BetaBuilt by the community
Navigation
Metrics
Program
Service DeskPricingPoliciesDocument RepositoryIn Production
Developer Docs
TPP — Open Finance StandardsLFI — Integration GuideAPI SpecsKnowledge BaseProposals & VotingRelease Notes & Erratas
Draft

This is v2.2-draft — a working draft of the v2.2 standards, published for review and not yet ratified. It MUST NOT be used as the basis for a production implementation. For the current standards, switch to v2.1 using the version selector. See the v2.1 → v2.2-draft changelog for every change in this version.

Validate · Enforce · Trust

Confirmation of Payee — Requirements v2.2-draft2 min read

The User Journeys for this service also apply and must be adhered to.

The tables below list the rules that apply to Confirmation of Payee. The Hub receives and validates the TPP's request, then calls your Ozone Connect POST /customers/action/cop-query endpoint with the IBAN alone. You are responsible for returning the name(s) you hold against that account, accurately — the Hub performs the name matching.

01 Endpoint

Create Cop Query

POST/customers/action/cop-query
#
Condition
Rule
1
Any request
Look the account up by data.account.identification (the IBAN). The request carries no name from v2.2, so there is nothing to compare against: you must not attempt to match, and must not filter, rank, or omit holders on any basis. The Hub owns the matching rules and applies them to what you return.
2
Account found, holder not opted out
Return 200 with a data array containing one entry per account holder — a joint account returns one entry per holder, in any order. Each entry carries id and name. For personal accounts, name.fullName is mandatory; firstName, middleName, lastName, fullNameAr and alsoKnownAs are optional — supply them where held separately. For business accounts, populate name.businessName; businessNameAr and alsoKnownAs are optional.
3
Any response
Return name data only. The verifiedClaims / verification envelope and the wider customer data it carried in v2.1 — emiratesId, birthDate, nationality, residentialAddress, salary, and the rest — are removed from this operation and must not be sent. Confirmation of Payee is not carried out under a consent.
4
IBAN not recognised at this LFI
Return 200 with an empty data array. Do not use 204, 404, 201, or 202.
5
Account is blocked from receiving payments — temporary
Return 403 with errorCode: Consent.AccountTemporarilyBlocked and errorMessage: The account is blocked from receiving payments. Applies when the block is temporary — e.g. account status is Suspended.
6
Account is blocked from receiving payments — permanent
Return 403 with errorCode: Consent.PermanentAccountAccessFailure and errorMessage: The account is blocked from receiving payments. Applies when the block is permanent — e.g. account status is Closed, Deceased, or Unclaimed.
7
Account holder has opted out of CoP
Return 200 with an empty data array.
02 Section

Opt-out

#
Rule
1
LFIs must not provide users with a general opt-out option for the CoP service. Opt-out is only permitted in exceptional circumstances — for example, where the account holder is a national or Emirati leader or their immediate family.
2
The opt-out process is not defined by the Open Finance Framework. LFIs must implement opt-out as part of their own BAU processes.
3
When an account holder has opted out, the LFI must return no data in the response — i.e. 200 with an empty data array (see row 7 of the table above).