generated: '2026-07-23'
method: derived
source: openapi/uk-open-banking-account-info-api-openapi.yaml, openapi/uk-open-banking-payment-initiation-api-openapi.yaml, openapi/uk-open-banking-confirmation-of-funds-api-openapi.yaml, openapi/uk-open-banking-open-data-api-openapi.json
note: >-
  Standards conformance asserted from the shared OBIE UK Open Banking standard specs
  in this repo. UNVERIFIED for GB Bank as a live participant - these describe the
  standard GB Bank as an FCA-authorised ASPSP would conform to, not a certified
  GB Bank implementation. No published GB Bank security-certification programme
  (SOC 2 / ISO 27001 / PCI) was found, so no Compliance pointer is emitted.
standards:
  - id: oauth2
    conforms: true
    evidence: OpenAPI securitySchemes type oauth2 (TPPOAuth2Security clientCredentials, PSUOAuth2Security authorizationCode)
  - id: openid-connect
    conforms: true
    evidence: OBIE Read/Write mandates OIDC hybrid flow for PSU authentication (FAPI)
  - id: fapi
    conforms: true
    evidence: FAPI-grade security profile - mTLS client auth, detached JWS (x-jws-signature), x-fapi-* headers
  - id: psd2
    conforms: true
    evidence: OBIE Read/Write standard implements PSD2 AIS/PIS/CBPII with SCA
  - id: obie-read-write-4.0
    conforms: true
    evidence: AIS/PIS/CBPII OpenAPI documents at version 4.0.1
  - id: obie-open-data-1.3
    conforms: true
    evidence: Open Data API Swagger 2.0 at version v1.3 (ATM/Branch/PCA/BCA/SME/CCC)
  - id: mutual-tls
    conforms: true
    evidence: OBIE FAPI requires mTLS transport-layer client authentication with eIDAS/OBIE certificates
  - id: message-signing-jws
    conforms: true
    evidence: x-jws-signature detached-JWS header on payment requests/responses
  - id: idempotency
    conforms: true
    evidence: x-idempotency-key header on payment-initiation write operations
  - id: rfc9457-problem-details
    conforms: false
    evidence: errors use the OBIE OBErrorResponse1 envelope (Id/Code/Message/Errors), not application/problem+json
  - id: json-api
    conforms: false
  - id: fhir
    conforms: false
  - id: scim
    conforms: false