Deprecation & removal of FAPI 1 Implementer's Draft conformance certification tests/programme

[Joseph Heenan]

With FAPI 1 Advanced going to final in March 2021, the question arises of what we do with the conformance tests and certification program for implementer’s draft 2.

It is not desirable to offer certifications for implementer’s draft 2 indefinitely, because this imposes a burden on both the certification team to continue to maintain the code and offer support, and on vendors who often feel obligated to certify new versions for all available profiles. The certification team also don’t have easy access to a system configured to support ID2.

To the best of my knowledge, OpenBanking in the UK was the only ecosystem that really made use of the implementer’s draft, though I think CDR in Australia may also have done.

I would propose that we look at removing these tests and closing the certification program for these in around 12 months time (to give organisations time to migrate if they are still using ID2 / allow them to continue to meet the regulatory obligation in the UK for annual FAPI re-certification), and that we mark them as ‘deprecated’ or a similar phrase in the meantime. It may also make sense to stop publishing the existing certifications sometime after the removal, or at least perhaps to move them away from the main certification page?

Feedback from the working group would be welcome. If the working group is okay with this proposal then the certification team can share it with OBIE in the UK and ACCC in Australia so that any organisations that don’t already have a plan to move to ‘final’ can do so (and would take any final feedback on the timescales from these organisations).

‌

[Joseph Heenan]

Discussed on today’s call.

There was support for proceeding as I outlined; I’ll let OBIE UK know about the plan and see if they have any feedback.

[Joseph Heenan]

Latest discussion with OBIE is that we plan to target closing the FAPI1 implementer’s draft 1 certification program at end of September 2024, but we still need to fully communicate that out to the banks etc and I’m working with OBIE on that.

[Nat Sakimura]

Waiting for @Joseph Heenan to come up with a write up.

[Joseph Heenan]

The discussion with OBIE is ongoing, and no committed date for moving away from the Implementer’s Draft has yet been proposed by OBIE. OpenID Foundation has not made any commitment to extend the FAPI1-RW Implementers Draft 2 certification tests beyond the early 2024 date as discussed on the 18th January 2023 FAPI working group call.

We are asking OBIE to make a commitment as to their plans prior to 31st Nov 2023, so that this can be taken account of in the 2024 plans for the certification programme. My current guess is that OBIE would commit to a date in early 2025, and that the certification team would then make a recommendation to the WG that FAPI1 implementer’s draft 2 certifications are extended to end of March 2025.

[Joseph Heenan]

The latest from OBIE, as voted on by their TDA in late November is “majority the vote was to adopt FAPI 1.0 Advanced Final without PAR.”

We understand the timescales for this are such that no bank will be certifying to FAPI-RW Implementers draft 2 after the end of December 2024 and hence the tests can be removed at this point.

A ticket has been opened to update the tests in the conformance suite front end to make this clear, https://gitlab.com/openid/conformance-suite/-/issues/1297

I think this ticket can be closed once this update has been shared on a FAPI WG call.

[Nat Sakimura]

No objections heard by Feb 21 so closing this ticket.