Salt Edge secures identity in open banking

Actalis QWAC and QSEAL certificates for secure identification in PSD2 communications with banking channels.

The customer

Salt Edge Inc. is a leading fintech company with offices in Toronto, London, Bucharest and Chisinau.

The company was founded in 2013 with the goal of creating stable and secure interoperability channels between financial service providers and end consumers, for the benefit of all parties involved. Salt Edge currently operates across Europe, Asia Pacific and the Americas, providing its services to institutions such as banks, fintechs, financial companies, ERPs and accounting firms.

Through its API platform, Salt Edge enables companies to connect to PSD2 banking channels for account information and payment initiation. ISO 27001 certified and holder of an AISP license under PSD2, the company applies the highest international security measures and standards.

To meet the requirements of the PSD2 directive, fintech Salt Edge chose Actalis, the Aruba Group's QTSP, to obtain the eIDAS QWAC and QSEAL certificates needed to securely identify itself in communications with banking channels across Europe, with issuance times faster than the market average.

The need

Secure identification for PSD2 open banking

The solution

QWAC and QSEAL certificates from a trusted QTSP

The benefits

Faster certificates, clearer communication

The need

Secure identification for PSD2 open banking

The PSD2 directive introduced strict security requirements, including the acquisition of eIDAS certificates for identification during communications with banking channels. This led Salt Edge to look for a QTSP (Qualified Trust Service Provider) able to supply both a QWAC and a QSEAL certificate.

The qualified certificates had to be obtained through software tokens and comply with the Regulatory Technical Standards (RTS) and the guidelines of the European Banking Authority (EBA).

The solution

QWAC and QSEAL certificates from a trusted QTSP

Actalis is a Certification Authority qualified under the eIDAS regulation for the provision of trust services and recognised worldwide for issuing SSL Server certificates. It was the first company of its kind in Italy, is among the largest CAs in Europe, and ranks in the global top 10 for SSL. Actalis is part of the Aruba Group, the Italian leader in domains, hosting, certified email and cloud.

During a market survey in search of a suitable solution, Salt Edge identified Actalis S.p.A., part of the Aruba Group since 2009 and one of the first QTSPs to offer this type of certificate.

Thanks to fast response times and clear, simple processes, Actalis provided Salt Edge with trial certificates that simplified its efforts to offer open banking services across Europe.

The QWAC (Qualified Website Authentication Certificate) is a digital certificate qualified under the trust services defined by the eIDAS Regulation; it must be used for website authentication, so that ASPSPs (Account Servicing Payment Services Providers) and TPPs (Third Party Providers) can verify each other's identity.

The QSEALC (Qualified Electronic Seal Certificate) must be used to verify identity, so that transaction information is protected from potential attacks during or after a communication. Through this solution, Salt Edge can integrate with banking channels using its own eIDAS for identification, or act as a Technical Service Provider (TSP) and present its clients' eIDAS certificates instead.

Because security is critical for Salt Edge, the company encourages all its clients to issue dedicated eIDAS certificates for Salt Edge, used for communication with banks whenever Salt Edge acts as a TSP; this approach is also recommended by the EBA.

The benefits

Faster certificates, clearer communication

For this reason, Salt Edge built a self-service certificate signing request (CSR) generation flow into its own system, the first open banking TSP to do so. This made it essential to find a reliable QTSP such as Actalis.

Salt Edge received its eIDAS certificate in a notably shorter time than other providers, who typically receive their eIDAS certificate in three times as long.

Clear and open communication between provider and client helped improve overall efficiency in responding to both business and customer needs.

"We were the first open banking TSP to implement self-service certificate signing request (CSR) generation in our system, in order to help our clients generate dedicated eIDAS certificates. This made it essential to find a reliable QTSP such as Actalis: since our experience working with Actalis has been positive and productive, we recommend their services to our clients".

Vladimir PinteaHead of Open Banking at Salt Edge

Future developments

Working with a trusted partner helps create a continuous, secure flow for clients and is also what is needed for the next steps ahead, as it helps strengthen and improve Salt Edge's business processes.