LFIs MUST keep the Data Sharing and Service Initiation Consents separate to ensure clarity and prevent any misunderstandings by Users.

LFIs MUST provide Consent Management Interfaces (CMIs) with an Overview page displaying high-level details for all Consents and a Detailed page for each Consent.

LFIs MUST display the TPPs' trading name/brand name to Users. They MAY also display the registered company name of TPPs, if it is different.

LFIs MUST provide Users with comprehensive information to help them make informed decisions on the Consent Management Interface (CMI) Overview page. As a minimum, LFIs MUST display:

Consent Summary:

• Consent State (“Awaiting", "Authorized", "Rejected", "Canceled", "Finished")

• Service Provider Name (i.e. the TPP trading name)

• Account type and the last 4 digits of account number

• The expiry date for when the Consent will end (Note: A countdown is an optional element. If provided, it SHOULD be used in addition to an expiry date and not instead of it)

• The date and time of the last occasion when Data Sharing or Service Initiation access occurred from the Users' connected account. This MAY be a specific date and time, or a range (e.g. within the last [x] days)

• “View Details" button to view the details of the Consent

LFIs MUST provide Users with comprehensive information to help them make informed decisions on the Data Sharing or Service Initiation details.

These details MUST include all the values which are defined within the specific Data Sharing or Service Initiation Consent, when it was requested. These details are covered within the Rules & Guidelines for each of the areas of functionality covered by the Standard.

LFIs MUST offer functionality (such as search, sort, filter etc.) to enable Users to search for the relevant Consent. This will be of particular benefit as the number of Consents for different LFI accounts given by Users to TPPs increases.

LFIs MUST provide the following minimum set of filters in the Consent management Overview page:

• Service Provider Trading Name (and TPP name if different)

• Connected Account Number

• Consent Type

• Consent State

• Consent Date

LFIs SHOULD provide extra explanatory text to help Users understand complicated topics such as how to cancel their Consent (e.g. using information bubbles helps to keep information manageable).

The Consent ID that is presented at the User-Interface (UI) MUST be user-friendly. LFIs MUST present the first and last four digits of the consent ID: 1234…….6789.

LFIs MUST offer a copy option that allows Users to copy the complete consent ID easily.

LFIs MUST provide the following Consent management options:

1. Authorize & Reject options:

   • Will be shown when there are multiple payment authorizations (for example in joint/multiple account holders) or when the Authentication/Authorization request has failed at the LFI side.

2. Cancel:

   • Will be shown when Users have completed the Authorization. This is not applicable for Single-use Consents for irrevocable Service Initiations such as Single Immediate Payments “SIPs”.

LFIs MUST provide a record of all past connections, including any previously granted Consents which had previously been:

• Canceled at the LFIs or the TPPs

• Expired

• Authorization Time Window Elapsed

• Rejected

• Finished

In the Consent Management Interface (CMI) Detailed page, LFIs MUST show as a minimum:

• When data was last shared or when Service Initiation was made by each TPP. This MAY be a specific date and time, or a range (e.g. within the last [x] days)).

• The expiry date of the Consent.

In the Consent Management Interface (CMI) Detailed page, LFIs MUST allow Users to cancel the Consents they have provided to TPPs easily and without obstruction or excessive barriers.

In the Consent Cancellation Notification page (i.e. the last page), LFIs MUST advise Users that they SHOULD contact the associated TPP to inform them of the revocation of their Consent and to understand the consequences of their action.

In the Consent Management Interface (CMI) Overview page, LFIs MUST inform Users that the Consent has been withdrawn successfully and show “Canceled” state to the User.

ABC Trades

ABC Company Ltd

ABC Trades

ABC Company Ltd

ABC Company Ltd

ABC Company Ltd

ABC Company Ltd

ABC Company Ltd

OBO Ltd

OBO Ltd via ABC Company Ltd

[TPP Trading Name]

[TPP Company name]

[Merchant Trading name]

[Merchant Trading name] via [TPP Trading Name]