a partner who is PSD2 compliant. Nordigen is the easiest to work with, but their API might not have all of the features you need.
If you only want to access your own accounts (not your clients accounts) then the rules might be different.
- petkeviciuz 4y agoClient I'm working with decided to use Nordigen for retrieval of customer bank statement. As I'm a developer who's implementing a solution, I can say that so far their API seems to work pretty nice and is well documented.
- sjducb 4y agoAgreed, nordigen is amazing. One of my companies uses it. However they don't implement the full PDS2 API. The OP might need features that Nordigen don't support.
- supermatt 4y agoit costs just the (nominal) registration fee per country if you are classed as a "small payment institution" (less than 3m EUR transactions monthly)
- sjducb 4y agoHow do you get classed as a "small payment institution" and what does that cost?
- supermatt 4y agoBy meeting the criteria as mentioned. Application/registration fee varies by jurisdiction. e.g. Its free in Spain, it costs 500 GBP in UK. Other countries are somewhere between the two. You can get more information from your local financial authority.
- hknmtt 4y agothat is complete bullshit. all you need is a QWAC PSD2 certificate which costs around 150€ per year.
- deleted 4y ago[deleted]
- sjaak 4y agoHe's right though, to acquire a cert that a bank will accept you need to be an AISP [0] or a PISP (or both) [1]. In other words: you need a license from a regulatory body of one of the PSD2 countries To talk to a bank's PSD2 API you often need /both/ a QWAC and a QSEALC cert. A QWAC cert is basically a normal TLS (client) cert with some PSD2 specific OIDs like the QC Statement (0.4.0.1862) [2] that a bank can use to identify who you are and which authority gave you a license (for AISP / PISP activities). The QSEALC is typically used to sign the http requests at the application level in the form of an extra http header (X-Signature or something similar). The above is all moot though, if you just want to do payouts I recommend you stay far away from PSD2 [0] Account Information Service Provider = AISP; Payment Initiation Service Provider = PISP [1] https://www.entrust.com/-/media/documentation/datasheets/qualified-website-certificates-ss.pdf?la=en&hash=8E4D55A8470C3769CB5A2E2AE5D69036 https://www.entrust.com/-/media/documentation/datasheets/qua... [2] see 5.1 in here https://www.etsi.org/deliver/etsi_ts/119400_119499/119495/01.06.01_60/ts_119495v010601p.pdf https://www.etsi.org/deliver/etsi_ts/119400_119499/119495/01...
- hknmtt 4y agoi was wrong. my bank's documentation did not include this crucial detail so i had the impression that, at leas my bank, allows anyone with verified ssl certificate to access the api(which is quite basic anyway).