| Expand | ||||
|---|---|---|---|---|
| ||||
|
...
The purpose of this open insurance functionality for motor insurance is to ensure customers receive comparable and personalised personalized insurance offerings. This can be done through:
...
By obtaining data about a customer pertaining to their past or current insurance policies, vehicle, customer profile, premiums and previous/pending claims, an insurance broker or insurance provider can provide the customer with a personalised personalized insurance quote. This insurance service request enables TPPs to retrieve a User’s data (with the User’s consent) held with a LFI. The TPP agrees the boundaries of the data sharing consent with the User, the TPP then sends this data sharing consent to the LFI, where it is approved by the User. TPPs are then further able to retrieve the status of the data sharing consent. This User journey requires a consent similar to that of an Account Access Consent.
...
| Panel | ||||||||
|---|---|---|---|---|---|---|---|---|
| ||||||||
User StoryAs a User (Consumer), I want to provide my consent to a TPP to retrieve data about my insurance policies, so that I can receive a personalised personalized retail motor insurance quote. |
...
# | Step | Rules & Guidelines |
MICS-1 | Initiate User Set-up (Conditional) | Depending on the use case, the User may have to be onboarded with the TPP by agreeing to any relevant terms and conditions (e.g. regarding sharing and storage of personal data) and setting up an account with them if required. TPPs MUST: 1.1 Provide the User with a Terms & Conditions, and Privacy Notice outlining applicable rights and responsibilities in the context of relevant regulation and legal principles. This may need to include any onward sharing of personal data, recipients or categories of recipients who receive that data, and the lawful basis for processing personal data as perhttps://openfinanceuae.atlassian.net/wiki/spaces/standardsv1rc1standardsv1dot1final/pages/121372984210796838/Consent+Setup#2.-Consent-Codification 1.2 Obtain the User's agreement to the above before setting them up and be able to request User consent as per the next step in the process 1.3 Provide an option to cancel the flow |
MICS-2 | Data Sharing Consent | Basic Consent Parameters TPPs MUST: 2.1 Request only data required to perform their service (or use case). 2.2 Use the data language standards to describe the data clusters and data permissions in user-facing interactions so that the User clearly understands the data that will be requested from their LFI to provide the service requested
2.3 Provide to User, the OFP and the LFI their trading/brand name clearly and the name of any other parties they are supporting (if applicable). 2.4 Allow the User to identify and select the LFIs for the Consent
|
Additional Consent Parameters TPPs MUST: 2.5 Set the Accepted Authorization Type (as per https://openfinanceuae.atlassian.net/wiki/spaces/standardsv1rc1standardsv1dot1final/pages/121375612210800446/Common+Rules+and+Guidelines#7.-Accepted-Authorization-Type). 2.6 Set the Authorization Time Window (as per https://openfinanceuae.atlassian.net/wiki/spaces/standardsv1rc1standardsv1dot1final/pages/121375612210800446/Common+Rules+and+Guidelines#8.-Authorization-Time-Window) if there are specific timing requirements that must be met for the Consent authorization. This is also relevant to cases where multiple authorizers are required to authorize the payment consent. 2.7 Obtain the Users' explicit consent to access information from insurance products held at LFIs (as perhttps://openfinanceuae.atlassian.net/wiki/spaces/standardsv1rc1standardsv1dot1final/pages/121372984210796838/Consent+Setup#2.1--Data-Sharing-Consent). | ||
MICS-3 | Consent Staging | As perhttps://openfinanceuae.atlassian.net/wiki/spaces/standardsv1rc1standardsv1dot1final/pages/121375612210800446/Common+Rules+and+Guidelines#10.-Consent-Staging |
MICS-4 | Hand-off to LFI | TPPs MUST: 4.1 Notify the User that they will be transferred to the selected LFI to undertake their authentication and consent Authorization (as perhttps://openfinanceuae.atlassian.net/wiki/spaces/standardsv1rc1standardsv1dot1final/pages/121375612210800446/Common+Rules+and+Guidelines#11.-Hand-off-to-LFI) |
MICS-5 | Authentication | LFIs MUST: 5.1 Enable Users to perform authentication with their LFIs, as per the following sections: 5.2 Re-direct Users back to the TPPs, with information that the Consent has not been authorized, if User Authentication has failed or Users opted to cancel the authentication/authorization process. |
MICS-6 | Disclosure Consent | LFIs MUST: 6.1 Enable Users to authenticate using Multi-Factor Authentication (MFA) in order to review and authorize the data sharing Consent. 6.2 Retrieve from the OFP the data sharing Consent details staged by the TPP using the unique Consent Identifier. 6.3 Display details of data that will be shared and for how long 6.4 Use the data language standards to describe data clusters and permissions in user-facing interactions so that the same information is displayed to the User |
MICS-7 | Confirmation/ Authorization | LFIs MUST: 7.1 Present to Users all the details in relation to data sharing Consent. 7.2 NOT allow Users to change any of the Consent parameters (e.g. permissions) staged by the TPP. 7.3 Request Users to authorize the data sharing Consent. 7.4 Enable Users to cancel the data sharing Consent request from within the authorization journey 7.5 Re-direct Users back to the TPPs, with information that the Consent has not been authorized, if Users opt to cancel the Consent authorization process before final authorization. 7.6 Check the Authorization Time window is valid as perhttps://openfinanceuae.atlassian.net/wiki/spaces/standardsv1rc1standardsv1dot1final/pages/121375612210800446/Common+Rules+and+Guidelines#20.-Check-Authorization-Time-Window 7.7 Change the state of the data sharing Consent from Awaiting Authorization to Authorized, when all Authorizers (one or more) have authorized the data sharing Consent. 7.8 Update the data sharing Consent details stored in the OFP with all the information included in the data sharing Consent authorized by the User. |
OFP MUST: 7.9 Confirm back to the LFIs that the data sharing Consent details have been updated successfully. | ||
Multi-Authorization Journey Only | ||
MICS-8 | Hand-off back to the TPP | As perhttps://openfinanceuae.atlassian.net/wiki/spaces/standardsv1rc1standardsv1dot1final/pages/121375612210800446/Common+Rules+and+Guidelines#14.-Hand-off-back-to-the-TPP |
MICS-9 | Confirmation to User | As perhttps://openfinanceuae.atlassian.net/wiki/spaces/standardsv1rc1standardsv1dot1final/pages/121375612210800446/Common+Rules+and+Guidelines#16.-Confirmation-to-User |
...
# | Step | Rules & Guidelines |
|---|---|---|
MISR-1 | Data Sharing Request | TPPs MUST: 1.1 Only request specific data in the scope of their service (or use case). 1.2 Only submit to OFP data sharing requests for the data clusters and permissions consented by the User as per the data sharing Consent authorized by the User. |
MISR-2 | Processing of Data Sharing Requests | OFP MUST: 2.1 Allow TPPs to submit data sharing requests in relation to a data sharing Consent authorized by Users, without any additional MFA or authorization by the Users. 2.2 Check that the received data sharing request relates to a valid data sharing Consent authorized by the User. The Consent MUST be in the Authorized state. The OFP MUST reject any data sharing requests related to a data sharing Consent in a different state (e.g. expired) and respond back to the TPP with the appropriate error message/code.
2.3 Reject the data sharing request and provide the necessary error message to the TPP, if any checks on the data sharing request fail against the authorized data sharing Consent.
2.4 Send the data sharing requests to the LFI for the data clusters and permissions consented by the User as per the data sharing Consent authorized by the User. |
LFIs MUST: 2.5 Allow the OFP to submit the data sharing requests without any additional MFA or authorization from the User. 2.6 Reject the data sharing request received by the OFP in case there are valid reasons for the data sharing Consent to be suspended as per https://openfinanceuae.atlassian.net/wiki/spaces/standardsv1rc1standardsv1dot1final/pages/121372984210796838/Consent+Setup#4.-Consent-States or due to any other BAU checks failure. 2.7 Share data requested by the OFP in relation to the authorized data sharing Consent.
| ||
OFP MUST: 2.8 Send an appropriate error response to the TPPs in case the data sharing request is rejected due to violating any of the LFIs BAU checks. 2.9 Provide the TPP with all the available data for the data clusters and permissions requested in relation to the data sharing Consent authorized by the User. |
...
If it should be mandatory for a user to share all available policies or if they can select specific policies
If consent should be single-use for quotes or if there is a valid use case for long-lived consent
How consent is affected when there are multiple drivers under a single policy
How to standardise standardize the request of quotes
7. Data Categories
...
Property | Description |
Basic Information | |
Customer ID | Depends on insurance company |
Customer Full Name | Free-form |
Customer Short Name | Free-form |
Category / Segment | Depends on insurance company |
Local Branch | Depends on insurance company |
Primary Language | English / Arabic / Other |
Billing Address | |
Address Line 1 | Free-form |
Address Line 2 | Free-form |
Address Line 3 | Free-form |
Postal Code | Only numeric answers allowed |
Country | Select from list |
State / Emirate | Select from list generated based on previous selection |
City | Select from list generated based on previous selection |
Permanent Address | |
Address Line 1 | Free-form |
Address Line 2 | Free-form |
Address Line 3 | Free-form |
Postal Code | Only numeric answers allowed |
Country | Select from list |
State / Emirate | Select from list generated based on previous selection |
City | Select from list generated based on previous selection |
Residential Address | |
Address Line 1 | Free-form |
Address Line 2 | Free-form |
Address Line 3 | Free-form |
Postal Code | Only numeric answers allowed |
Country | Select from list |
State / Emirate | Select from list generated based on previous selection |
City | Select from list generated based on previous selection |
Communication | |
Communication Type 1 | Home / Mobile / Other |
Communication Phone Number 1 | Area code selection option and 9-10 additional digits permissablepermissible |
Communication Type 2 | Home / Mobile / Other |
Communication Phone Number 2 | Area code selection option and 9-10 additional digits permissablepermissible |
Communication Type 3 | Home / Mobile / Other |
Communication Phone Number 3 | Area code selection option and 9-10 additional digits permissablepermissible |
Email ID | Must be a valid email address (i.e., include @ followed by domain) |
Alternate Email ID | Must be a valid email address (i.e., include @ followed by domain) |
Background and Family | |
Gender | Male/Female |
Date of Birth | dd/mm/yyyy |
Marital Status | Married/Single |
Education Background | High School/ Bachelor's/ Masters/ PhD/ Other |
Nationality | Select from list |
Dual Nationality | Yes / No |
Second Nationality (if applicable) | Select from list |
Salutation | Mr./ Ms./ Mrs./ Dr./ Other |
Country of Birth | Select from list |
City of Birth | Select from list generated based on previous selection |
Religion | Christian/ Muslim/ Jewish/ Hindu/ Buddhist/ Other |
Mother's Maiden Name | Free-form |
Spouse Name | Free-form |
Spouse Date of Birth | dd/mm/yyyy |
Spouse Employment Details | Employed/ Unemployed |
Spouse Phone Number | Area code selection option and 9-10 additional digits permissablepermissible |
Number of Children | Only numeric answers allowed |
Employment | |
Profession | Free-form |
Profession Description | Free-form |
Employer Name | Free-form (or company name in case of self-employment) |
Employer Address | Free-form (or company name in case of self-employment) |
Employment Type | Select from list of options (e.g., Employed, Self-Employed, Retired, Unemployed) |
Employment Location | Free-form |
Nature of Business | Select from list of categories (e.g., Law, Finance, Medicine) |
Designation | Free-form |
Source of Income | Free-form (e.g. salary / dividends from ownership) |
Income Currency | Select from a list of options (e.g., AED, USD, SAR) |
Montly Monthly Income | Only numeric answers allowed (in AED) |
Annual Income | Only numeric answers allowed (in AED) |
Employment Start Date | dd/mm/yyyy |
Identification | |
EID Number | Only 15 digits permissible |
EID Expiry Date | dd/mm/yyyy |
Passport Issue Country | Select from list |
Passport Number | Alphanumeric identifier |
Passport Issue Date | dd/mm/yyyy |
Passport Expiry Date | dd/mm/yyyy |
Visa Number | Only numeric answers allowed |
Visa Issue Country | Select from list |
Visa Issue Date | dd/mm/yyyy |
Visa Expiry Date | dd/mm/yyyy |
UAE Driving License Number | Only 7 digits permissible |
UAE Driving License Issue Date | dd/mm/yyyy |
UAE Driving License Issuing Emirate | Select from drop-down list (e.g., Dubai, Ajman, Abu Dhabi) |
Mulkiya Card | pdf attachment |
Home Country Driving License Number | Free-form |
Bank Information | |
Bank Account Number | Free-form (may vary by bank and country) |
IBAN | Free-form (may vary by bank and country) |
Swift Code | Free-form (may vary by bank and country) |
Name on Account | Free-form |
Bank Name | Free-form |
Home Branch | Free-form (may vary by bank and country) |
Type of Account | Free-form (may vary by bank and country) |
Emergency Contacts | |
Emergency Contact 1 Name | Free-form |
Emergency Contact 1 Relationship | Free-form |
Emergency Contact 1 Phone Number | Area code selection option and 9-10 additional digits permissablepermissible |
Emergency Contact 1 Email Address | Must be a valid email address (i.e., include @ followed by domain) |
Emergency Contact 2 Name | Free-form |
Emergency Contact 2 Relationship | Free-form |
Emergency Contact 2 Phone Number | Area code selection option and 9-10 additional digits permissablepermissible |
Emergency Contact 2 Email Address | Must be a valid email address (i.e., include @ followed by domain) |
...