CFP Open Banking & API Integration 1 — Questions and Answers
Question 1: Which regulatory framework mandates that banks open their APIs to third-party providers in the European Union?
- PSD2 (Payment Services Directive 2) (Correct answer)
- GDPR (General Data Protection Regulation)
- MiFID II (Markets in Financial Instruments Directive)
- Basel III Capital Framework
Correct answer: PSD2 (Payment Services Directive 2)
PSD2 is the EU regulation that requires banks to provide third-party providers with secure access to customer account data and payment initiation services via APIs.
Question 2: Which API architecture style is most widely adopted in open banking implementations?
- SOAP-based APIs using XML
- RESTful APIs using HTTP methods (Correct answer)
- GraphQL APIs with schema queries
- XML-RPC remote procedure calls
Correct answer: RESTful APIs using HTTP methods
RESTful APIs are the industry standard for open banking due to their simplicity, stateless design, scalability, and broad compatibility with web and mobile applications.
Question 3: What does 'AISP' stand for in the context of open banking?
- Automated Information Security Protocol
- Account Information Service Provider (Correct answer)
- API Integration Service Platform
- Authenticated Identity Service Provider
Correct answer: Account Information Service Provider
An AISP (Account Information Service Provider) is a third-party entity authorized under PSD2 to access and aggregate customer account information for services like personal finance management.
Question 4: Which US regulatory provision most closely parallels the EU's open banking mandate by establishing consumer financial data rights?
- Dodd-Frank Act Section 619
- CFPB Section 1033 Personal Financial Data Rights Rule (Correct answer)
- Gramm-Leach-Bliley Act Title V
- Sarbanes-Oxley Act Section 404
Correct answer: CFPB Section 1033 Personal Financial Data Rights Rule
CFPB Section 1033 establishes consumers' rights to access their financial data and share it with authorized third parties, serving as the primary US open banking framework.
Question 5: What is the primary role of a Payment Initiation Service Provider (PISP) in an open banking ecosystem?
- Providing identity verification and KYC services to banks
- Initiating payment transactions directly from a customer's bank account with their consent (Correct answer)
- Providing portfolio investment strategy recommendations
- Monitoring and auditing bank API performance metrics
Correct answer: Initiating payment transactions directly from a customer's bank account with their consent
A PISP can initiate payment transactions directly from a user's bank account with their explicit consent, enabling direct bank-to-bank payments without card networks.
Question 6: Which OAuth 2.0 flow is considered most appropriate for securing open banking API authentication for mobile and web applications?
- Client Credentials Flow for server-to-server auth
- Implicit Flow for browser-based clients
- Authorization Code Flow with PKCE (Correct answer)
- Resource Owner Password Credentials Flow
Correct answer: Authorization Code Flow with PKCE
The Authorization Code Flow with PKCE (Proof Key for Code Exchange) is recommended for open banking as it prevents authorization code interception attacks and is suitable for both server-side and public clients.
Question 7: What is the primary purpose of a 'consent framework' in open banking?
- To allow banks to share data between institutions without requiring customer approval
- To ensure customers explicitly authorize third parties to access their financial data with defined scope and duration (Correct answer)
- To enable automatic data aggregation across all linked financial accounts
- To standardize API rate limiting and throttling policies across all providers
Correct answer: To ensure customers explicitly authorize third parties to access their financial data with defined scope and duration
A consent framework ensures customers provide explicit, granular, and time-bound authorization before any third party can access their financial data, upholding data sovereignty and privacy rights.
CFP Open Banking & API Integration 1
Which regulatory framework mandates that banks open their APIs to third-party providers in the European Union?