<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Thanks Dave and Ralph<br>
</p>
<p><br>
</p>
<p>Tom, I too would like to understand more about your concerns. We are committed to ensuring that the OB standards do exactly as Dave suggests - to protect the end user/customer - and we have been working with OIDF with exactly this goal.<br>
</p>
<p><br>
</p>
<p>Maybe the four of us can meet/talk to discuss in more details.<br>
</p>
<p><br>
</p>
<p>When is good for you next week?<br>
</p>
<p><br>
</p>
<p>Thanks<br>
</p>
<div id="Signature">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<p style="font-size:16px"><strong><br>
</strong></p>
<p style="font-size:16px"><strong>Chris Michael</strong><br>
</p>
<p style="font-size:16px">Head of Technology<br>
</p>
<p style="font-size:16px">Open Banking<br>
</p>
<p style="font-size:16px">+44 7767 372277<br>
</p>
<p style="font-size:16px"><a tabindex="0" href="http://www.openbanking.org.uk/" target="_blank" id="NoLP">http://www.openbanking.org.uk</a></p>
</div>
</div>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Openid-specs-fapi <openid-specs-fapi-bounces@lists.openid.net> on behalf of Dave Tonge via Openid-specs-fapi <openid-specs-fapi@lists.openid.net><br>
<b>Sent:</b> 16 August 2018 11:59<br>
<b>To:</b> Openid-specs Fapi<br>
<b>Cc:</b> Dave Tonge<br>
<b>Subject:</b> Re: [Openid-specs-fapi] i wish to resign from FAPI</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Hi Tom,</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">I'm sorry to hear about your wish to 'resign' and note your concerns.</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">As Ralph said it would be great to try and work through the issues you have as I can assure you that OpenBanking UK has absolutely no desire to put the user at risk - indeed safeguarding
the user is very important to OpenBanking UK and there are consumer representatives on the steering committee who play an active role in championing user's rights and protections.</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">From a user protection perspective PSD2 is quite helpful:</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"> - If a user disputes a payment, the ASPSP (bank) has to refund the user within 24 hours</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"> - The ASPSP then needs to investigate and may ask the PSIP for evidence of consent</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"> - If the ASPSP is not satisfied it can recover the money from the PISP (the PISP must have adequate insurance to cover this)</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"> - If the ASPSP is satisfied with the consent evidence provided by the PISP AND they are satisfied with how they (the ASPSP) applied "Strong Customer Authentication" (i.e. 2FA) then they
can dispute the users claim and take the money back from them.</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Its worth noting that because of the redirect model that OB uses this is not that different from if a user disputes a payment made via online banking. In both cases the bank will have records
of how they have applied authentication, and the text that the user approved when confirming the transaction.</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">In your first email you seem to assume that the user is not involved in authenticating with the bank and confirming transactions initiated by a dubious PISP from Malta, but this is not the
case. The user will have to strongly authenticate to their bank AND (in the OB model) confirm the transaction they are making. If the user is tricked by a dubious PISP they have full recourse to their bank to get a refund. </div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">From an AML perspective, ASPSPs have a duty to apply the same checks on a transaction that a user "initiates" from their online banking platform as one that a user "initiates" via a PISP. </div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">With regards to some of your comments on the PDF:</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"> - there is no requirement for a TPP to identify or authenticate a user to any level of assurance. Indeed for payments in an e-commerce model a TPP may simply have a record of a user, using
a browser, on an IP address who ordered an item and selected to pay with Bank X (but no nothing else about the user). If the payment is later disputed the TPP can provide evidence of the transaction in the same manner that a merchant deals with card charge
backs. I agree with you that this "evidence" would be weak and this is why the OB model explicitly redirects the user to the bank where strong authentication can take place AND the user can confirm the amount and payee. In other PSD2 standards such as the
Berlin Group embedded mode this is a much greater problem as the ASPSP has no interaction with the user at all.</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"> - partial consent - while possible in OAuth 2, this is not allowed by OpenBanking UK. It is either accept all or deny.</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Finally I'd like to stress again that OpenBanking UK is very separate from the FAPI WG at OIDF. There are multiple standards bodies, industry initiatives and vendors that are implementing
FAPI as a secure profile of OAuth 2; OpenBanking UK is just one of those.</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">I hope this helps and thank you for continuing to push us to consider the protection of the user as we develop these standards.</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Dave</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Thu, 16 Aug 2018 at 10:32, Tom Jones via Openid-specs-fapi <<a href="mailto:openid-specs-fapi@lists.openid.net" target="_blank">openid-specs-fapi@lists.openid.net</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">Well, i have spent as much time reviewing and annotating the attached document as i am will to do pro bono.
<div>What I don't see is any reason for the user to trust the flow shown.</div>
<div>So is the net result a debit against the user's account that is the user's liability?</div>
<div>And does the user have the responsibility to prove that the charge was not authorized by them?</div>
<div><br>
</div>
<div>This is not a service that i personally would be willing to use with a US bank.</div>
<div>Here is the site where i record by own thought on user consent: <a href="http://tcwiki.azurewebsites.net/index.php?title=User_Consent#Full_Title_or_Meme" target="_blank">http://tcwiki.azurewebsites.net/index.php?title=User_Consent#Full_Title_or_Meme</a></div>
<div>i am also working with the Kantara CIS group and Mark Lizar by building an OP that uses consent and show some results here:
<a href="http://tcwiki.azurewebsites.net/index.php?title=Consent_Receipt_Construction" target="_blank">
tcwiki.azurewebsites.net/index.php?title=Consent_Receipt_Construction</a></div>
<div><br>
</div>
<div><br>
</div>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div class="m_-8559208860832994185m_2355318165777347081m_-584231779411524940m_3878145780121875545gmail_signature">
<div dir="ltr">
<div>Peace ..tom</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">On Wed, Aug 15, 2018 at 10:56 AM, Ralph Bragg <span dir="ltr">
<<a href="mailto:ralph.bragg@raidiam.com" target="_blank">ralph.bragg@raidiam.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div>
<div>
<div style="direction:ltr">
<div>Hi Tom,</div>
<div style="direction:ltr"><br>
</div>
<div style="direction:ltr">I’m personally really interested in the concerns you’ve raised especially when it comes to the OB part. </div>
<div style="direction:ltr"><br>
</div>
<div style="direction:ltr">This (below) is the consent guidelines that the OBIE currently have published with an update in train.</div>
<div style="direction:ltr"><br>
</div>
<div style="direction:ltr">OB would be really interested in your feedback and comments.</div>
<div style="direction:ltr"><br>
</div>
<div style="direction:ltr">Kind regards,</div>
<div style="direction:ltr"><br>
</div>
<div style="direction:ltr"><a href="https://www.openbanking.org.uk/wp-content/uploads/Consent-Model-Part-1-Implementation-Guide.pdf" target="_blank">https://www.openbanking.org.uk/wp-content/uploads/Consent-Model-Part-1-Implementation-Guide.pdf</a></div>
<div style="direction:ltr"><br>
</div>
<div style="direction:ltr"><br>
</div>
<div><br>
</div>
<div class="m_-8559208860832994185m_2355318165777347081m_-584231779411524940m_3878145780121875545m_-5035734763785135446ms-outlook-ios-signature">
</div>
</div>
<div> </div>
<hr style="display:inline-block; width:98%">
<div id="m_-8559208860832994185m_2355318165777347081m_-584231779411524940m_3878145780121875545m_-5035734763785135446divRplyFwdMsg" dir="dir="ltr"">
<font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> 32022724200n behalf of
<br>
<b>Sent:</b> Wednesday, August 15, 2018 16:55<br>
<b>To:</b> Financial API Working Group List<br>
<b>Cc:</b> Tom Jones<br>
<b>Subject:</b> [Openid-specs-fapi] i wish to resign from FAPI
<div> </div>
</font></div>
<div>
<div class="m_-8559208860832994185m_2355318165777347081m_-584231779411524940m_3878145780121875545h5">
<div dir="ltr">Please remove my name from the mailing list and from all future documentation produced by the wg.
<div><br>
</div>
<div>If you care to know why; i thought i would list my reasons (these just relate to the FAPI part):</div>
<div>1. FAPI is being used by the UK OB & PSD2 folk as proof of security compliance but that only applies to the connection between the ASPSP and TPP, the user is not involved.</div>
<div>2. Since this is the Open ID foundation, i believe it is not part of our work to consider any standard where the user is not identified.</div>
<div>3. We have no input on user consent to the process.</div>
<div><br>
</div>
<div>I also have concerns about the damage that will be reflected on the OpenID foundation by association with a group that appears to have no interests in the user or the financial and time loss to the user that will (IMHO) result from user unhappiness with
the way that their private data and actual assets are put on display without their explicit consent. It seems that the ASPSP has no choice but to accept a payment request initiated by any entity approved by any member state including Malta (with known tolerance
for Russian oligarchs) or the channel islands which have been used by UK banks to avoid money laundering regulations. I do understand that they can refuse the request, but that action can be challenged by any TPP, which is certain to wear down their fiduciary
duty to their users. The OP in the cases i have seen is not defined, so the threats cannot be fully known.</div>
<div><br clear="all">
<div>
<div class="m_-8559208860832994185m_2355318165777347081m_-584231779411524940m_3878145780121875545m_-5035734763785135446gmail_signature">
<div dir="ltr">
<div>Peace ..tom</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
_______________________________________________<br>
Openid-specs-fapi mailing list<br>
<a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank">Openid-specs-fapi@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-fapi</a><br>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr" class="m_-8559208860832994185m_2355318165777347081m_-584231779411524940gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div style="font-size:1em; font-weight:bold; line-height:1.4">
<div style="color:rgb(97,97,97); font-family:'Open Sans'; font-size:14px; font-weight:normal; line-height:21px">
<div style="font-family:Arial,Helvetica,sans-serif; font-size:0.925em; line-height:1.4; color:rgb(220,41,30); font-weight:bold">
<div style="font-size:14px; font-weight:normal; color:rgb(51,51,51); font-family:lato,"open sans",arial,sans-serif; line-height:normal">
<div style="color:rgb(0,164,183); font-weight:bold; font-size:1em; line-height:1.4">
<div style="font-weight:400; color:rgb(51,51,51); line-height:normal">
<div style="color:rgb(0,164,183); font-weight:bold; font-size:1em; line-height:1.4">
Dave Tonge</div>
<div style="font-size:0.8125em; line-height:1.4">CTO</div>
<div style="font-size:0.8125em; line-height:1.4; margin:0px"><a href="http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A" target="_blank" style="color:rgb(131,94,165)"><img alt="Moneyhub Enterprise" height="50" title="Moneyhub Enterprise" width="200" style="border:none; padding:0px; margin:7px" src="http://content.moneyhub.co.uk/images/teal_Moneyhub-Ent_logo_200x50.png"></a></div>
<div style="padding:8px 0px">
<div style="padding:8px 0px"><span style="color:rgb(0,164,183); font-size:11px">Moneyhub Financial Technology, 2nd Floor, Whitefriars Business Centre, Lewins Mead, Bristol, BS1 2NT</span></div>
<span style="font-size:11px; line-height:15.925px; color:rgb(0,164,183); font-weight:bold"></span></div>
<span style="font-size:11px; line-height:15.925px; color:rgb(0,164,183); font-weight:bold">t: </span><span style="font-size:11px; line-height:15.925px">+44 (0)117 280 5120</span><br>
</div>
<div style="font-weight:400; color:rgb(97,97,97)"><font color="#00a4b7"><span style="font-size:11px; line-height:15.925px"><br>
</span></font>
<div style="color:rgb(51,51,51); line-height:1.4"><span style="font-size:0.75em">Moneyhub Enterprise is a trading style of Moneyhub Financial Technology Limited which is authorised and regulated by the Financial Conduct Authority ("FCA"). </span><span style="font-size:10.5px">Moneyhub</span><span style="font-size:0.75em"> Financial
Technology is entered on the Financial Services Register </span><span style="font-size:0.75em; background-color:transparent">(FRN </span><span style="font-size:0.75em; background-color:transparent; color:rgb(0,164,183); font-weight:bold">561538</span><span style="font-size:0.75em; background-color:transparent">)
at <a href="http://fca.org.uk/register" target="_blank">fca.org.uk/register</a>. </span><span style="font-size:10.5px">Moneyhub</span><span style="font-size:0.75em; background-color:transparent"> Financial Technology is registered in England & Wales, company
registration number </span><span style="font-size:0.75em; color:rgb(0,164,183); font-weight:bold; background-color:transparent">06909772</span><span style="font-size:0.75em; background-color:transparent"> </span><span style="color:rgb(34,34,34); font-family:arial,sans-serif; background-color:transparent"><font size="1">©</font></span><span style="font-size:0.75em; background-color:transparent"> . </span><span style="font-size:10.5px">Moneyhub</span><span style="background-color:transparent; font-size:0.75em"> Financial
Technology Limited 2018. </span><span style="background-color:transparent; font-size:0.75em; color:rgb(136,136,136)">DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or
of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and
emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of
Momentum Financial Technology Limited or of any other group company.</span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br clear="both">
Please consider the environment before printing this email.<BR>
<BR>
This email is from Open Banking Limited, Company Number 10440081. Our registered and postal address is 2 Thomas More Square, London, E1W 1YN. Any views or opinions are solely those of the author and do not necessarily represent those of Open Banking Limited. <BR>
<BR>
This email and any attachments are confidential and are intended for the above named only. They may also be legally privileged or covered by other legal rights and rules. Unauthorised dissemination or copying of this email and any attachments, and any use or disclosure of them, is strictly prohibited and may be illegal. If you have received them in error, please delete them and all copies from your system and notify the sender immediately by return email. You can also view our privacy policy (https://www.openbanking.org.uk/privacy-policy).<BR>
</body>
</html>