Creditor Identification details

TPPs MUST:

1.1 Enable Creditor Identification using an IBAN. The information required for the creditor is:

• IBAN of the Creditor

• Name of the Creditor (First/Last Name or Business Name)

1.2 Ensure that the format and the validation rules of the Creditor Identification details are correct, when Users (Debtors) manually enter the Creditor Identification details. If incorrect, TPPs MUST request Users (Debtors) to review and re-enter the information.

Discovery

TPPs MUST:

2.1 Send a request to the OFP to discover the LFI entity of the Creditor that will confirm the creditor using the COP service. The request MUST include the IBAN of the Creditor as per 1.1.

OFP MUST:

2.2 Resolve the request received by the TPP. The response back to the TPP will include the correct URL to make the COP API call.

COP Service

TPPs MUST:

3.1 Only use the COP service as part of a Bank Service Initiation journey.

3.1.1 Attempt to conduct Confirmation of Payee (COP) with the User whenever the User is setting up a new beneficiary.

3.2 NOT use the COP service for any non-payment initiation purposes.

3.2 Request the OFP to perform COP for the Creditor Identification details provided by the User for the payment Consent.

3.3 Provide the mandatory information to the OFP to perform the COP operation. This information include:

• IBAN of the Creditor

• Name of the Creditor (First/Last Name or Business Name)

OFP MUST:

3.4 Make a Customer Data request to the Creditor’s LFI, specifying the Creditor Account in IBAN format. The data elements the OFP will request include the following:

• Account Name (including First Name and Surname or Business Name)

CREDITOR LFIs MUST:

3.5 Receive the Customer Data request from the OFP with the Creditor Account in IBAN format for accessing the Account Name (including First Name and Surname or Business Name) information

3.6 Retrieve the Account Name (including First Name and Surname or Business Name) information related to the Creditor Account identified by the provided IBAN and return all the related data in the response message.

• 3.6.1 NOT return any data in the response to the Customer Data request message for the Creditor Account related to the provided IBAN if the account is in dormant or suspended mode, or any other state that the rules of the LFI would not allow any funds to be received in the account. This is to prevent payment initiations that will be rejected when the reach the Creditor LFI.

3.7 NOT provide Users (Creditors) the option to select to opt-out from the COP service. However, in exceptional circumstances only, such as where the account holder is a national or Emirati leader or their immediate family, LFIs have the ability to establish processes to agree with the account holder that their account information will not be shared with the OFP when receiving a Customer Data request message from the OFP for COP purposes.

• 3.7.1 In this case, LFIs MUST return no data in their response message back to the OFP.

OFP MUST:

3.8 Receive the Customer Data from the Data Request response of the API endpoint.

3.9 Compare the Account Name information received by the Creditor’s LFI with the Creditor Identification details included in the COP request. The outcome will be as follows:

• Exact Match - Confirmed

• No Match - The comparison of the Account Name (First Name & Surname or Business Name) with the Creditor Name in the COP request is NOT an exact match.

3.10 Provide to the TPP the appropriate information depending on the outcome of the COP operation as follows:

• 3.10.1 - If the COP operation results in an Exact Match, respond with a positive (Yes).

• 3.10.2 - If the COP operation results in a No Match, then respond with the following:

  • A negative (No)

  • The Account Name retrieved by the Creditor LFI based on the Payee account details provided.

  • The masked version of the Account Name.

User Payee Name Confirmation

TPPs MUST:

4.1 Display the outcome of the COP operation (Yes/No) next to the Creditor Account Name provided by the User (Debtor).

4.2 Provide Users (Debtors) one of the following alternatives based on the outcome of the COP operation:

• 4.2.1 If the outcome is Yes, then allow the User (Debtor) to proceed with the payment consent as usual.

• 4.2.2 If the outcome is No, then:

  • display to Users (Debtors) the masked Account Name returned by the COP operation.

  • inform Users (Debtors) about the risk of proceeding with providing consent for this payment as it can be misdirected to the wrong Creditor.

  • advice Users (Debtors) that they should:

    • Either cancel the payment journey and start the payment information process again to provide new Creditor Identifications details (i.e. move to step COP-1)

    • Or if they are certain that the payment account details are correct, they can proceed with making the payment to this Creditor at their own risk.

4.3 Use the Account Name retrieved by the COP operation in the payment consent, if the User (Debtor) proceeds with the payment initiation based on a No response.

COP No Return of Data/Error Only

OFP MUST:

4.4 Inform the TPPs that the Creditor Name cannot be verified due to error in the COP operation. The OFP MUST provide the appropriate error message for the failure.

TPPs MUST:

4.5 Inform Users (Debtors) that the Creditor Name cannot be verified by the COP service.

4.6 Inform Users (Debtors) about the risk of proceeding with providing consent for this payment as it can be misdirected to the wrong Creditor.

4.7 Advice Users (Debtors) that they should:

• Either cancel the payment journey and start the payment information process again to provide new Creditor Identifications details (i.e. move to step COP-1)

• Or if they are certain that the payment account details are correct, they can proceed with making the payment to this Creditor at their own risk.