QWAC Assessor

Handy solution to check TPP certificates offline

The challenge

To meet PSD2 security requirements, banks and TPP account information service providers make use of qualified website authentication certificates (QWAC) and electronic seals (QSealC) which authorise them to access sensitive customer data legitimately.

Given that different entities confirm their identity and authorisation and that a certificates’ validity has to be regularly updated in a bank’s system, there is the risk that while a bank has correctly identified a TPP, the authorisation for certain services is no longer up to date.

Therefore, there has to be a two-part check process for every inquiry.  This avoids any risk of unauthorised access and the related disclosure of confidential information as well as unauthorised payments being made.

So, how can you check a TPP certificate and ensure that its identity matches the request made by the TPP?

The solution

Our QWAC Assessor can run this test offline for you.

Run either as a stand-alone web service or as part of an API gateway, QWAC Assessor confirms the identity and function (AIS, PIS, PIIS) of the TPP and validates the request while encrypting and checking confidential data.

We provide a framework for updating the data that is imported into QWAC Assessor. Only once the data is confirmed the TPP receives the X2SA access they’ve requested.

The benefits

  • Offline TPP checks without any timeouts
  • Identity and authentication checks for PISP, AISP or PIISP
  • Available as a stand-alone service or an integrated solution into a API gateway
adorsys-QWAC-Assessor-infographic Created with Sketch. TPP API Gateway XS2A Interface Request Check Bank API Gateway XS2A Interface Bank TPP API Gateway XS2A Interface Bank TPP Library Proxy Standalone As a standalone server that receives requests from both TPP and XS2A Interface As a proxy server between TPP and XS2A Interface As a library that is integrated in a bank`s application

For more information, please contact

Andre Achtstaetter adorsys

Andre Achtstaetter