News & Announcements
November 2020
App to App Redirection
Following the launch of the new Bank of Ireland mobile banking app, customers can now authenticate for Open Banking using new App to App and Browser to App Redirection.
Further details as well as FAQs can be found in the Open Banking Enhancements PDF download here.
eIDAS and OB certs, and the impact of Brexit
Following announcements from the EBA and FCA, Bank of Ireland is providing the following guidance to TPPs in the event of a hard Brexit.
- BOI (Republic of Ireland) will continue to only accept eIDAS certificates for the purposes of identification. As per the current EBA guidance (subject to the ongoing political process), only TPPs authorised in the EU will be permitted access
- BOI (United Kingdom) will follow the FCA guidance (upon its completion) and will continue to accept both Open Banking and eIDAS certificates. We note that eIDAS certificates issued to UK-authorised TPPs are due to be revoked in the event of a hard Brexit
- TPPs who subsequently need to change certificates are advised that if this results in a change to the Distinguished Name (DN), they will have to re-register with a new client ID. This will invalidate all pre-existing long-lived consents. Further details on changing certificates is in the table below, and details on how to register through DCR are available on the BOI Developer Portal. NB. There is no need to re-register for certificate rotation when the DN does not change (e.g. certificate renewal)
We advise any TPPs thinking of onboarding with BOI to only use certificates which will be valid after 31 December, i.e. eIDAS with an EU authorisation for BOI ROI, and OB ETSI or Legacy for BOI UK.
| Source Cert | Target Cert | Rules | TPP re-registration & PSU re-auth required |
|---|---|---|---|
| eIDAS | eIDAS | DN will be the same upon renewal. There will be no need to re-register. The TPP simply uses their new cert as normal. | No |
| eIDAS | eIDAS (DN Change) | If DN has changed since the last cert was issued, either by the same QTSP or by the TPP moving to a new QTSP. TPPs will need to re-register a new client id with Bank of Ireland. This will also invalidate all pre-existing long lived consents. | Yes |
| eIDAS | OB Legacy | DN will be different. TPPs will need to re-register a new client id with Bank of Ireland. This will also invalidate all pre-existing long lived consents. | Yes |
| eIDAS | OB ETSI | DN will be different. TPPs will need to re-register a new client id with Bank of Ireland. This will also invalidate all pre-existing long lived consents. | Yes |
| OB Legacy | eIDAS | DN will be different. TPPs will need to re-register a new client id with Bank of Ireland. This will also invalidate all pre-existing long lived consents. | Yes |
| OB Legacy | OB ETSI | DN will be different. TPPs will need to re-register a new client id with Bank of Ireland. This will also invalidate all pre-existing long lived consents. | Yes |
| OB Legacy | OB Legacy | DN will be the same upon renewal. There will be no need to re-register. The TPP simply uses their new cert as normal. | No |
| OB ETSI | OB Legacy | DN will be different. TPPs will need to re-register a new client id with Bank of Ireland. This will also invalidate all pre-existing long lived consents. | Yes |
| OB ETSI | eIDAS | DN will be different. TPPs will need to re-register a new client id with Bank of Ireland. This will also invalidate all pre-existing long lived consents. | Yes |
| OB ETSI | OB ETSI | DN will be the same upon renewal. There will be no need to re-register. The TPP simply uses their new cert as normal. | No |
Support for consumer credit cards (UK only)
Following the sale of the Bank of Ireland UK consumer credit card portfolio, these accounts will no longer be available for access through Open Banking through Bank of Ireland. Jaja Finance are now fully responsible for all regulatory commitments, including access to accounts for PSD2.