Redirect URL and mobile app in Belgium

In Belgium, the common behavior of SCA redirect URL given by the bank is to open their mobile app if it is installed or the web page in a browser if the app is not installed. We also know that, in some cases, the web page opens in the browser and then the phone is opening the mobile app with or without prior confirmation request.

It depends on the mobile OS version and the bank app version.

BELFIUS

EverShield/TPP mode only!

Belfius requires to include redirect URL to get new data about Account/Balances. Our SDK automatically saves this value in user context.

If you update your website’s URL (redirect URL changes), GetBalance method may not work for current user contexts. To solve this issue, you can take one of following actions:

• Create new consent for each user in this bank,
• Manually update all user contexts for Belfius, by replacing old Redirect URL with the new one.

KBC, REVOLUT, ABN-AMRO, Triodos, Rabobank

Those banks try to do the payment by default in Instant mode. If not possible, the payment will be done as normal. We cannot have any impact on this, and we cannot know the priority the payment has been done with.

ABN-AMRO

This bank is waiting seven days for the PSU to have enough funds on his account before cancelling it. During that period, the payment is in status ACSP (3).

Rabobank

This bank is waiting three working days for the PSU to have enough funds on his account before cancelling it. During that period, the payment is in status ACSC (2).

Specific refresh token handling

When we get the consent, the bank is giving us a refresh token and a token. The token is valid for 30 minutes and the refresh token 5 days and not for the consent duration. When we refresh the token, we also get a new refresh token valid for an extra 5 days.

❗️

This means that the refresh token must be refresh within the 5 days to avoid losing the consent!

In Skybridge, we are getting the balances and transactions three times a day, so no problem.

In EverShield, TPPs, be sure to get balances and/or transactions regularly, at least more often than every 5 days to get a new refresh token before it expires or the PSU will have to reconnect the account again.

Crelan

Crelan is sending "000000000000" as recipient IBAN in at least when it's a card payment.

GR NBG, DE Santander, CY Alpha bank and Belgium enterprise number vs EU EUCLID

Those banks are checking your id found in the provided certificate against the EBA EUCLID Payment Institutions Register. In the National Bank of Belgium's Payment Institutions Register, the enterprise number contains dots like "0630.675.588" which gives "PSDBE-NBB-0630.675.588". In EUCLID, the same company has the national id "0630675588" which gives "PSDBE-NBB-0630675588". If your certificate contains the dotted one, those banks will reject the certificate. There are other banks that may not accept the format without the dots...

For your information, the technical specifications TS 119 495 edited by ETSI, section 5.2.1, say:

2-8 character NCA identifier without country code (A-Z uppercase only, no separator);

Don't forget that the consents of AIS are linked to the NCA ID, changing the NCA ID will prevent you to access the accounts unless you renew the consent!