TPP Validation
TPP Validation provides an automated eIDAS certificate and regulatory verification service for banks and ASPSPs operating under PSD2, PSD3/PSR, and FIDA frameworks. The platform validates QWAC and QSealC certificates against EU Trust Lists in real time, with event-driven webhook callbacks that push certificate and license state changes to clients, eliminating latency at request time. The service is available via a POST /v5 API endpoint with a median 78 ms response time, a CLI tool, and institutional deployment through the Microsoft Azure Marketplace.
- Regulatory & Compliance Technology
- Financial Technology
- Cybersecurity
- Software Only
Funding
Founders
Founder details are not available yet.
Product
Problem
Banks and ASPSPs must validate eIDAS certificates and regulatory standing of Third-Party Providers (TPPs) before granting API access under PSD2, but pull-based validation forces a trade-off between adding latency that obstructs legitimate TPPs and caching trust at the risk of serving revoked certificates. Manual or fragmented verification across national registers creates compliance gaps and operational overhead.
Solution
TPP Validation provides an authoritative trust anchor between regulated APIs and the TPP ecosystem, automating the verification of eIDAS certificates and regulatory roles in real time. The service performs full chain-of-trust validation against EU Trust Lists with OCSP and CRL fallback, extracts PSD2 attributes from QWAC and QSealC certificates in a single atomic pass, and maps licenses and cross-border permissions from national registers. Event-driven callbacks push verdicts to the bank's system the instant a certificate or license changes state, so the result is available before the request arrives, making enforcement non-obstructive by design. Results are cryptographically signed with hash-chained provenance, providing traceable and tamper-evident grounds for access decisions. The platform is built for current PSD2 requirements and is PSD3/PSR-ready, with FIDA FISP authorization support.
Target Audience
Primary customers are ASPSPs, banks, and financial institutions operating regulated APIs within the EU and EEA that need to validate TPP credentials and maintain regulatory compliance under PSD2, PSD3/PSR, and FIDA frameworks.
Features
- Real-time eIDAS introspection supporting QWAC and QSealC certificates with full chain-of-trust verification against EU Trust Lists across all 30 jurisdictions
- Zero-cache policy with live-refreshed anchors updated hourly, using OCSP and CRL fallback for revocation checks
- Regulatory standing confirmation with automated mapping of licenses and cross-border permissions from EBA, FCA, and NCA registers
- Event-driven webhook callbacks that notify banks of certificate or license state changes (cert.revoked, cert.expired, role.changed, passport.lost, license.withdrawn, qtsp.revoked), enabling push-based compliance
- POST /v5 API endpoint with median 78 ms end-to-end response time and auditable, cryptographically signed responses (ES256) with qualified eIDAS time-stamps
- CLI tool for local validation and automatic generation of enforcement plugins for API gateways
- Support for both pull (synchronous) and push (webhook) validation modes, reconciled into a single audit trail