(title available in French only)
Official Binding
Note
ETSI technical specification defining the certificate profiles and provider policy requirements for open banking uses (version 1.7.1).
The full text is not reproduced here (copyright): see the official source.
Summary
Purpose
Technical specification ETSI TS 119 495 (version 1.7.1, July 2024) defines the qualified certificates used by payment service providers in the context of Open Banking, including the second Payment Services Directive (PSD2) ETSI TS 119 495 V1.7.1, § 1 Scope ETSI TS 119 495 V1.7.1, History. Its scope first states that it:
Specifies requirements for qualified certificates, or other non-EU schemes which provide equivalent assurance based ETSI best practices, for electronic seals and website authentication
It therefore covers two types of certificates: qualified certificates for electronic seals (QSealC) and qualified certificates for website authentication (QWAC). It also adds policy requirements for providers that manage the attributes specific to Open Banking; these requirements supplement ETSI EN 319 411-2 ETSI TS 119 495 V1.7.1, § 1 Scope.
Who it applies to
- Qualified trust service providers that issue QWACs or QSealCs to payment service providers ETSI TS 119 495 V1.7.1, § 6.1 General policy requirements.
- Payment service providers, holders of these certificates, according to their roles: account servicing, payment initiation, account information, issuing of card-based payment instruments ETSI TS 119 495 V1.7.1, § 4.2 Roles.
Key points
- Open Banking attributes: a QCStatement contains the role of the payment service provider and the name and identifier of the competent authority that authorised it ETSI TS 119 495 V1.7.1, § 5.1 QCStatement for Open Banking.
- Verification: the trust service provider verifies these attributes against the authentic information of the competent authority, for example a public register ETSI TS 119 495 V1.7.1, § 6.2.2 Initial identity validation.
- TLS certificate outside a browser: the specification recommends (should) applying the QNCP-w-gen profile of ETSI EN 319 412-4; the Open Banking statement and the organizationIdentifier are mandatory ETSI TS 119 495 V1.7.1, § 5.3 Profile Requirements for Certificate for TLS Authentication.
- Policies: for QWACs, the requirements of EN 319 411-2 apply unless they conflict with the specification; for QSealCs intended for PSD2, those of the QCP-l policy ETSI TS 119 495 V1.7.1, § 6.1 General policy requirements.
- Revocation: clause 6.2.6 deals with revocation, including at the request of the competent authority ETSI TS 119 495 V1.7.1, § 6.2.6 Certificate revocation ETSI TS 119 495 V1.7.1, C.8 How NCAs can request a TSP to revoke issued certificates.
What the acts apply, and how
- Implementing Regulation 2025/2527: for QWACs issued for transport layer (TLS) authentication outside a web browser, the annex designates, as alternatives, ETSI EN 319 411-2 version 2.6.1 (with the QNCP-w-gen, QEVCP-w or QNCP-w policies) or TS 119 495 version 1.7.1 List of reference standards for qualified certificates for website authentication. Other QWACs, including in a browser, fall under TS 119 411-5 List of reference standards for qualified certificates for website authentication. The annex targets neither clauses nor adaptations: the reference covers the whole specification. Only the QWAC part is concerned; QSealCs fall outside this Regulation, which concerns the reference standards for certificates for website authentication Art. 1. The Regulation applies from 6 January 2027 Art. 2. Here Regulation 910/2014 provides not for a presumption, but for an evaluation carried out in accordance with these standards:
The evaluation of compliance with those requirements shall be carried out in accordance with the standards, specifications and procedures referred to in paragraph 2 of this Article.
- Implementing Regulation 2025/2162: its Annex II cites TS 119 495, without a version, for the issuance of qualified certificates for electronic seals and qualified certificates for website authentication; conformity assessment schemes include at least these standards, as applicable, with their year and version number Annex II Art. 6(3).
Cited version
Implementing Regulation 2025/2527 names version 1.7.1 (2024-07) of TS 119 495 List of reference standards for qualified certificates for website authentication. The index of ETSI standards in the corpus, consulted on 31-10-2026, mentions a more recent published version, V1.8.1, whose text is not in the corpus.
Important clauses
- ETSI TS 119 495 V1.7.1, § 1 Scope: scope.
- ETSI TS 119 495 V1.7.1, § 5 Certificate profile requirements: certificate profiles.
- ETSI TS 119 495 V1.7.1, § 6 Policy requirements: policy requirements.
- ETSI TS 119 495 V1.7.1, Annex D (informative): EU PSD2 specific list of NCA Identifiers provided by European Banking Authority: identifiers of the competent authorities.
Links
- Policy for qualified certificates: ETSI EN 319 411-2 ETSI EN 319 411-2 V2.6.1; profile of website certificates: ETSI EN 319 412-4 ETSI EN 319 412-4 V1.4.1.
- Other standard of 2025/2527, for other QWACs: ETSI TS 119 411-5 ETSI TS 119 411-5 V2.1.1.
- Learning path: step 4, trust services.
Consolidation without official value
This summary relies on the consolidated version, published on EUR-Lex, of Regulation 910/2014 Regulation (EU) No 910/2014 — consolidated version of 18/10/2024. It serves as documentation: only the text published in the Official Journal is authentic.
ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI TS 119 495 V1.7.1. Written by Asphalia.