> For the complete documentation index, see [llms.txt](https://doc.api.tieto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.api.tieto.com/solutions-and-use-cases/open-banking-and-compliance.md).

# Open Banking and compliance

Open Banking compliance is an operating capability, not just an API delivery project. The platform supports PSD2 today and prepares institutions for PSD3/PSR. It implements the Berlin Group framework and the UK Open Banking Limited (OBL) standard, with the regulatory APIs, security controls, evidence and reporting needed to operate reliably. Two deployment models are available:

* An ASPSP can operate its own compliant interface;
* A processing center, clearing house or central bank can operate one multi-tenant platform for many regulated institutions.

## ASPSP compliance on one platform

If you are a commercial bank preparing for PSD3/PSR, you can use the platform as your dedicated Open Banking interface. It publishes the required APIs, connects to your existing authentication and core-banking services, and manages third-party access through a controlled gateway.

The platform supports the operational controls that make compliance sustainable:

* **Fully compliant APIs.** Regulatory APIs exposed by the platform are based on NextGenPSD2 XS2A Framework which makes them fully compliant with PSD2 and emerging PSD3/PSR. The Platform can also expose APIs compliant with UK Open Banking Limited (OBL).
* **Secure third-party access.** Validate certificates, enforce mutual TLS and signatures, and verify regulatory roles against national registers.
* **Consent and SCA orchestration.** Use the Bank Administration Portal to manage consent records. Connect redirect, decoupled, embedded and corporate authorization journeys to the bank's existing identity and authorization services.
* **Regulatory statistics.** Meet the PSD2 and RTS SCA obligation to publish dedicated-interface availability and performance statistics. The XS2A Performance dashboard calculates the required metrics and publishes them in the Developer Portal — we have you covered.

The bank keeps ownership of its customer data, policies and operational decisions. The platform supplies the reusable Open Banking control plane around its existing systems.

## Shared compliance infrastructure

If you are a processing center, a clearing house or a central bank, you can leverage our Platform to offer a shared compliance service to participating institutions in your region. You run the Platform, and each participating ASPSP receives an isolated tenant with its own data, administrators, consents, policies and reports.

This model removes duplicated platform operations across the market. The operator maintains common standards, security policies and regulatory API products. Each institution retains its own regulatory identity, customer journeys and third-party relationships.

The platform supports two ways to expose shared infrastructure:

* **Separated multi-tenancy** gives every institution its own branded Developer Portal and documentation. Third parties register and subscribe with each institution independently.
* **Marketplace** provides one shared Developer Portal. Third parties register once, then subscribe to the institutions they need.

Both models support centrally managed regulatory APIs.

## Relevant features

<table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td>Run isolated bank tenants on shared infrastructure, with separate data, administration and branding. This supports market-wide compliance services without weakening institutional independence.</td><td><a href="/features/multi-tenancy-and-white-labeling.md">Multi-Tenancy and White-Labeling</a></td></tr><tr><td>Apply role-based access, multi-factor authentication and separation of duties across operational portals. These controls protect regulated administration and create accountable change processes.</td><td><a href="/features/access-control.md">Access Control</a></td></tr><tr><td>Adapt API products, consent rules and operational content for each market. This keeps a shared platform aligned with local regulatory and payment requirements.</td><td><a href="/features/localization-and-regional-adaptation.md">Localization and Regional Adaptation</a></td></tr><tr><td>Measure availability, performance and API activity continuously. Generate the evidence and metrics required for regulatory oversight and dedicated-interface reporting.</td><td><a href="/features/monitoring-and-reporting.md">Monitoring and Reporting</a></td></tr><tr><td>Validate third-party providers against national registers on every call. This enforces current regulatory authorization across each institution and market.</td><td><a href="/features/integration-with-national-registers.md">Integration with National Registers</a></td></tr><tr><td>Store, track and revoke account-access, payment and funds-confirmation consents throughout their lifecycle. This provides the customer authorization record required for secure third-party access.</td><td><a href="/features/consent-management.md">Consent Management</a></td></tr><tr><td>Manage customer-owned portal content, review changes and publish service notices. This keeps compliance communications current across shared and institution-specific channels.</td><td><a href="/features/content-management.md">Content Management</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://doc.api.tieto.com/solutions-and-use-cases/open-banking-and-compliance.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.