Page Comparison

_{#S. No.}

_{Customer Experience Checklist and Customer Experience Considerations}

_Participant

_{Implementation Requirements}

 ₁

_{AISP should offer functionality (e.g. search, sort, filter) to enable a user/customer to search for the relevant consent. This will be of particular benefit as the number of consents for different ASPSPs/ accounts given by a user/customer to AISPs increases. AISP should provide user/customer with multiple selection options to manage/revocate consent.}

_{AISPs must display the company’s trading name/brand name (i.e. the Client Name) to the user/customer during the setup and revocation of consent. If the AISP is only trading with its registered company name then it must display that name to the user/customer.}

_{If the AISP is not the customer-facing entity and there is an Agent who is acting on behalf of the AISP, then the Agent must make the user/customer aware that they are acting as an agent on behalf of the AISP and must also, display the AISP’s full trading name/brand name or registered company name whichever is the customer-facing brand of the AISP.}

_{The customer-facing entity must provide user/customers with sufficient information to enable them to make an informed decision. For example, detail the purpose for which the data will be used (including whether any other parties will have access to the information), the period over which it has been requested and when the consent for the account information will expire (consent could be ongoing or one-off).} 

_AISP

 _Required

₂

_{AISPs must describe the data being shared through each consent using the structure and language recommended by BOBF and ensure this request is specific to only the information required for the provision of their account information service to the user/customer.} 

_{AISPs should present the data at a Data Cluster level and allow the user/customer to expand the level of detail to show each Data Permission.} 

_{The Consent Dashboard should also describe:}

• _{A description of the account information service that is being provided (including whether any other parties will have access to the information)}

• _{Where the request is for multiple product types, the detail should explain to the customer the product type to which it applies or state that it is shared across multiple product types.}

• _{The date when consent was first granted.}

• _{The length of time for which this consent is valid (e.g. one-off use, for a set period of time e.g. one year, or with no end date and the date of expiry).}

• _{The period for which the account information has been requested (e.g. transactions for the last 12 months).}

_AISP

_Required

₃

_{The consent dashboard must allow a user/customer to view or cancel the access they have given consent to. The functions “Cancel Permission” and “back” should be displayed with equal prominence to the user/customer}

_{CX consideration:}

_{The AISP must make the exact consequences of cancelling the consent clear to the user/customer – i.e. they will no longer be able to provide the specific service to the user/customer} 

_AISP

_Required

₄

_{Once the user/customer confirms revocation, AISPs must inform the ASPSP that the user/customer has withdrawn consent by making a call ‘to PATCH’ the account-access-consent resource as soon as practically possible. This will ensure that no further account information is shared.} 

_{ASPSPs must support the Delete process. (This is not visible to the user/customer but will ensure no further account information is provided by the ASPSP to the AISP).}

_{CX consideration:}

_{As the account-access-consent resource has been deleted, AISPs must update the consent dashboard as soon as practicable. This update should include:-}

• _{An updated status of the user/customer’s sharing arrangement.}

• _{A statement indicating to the user/customer that the AISP is no longer collecting and using their data} 

_AISP

_Required

₅

 _{CX consideration:}

_{AISPs should provide a message to consumers that revocation was successful. This message SHOULD be clearly visible on the dashboard and shown as soon as revocation has taken place.}

_{ASPSPs should inform the user/customer that no further account information will be provided by the ASPSP to the AISP as the user/customer has withdrawn its access given to the AISP.}

_{After the Delete endpoint is called by the AISP to remove the account-access-consent resource, the ASPSPs are advised to inform the user/customer via their own channels (for example via SMS or via a notification on their mobile phone) that AISP will no longer have access to their account. This is an additional confirmation to the user/customer that the AISP has completed the delete endpoint process correctly.} 

_AISP

_ASPSP

_Required

_Required

₆

_{Post Customer revocation, AISPs must delete the entire customer data from their storage system}

_AISP

_Required