Ping Identity releases Consumer Data Right sandbox

Under CDR rules, financial institutions must provide customers with greater access and control of their data. The aim is to make it easier for consumers to switch between products and services and to encourage more competition between service providers.

For tier one banks and large financial institutions, CDR-compliant data sharing needs to be in place by July 1. However, because of the pressures caused by the COVID-19 pandemic, tier two banks and smaller firms have been granted an extension until July 2021.

Ping Identity’s sandbox is a DevOps-driven environment, built on Ping technology, that can be deployed in minutes and includes the major technical and user experience requirements of the CDR specification version 1.2:

• An implementation of the CDR InfoSec specification, which is based on the Financial-Grade API (FAPI) specification that Ping Identity has contributed to over many years
• A mock ACCC registry, supporting fintech registration and maintenance services
• An implementation of the CDR data sharing APIs, using Biza.io’s DeepThought CDR API implementation
• A sample Data Holder (bank) web application, demonstrating authentication, authorisation, token creation, and user consent
• A sample Data Recipient (fintech) web application, showing the end user experience in creating a data sharing arrangement with a Data Holder, and the display of transaction data based on CDR-compliant API calls to the Data Holder, on behalf of the end user.
• CDR is a technical specification developed as a multi-industry open standard by Data61 and the ACCC with industry collaboration. It leverages FAPI, OAuth 2.0 and OpenID Connect (OIDC) to define additional technical requirements for the financial industry and other sectors requiring higher security. For banks specifically, CDR provides various advantages, enabling third-party applications to securely interact with financial accounts, while also enhancing the user’s ability to control security and privacy settings, without insecure sharing of the user’s banking credentials (screen-scraping).

In the future, the CDR will expand to cover other industries like energy with a similar security model and other industries are likely to follow.