Automation and integration

Pursuant to Commission Regulation (EU) 2018/389¹ (the Regulation) in connection with the provisions of the Act of 10 May 2018 amending the Act on Payment Services² and certain other acts, from 14 September 2019 (the Act), account-servicing payment service providers are required to make available a so-called access interface. This interface is intended to enable providers (Third Party Providers – TPP) holding the relevant supervisory authority permit, providing, among others, the Payment Initiation Service (PIS) and providers offering the Account Information Service (AIS), or payment service providers who have submitted an application for the relevant permit, to integrate their software and applications used to offer payment services to users.

To this end, the Bank provides an interface that meets the above requirements.

Below you will find information on its content, capabilities, the available services that TPPs can use, as well as how the interface itself is made available.

¹ Commission Regulation (EU) of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication, available at: https://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32018R0389.

² Journal of Laws of 2018, item 1075..

The CitiConnect API enables payment service providers to offer the following services to clients:

• Payment initiation;
• Access to account information.

The CitiConnect API has the following functionalities enabling integration with the banking environment:

• TPP identification
• User (account holder) authentication
• Payment initiation
• Payment status check
• Balance check
• Confirmation of Availability of Funds (COF)
• Statement availability check
• Statement retrieval
• Payment confirmation retrieval
• Account history retrieval.

We invite all interested Third Party Providers to visit our global developer portal, the Citi Developer Portal. There you will find:

• Complete technical documentation of our API (specifications, usage examples).
• Access to a test environment (sandbox), enabling secure testing and integration of your solutions.
• Availability and performance statistics for the interface.
• Necessary information and technical support.

Review the specification and start testing at: https://developer.citi.com/apis/ (opens in new window) (opens in new window)

The full content of the documentation may be provided only to entities that hold the relevant permit/registration or have submitted such an application to the competent authority. It is the TPP's responsibility to demonstrate that it holds the relevant permit/registration or has submitted the appropriate application.

In order to gain access to the interface and/or the Documentation, please register on the Developer Portal, selecting the TPP option, and send an email to citidirect.poland@citi.com indicating the following information:

• TPP number and name from the relevant register (in the case of an entity in the process of registration, please send a scan or certified copy of confirmation of submission of the application for registration/permit to the competent authority)
• User's first and last name
• User's email address and other contact details

Failure to provide this information will prevent us from providing the documentation or granting access to the interface.

Upon successful verification of the request, the Bank will send the applicant an email together with the Documentation. In the case of a request for access to the interface, the Bank will contact the applicant by phone or email in order to carry out the implementation process.

In order to gain access to the interface, the Bank does not require any additional documentation from TPPs intending to provide the PIS and AIS service, with the exception of the documentation referred to in the section "Access to the interface and request for provision of documentation").

In case of any questions, problems, or errors related to the functioning of the interface, please contact our experts by email. Contact address: citidirect.poland@citi.com

TPP identification within the interface is based on electronic certificates, in accordance with the requirements of Regulation 910/2014 (eIDAS).

An entity intending to provide PIS and/or AIS services should have its own valid certificate for use during identification in the interface, compliant with the requirements of Article 34 of Regulation 2018/389.

Each service available within the interface is initiated based on the following steps:

• Identification and obtaining an oAuth token
• Placing the appropriate data in the header, indicating the service
• Signing and encrypting the "payload," i.e., the elements necessary to perform the given service
• Logging out

The identification process allows for the generation of an oAuth token, which in turn enables subsequent API requests to be called (e.g., payment initiation). Details are described in the Documentation.

User Authentication is based on electronic certificates used by entities to affix signatures in electronic form. In the "body" section, the "payload" should be inserted, i.e., the details of the specific service to be initiated after authentication. In the example above, the payment initiation service was presented.

The "payload" must contain the client's consent in the form of an electronic certificate. Details of the procedure are described in the Documentation.

The Bank ensures security through the use of electronic certificates compliant with eIDAS requirements. We support certificates from selected providers (list of supported providers available in the Documentation).

The confidentiality of communication and transmitted data is ensured through the use of the secure TLS protocol. Data transmission takes place in connection with the Bank's servers.

During identification and authentication, the Bank initiates access control and electronic certificate verification procedures.

The Bank will provide information about planned and unplanned unavailability of the interface via email to the applicant's addresses indicated during implementation.