Berlin Group

While PSD2 (Payment Services Directive 2) has mandated that banks must open their systems to third-parties, and provide interfaces for them to initiate payments and retrieve account information, in the UK it is the Open Banking Implementation Entity (OBIE) that defines how banks are to provide this information securely through APIs and data structures. In order to bring some synergy across the European banks, the Berlin Group which is a pan-European initiative has implemented a common API standard called NextGenPSD2. While these efforts have greatly improved how Open Banking can be consumed in member countries, there are some differences in how you communicate to these banks.

​

Payments

• In order to initiate a payment from an account from an Institution that belongs to the Berlin Group, the payer object and all its mandatory properties are required. This currently holds true for every Institution provided by Yapily that is in Europe (not including UKI)

• The payment reference unlike an Institution in order the Open Banking UK specification can be more than 18 characters.

​

Response Codes

General

Code	Status	Description	Yapily Response
200	OK	PUT, GET Response Codes. OK	200
201	CREATED	POST response code where Payment Initiation or Consent Request was correctly performed.	201
202	ACCEPTED	DELETE response code, where a payment resource can be cancelled in general, but where a cancellation authorisation is needed in addition.	200
204	NO_CONTENT	DELETE response code where a consent resource was successfully deleted. The code indicates that the request was performed, but no content was returned	200
400	FORMAT_ERROR	Format of certain request fields are not matching the XS2A requirements.
400	PARAMETER_NOT_CONSISTENT	Parameters submitted by TPP are not consistent. This applies only for query parameters.
400	PARAMETER_NOT_SUPPORTED	The parameter is not supported by the API provider. This code should only be used for parameters that are described as “optional if supported by API provider.
400	PERIOD_INVALID	Requested time period out of bound.
400	RESOURCE_BLOCKED	The addressed resource is not addressable by this request, since it is blocked e.g. by a grouping in a signing basket.
400	SCA_INVALID	Method Application on authorisation resource (e.g. Confirmation Request) blocked since SCA status of the resource equals “failed”.
400	SCA_METHOD_UNKNOWN	Addressed SCA method in the Authentication Method Select Request is unknown or cannot be matched by the ASPSP with the PSU.
400	SERVICE_INVALID	The addressed service is not valid for the addressed resources or the submitted data.
400	TIMESTAMP_INVALID	Timestamp not in accepted time period.
401	CERTIFICATE_BLOCKED	Signature/corporate seal certificate has been blocked by the ASPSP or the related NCA.	401
401	CERTIFICATE_EXPIRED	Signature/corporate seal certificate is expired.	401
401	CERTIFICATE_INVALID	The contents of the signature/corporate seal certificate are not matching PSD2 general PSD2 or attribute requirements.	401
401	CERTIFICATE_MISSING	Signature/corporate seal certificate was not available in the request but is mandated for the corresponding.	401
401	CERTIFICATE_REVOKED	Signature/corporate seal certificate has been revoked by QSTP.	401
401	CONSENT_INVALID	The consent was created by this TPP but is not valid for the addressed service/resource.	401
401	CONSENT_EXPIRED	The consent was created by this TPP but has expired and needs to be renewed.	401
401	CORPORATE_ID_INVALID	The PSU-Corporate-ID cannot be matched by the addressed ASPSP.	401
401	PSU_CREDENTIALS_INVALID	The PSU-ID cannot be matched by the addressed ASPSP or is blocked, or a password resp. OTP was not correct. Additional information might be added.	401
401	ROLE_INVALID	The TPP does not have the correct PSD2 role to access this service.	401
401	SIGNATURE_INVALID	Application layer eIDAS Signature for TPP authentication is not correct.	401
401	SIGNATURE_MISSING	Application layer eIDAS Signature for TPP authentication is mandated by the ASPSP but is missing.	401
401	TOKEN_UNKNOWN	The OAuth2 token cannot be matched by the ASPSP relative to the TPP.	401
401	TOKEN_INVALID	The OAuth2 token is associated to the TPP but is not valid for the addressed service/resource.	401
401	TOKEN_EXPIRED	The OAuth2 token is associated to the TPP but has expired and needs to be renewed.	401
403	CONSENT_UNKNOWN	The Consent-ID cannot be matched by the ASPSP relative to the TPP.	403
403	RESOURCE_EXPIRED	The addressed resource is associated with the TPP but has expired, not addressable anymore.	403
403	SERVICE_BLOCKED	This service is not reachable for the addressed PSU due to a channel independent blocking by the ASPSP	403
404	RESOURCE_UNKNOWN	The addressed resource is unknown relative to the TPP.
409	STATUS_INVALID	The addressed resource does not allow additional authorisation.
500	INTERNAL SERVER ERROR	Internal server error occurred.	424
501	SERVICE UNAVAILABLE	The ASPSP server is currently unavailable. Generally, this is a temporary state.	424

PIS

Code	Status	Description
400	EXECUTION_DATE_INVALID	The requested execution date is not a valid execution date for the ASPSP.
400	PAYMENT_FAILED	The payment initiation POST request failed during the initial process. Additional information may be provided by the ASPSP.
401	REQUIRED_KID_MISSING	The payment initiation has failed due to a missing KID.
403	PRODUCT_INVALID	The addressed payment product is not available for the PSU.
404	PRODUCT_UNKNOWN	The addressed payment product is not supported by the ASPSP.
405	CANCELLATION_INVALID	The addressed payment is not cancellable e.g. due to cut off time passed or legal constraints.

AIS

Code	Status	Description
400	SESSIONS_NOT_SUPPORTED	The combined service flag may not be used with this ASPSP.
401	CONSENT_INVALID	The consent definition is not complete or invalid. In case of being not complete, the bank is not supporting a completion of the consent towards the PSU.
406	REQUESTED_FORMATS_INVALID	The requested formats in the Accept header entry are not matching the formats offered by the ASPSP.
429	ACCESS_EXCEEDED	The access on the account has been exceeding the consented multiplicity without PSU involvement per day.