Confirmation of Payee — Requirements v2.12 min read
The User Journeys for this service also apply and must be adhered to.
The tables below list the validation rules that apply to Confirmation of Payee. The Validated by column indicates where each rule is enforced. All requests require an active Trust Framework application with the BSIP role, a valid transport certificate presented on every request via mTLS, and an active signing key for JWT signing.
Mandatory CoP Requirement
For all Open Finance account-to-account transfers where the creditor is unknown to the TPP — for example, entered by the customer at the time of payment — a Confirmation of Payee request must be made prior to consent creation, provided the receiving bank supports the CoP service. A creditor is considered unknown when the TPP does not already hold a verified record of the payee (for example, a pre-enrolled beneficiary confirmed by a prior successful CoP check). Where CoP has been performed, the full raw JWS response from the /confirmation endpoint must be included in the ConfirmationOfPayeeResponse field of the creditor entry in the payment consent PII.
Payee Discovery
/discoveryAuthorizationclient_credentials grant with the confirmation-of-payee scope.Content-Type: application/jwt).message.Data.Identification/discovery OpenAPI schema. No additional or undocumented parameters are permitted.x-fapi-interaction-idName Match
/confirmationAuthorizationclient_credentials grant with the confirmation-of-payee scope.Content-Type: application/jwt).message.Data.IdentificationConfirmationOfPayeeResponse in PII/confirmation must be included in the ConfirmationOfPayeeResponse field of the creditor entry in the payment consent PII./confirmation OpenAPI schema. No additional or undocumented parameters are permitted.204 with no body.Suspended), the response will be 403 with errorCode: Consent.AccountTemporarilyBlocked and errorMessage: The account is blocked from receiving payments. If the account is blocked permanently (e.g. account status is Closed, Deceased, or Unclaimed), the response will be 403 with errorCode: Consent.PermanentAccountAccessFailure and errorMessage: The account is blocked from receiving payments.x-fapi-interaction-id