CFP Open Banking & API Integration 2 — Questions and Answers
Question 1: Why is 'screen scraping' controversial in the context of financial data access?
- It requires customers to pay additional fees to access their own data
- It accesses bank portals by simulating user logins, bypassing security controls and posing data privacy risks (Correct answer)
- It violates copyright law by copying bank website content
- It generates excessive API traffic that overloads bank servers
Correct answer: It accesses bank portals by simulating user logins, bypassing security controls and posing data privacy risks
Screen scraping accesses financial data by mimicking user credentials on bank portals, bypassing official APIs and security controls, which creates significant data privacy and security risks.
Question 2: What is the Financial Data Exchange (FDX) in the context of US open banking?
- A federal agency established by the CFPB to regulate financial data sharing
- An industry-led nonprofit consortium that develops standardized APIs for secure financial data sharing (Correct answer)
- A cryptocurrency exchange platform regulated by FinCEN
- A mandatory clearinghouse for financial data established under Dodd-Frank
Correct answer: An industry-led nonprofit consortium that develops standardized APIs for secure financial data sharing
FDX is a nonprofit, industry-led consortium that develops and promotes standardized, secure APIs (based on the FDX API standard) to enable financial data sharing in the US without relying on screen scraping.
Question 3: Which security protocol is required to protect data in transit between open banking APIs and third-party providers?
- SSL 2.0 for legacy bank system compatibility
- TLS 1.2 or higher (preferably TLS 1.3) (Correct answer)
- SSH tunneling for all API connections
- IPSec for network-layer encryption
Correct answer: TLS 1.2 or higher (preferably TLS 1.3)
TLS 1.2 or higher (with TLS 1.3 preferred) is required to encrypt data in transit between open banking APIs and third-party applications, ensuring confidentiality and integrity of financial data.
Question 4: In open banking, what is the purpose of a 'sandbox environment' provided by banks or open banking platforms?
- A restricted bank branch for piloting new financial products with select customers
- A testing environment where developers can integrate and validate APIs using mock data without accessing real customer accounts (Correct answer)
- A secure credential vault for storing API keys and OAuth tokens
- A compliance review portal for submitting fintech application approvals
Correct answer: A testing environment where developers can integrate and validate APIs using mock data without accessing real customer accounts
A sandbox environment provides developers with an isolated, safe testing space using mock data, allowing them to build and validate API integrations before accessing live production systems with real customer data.
Question 5: What is 'Banking as a Service' (BaaS) and how does it leverage open banking principles?
- A premium service where banks manage investments on behalf of high-net-worth clients
- A model where banks expose their regulated infrastructure and financial services via APIs to enable non-bank businesses to embed banking capabilities (Correct answer)
- A government-mandated service providing free banking access to underserved populations
- A cloud-based service for banks to migrate their core systems to modern infrastructure
Correct answer: A model where banks expose their regulated infrastructure and financial services via APIs to enable non-bank businesses to embed banking capabilities
BaaS enables non-bank companies (e.g., fintechs, retailers) to embed banking services like accounts, payments, and lending into their own products by accessing bank infrastructure through APIs, extending open banking to full-service provision.
Question 6: Which of the following best describes 'tokenization' as applied in open banking security?
- Converting cryptocurrency holdings to equivalent fiat currency values
- Replacing sensitive financial data with non-sensitive surrogate tokens that map back to the original data in a secure vault (Correct answer)
- Generating time-limited one-time passwords for API endpoint authentication
- Encrypting API request payloads using asymmetric public-key cryptography
Correct answer: Replacing sensitive financial data with non-sensitive surrogate tokens that map back to the original data in a secure vault
Tokenization replaces sensitive data such as account numbers or card details with unique, non-sensitive tokens, reducing exposure of sensitive financial data while preserving system functionality.
Question 7: What does 'Strong Customer Authentication' (SCA) require under PSD2?
- Passwords of at least 16 characters with special characters for all online banking logins
- Authentication using at least two independent factors from knowledge, possession, and inherence categories (Correct answer)
- Biometric-only authentication for all payment transactions above €30
- Annual re-verification of customer identity by the account-holding bank
Correct answer: Authentication using at least two independent factors from knowledge, possession, and inherence categories
SCA under PSD2 mandates multi-factor authentication using at least two of three factor types—knowledge (PIN/password), possession (device/token), and inherence (biometrics)—to enhance the security of electronic payments.
CFP Open Banking & API Integration 2
Why is 'screen scraping' controversial in the context of financial data access?