PSD2 certificates: QWAC and QSealC

When an account information or payment initiation provider calls a bank's interface, the bank has to know that the caller holds a license and which services it covers. Article 34 of the regulatory technical standards on strong customer authentication and secure communication, Delegated Regulation (EU) 2018/389, settles this: payment service providers identify themselves with qualified certificates for electronic seals or for website authentication under the eIDAS regulation.

The certificate carries the provider's authorization number, the name of the supervisor that granted it, such as BaFin in Germany, and the provider's PSD2 roles: account servicing, payment initiation, account information, or issuing of card-based payment instruments. A bank can read from one certificate whether the caller may start a payment or only read data. The open banking TPP page covers the providers themselves.

A QWAC, a qualified website authentication certificate, is a TLS certificate. The provider presents it when it opens the connection, and both sides authenticate each other before any data flows. A QSealC, a qualified electronic seal certificate, seals the request itself, so the bank can check the origin and integrity of each message, also after it has been stored or passed on.

The EBA opinion on the use of eIDAS certificates leaves the choice between them to the bank, which provides the interface, and recommends using both in parallel. When an agent or a technical service provider calls the API on behalf of a provider, the certificate has to identify the licensed provider behind it.

Only a qualified trust service provider on an EU trusted list may issue PSD2 certificates, and it has to be audited against ETSI TS 119 495, the standard that defines the PSD2 fields. Issuance takes a signed application by the legal representative, the authorization number from the supervisor and, for a QWAC, proof of control of the domain, as one issuer, TBS Certificates, describes its process.

A QSealC creates qualified seals only when its key sits in a qualified signature creation device. PSD2 does not require qualified seals, so an advanced seal from the same certificate is enough. How eIDAS 2 changes the rules for website certificates is on eIDAS 2 and finance.

Finance Loop is the meeting place for the people who build and secure open banking interfaces in Germany, Austria and Switzerland: bank API teams, account information and payment initiation providers and the security staff around them. It connects the finance, IT and AI communities, with events in Frankfurt, Munich, Berlin and Hamburg.

Finance Loop is a strategic partner of the Digital Euro Association, whose Digital Euro Conference in Frankfurt covers digital money infrastructure next to open banking.

A PSD2 certificate is a qualified eIDAS certificate with extra PSD2 fields: the provider's authorization number, its supervisor and its licensed roles. A provider uses it to identify itself to a bank's open banking interface.

A QWAC secures and authenticates the connection, like a TLS certificate. A QSealC seals the data in each request, so its origin and integrity can be checked later. The EBA recommends using both.

Qualified trust service providers on the EU trusted lists, audited against ETSI TS 119 495. The provider needs its authorization from the national supervisor before the certificate can be issued.