Testing & Certification Overview 4 min read
A Licensed Financial Institution (LFI) reaches live operation in UAE Open Finance through two certification gates. The first unlocks production onboarding: the production Trust Framework and the production API Hub. The second unlocks TPP Buddying, the first live traffic with real customers.
Two certification gates, each unlocking the next phase
Certification is staged so that an LFI can start production onboarding as soon as its implementation is functionally correct and its customer experience is approved. Live traffic additionally requires evidence that the implementation is responsive under load, secure, and working as expected in production.
Gate 1: Functional and CX certification
Nebras accepts your Functional Certification evidence and your CX Certification evidence.
Production onboarding
You onboard to the production Trust Framework, then set up and connect to the production API Hub. No real-customer traffic flows at this stage.
Gate 2: Performance, penetration testing and production spot checks
Nebras accepts your performance test and penetration test results, and you attest that your production spot checks have passed.
TPP Buddying
You prove your implementation live with one or more partner TPPs and real customers before opening to the wider ecosystem. See TPP Buddying.
Production Trust Framework and API Hub onboarding happen once. A capability delivered later, such as Service Initiation after Data Sharing, goes through the same certifications before it enters TPP Buddying. See Getting Started as an LFI for the full journey.
Functional and CX certification unlock production onboarding
Before onboarding to the production Trust Framework, the LFI MUST have both of the following certifications accepted by Nebras. Each maps to a Certification Type in the Service Desk evidence ticket.
Functional Evidence
Proof that your Ozone Connect endpoints return correct, complete data, that each payment reaches the right terminal status, and that the same results flow through the API Hub to a TPP. Submitted per capability.
User Experience Evidence
Evidence that your consent journey and consent management interface meet the Open Finance user experience requirements.
Once both are accepted, the LFI MAY onboard to the production Trust Framework and set up and connect to the production API Hub — see Connectivity & Certificates and the production entries in Environment-Specific configuration.
Passing Gate 1 permits production onboarding and connectivity only. The LFI MUST NOT process real-customer Open Finance traffic until Gate 2 has been passed and TPP Buddying begins.
Performance, security and production spot checks unlock TPP Buddying
Before entering TPP Buddying, the LFI MUST have its performance test and penetration test results accepted by Nebras, and MUST attest that its production spot checks have passed.
Performance Testing
A performance test validating that your Ozone Connect endpoints remain responsive under reasonable load.
Security Validation
An independent penetration test covering your consent journey, your consent management interface, and every Ozone Connect endpoint you have delivered.
Production Spot Checks
Spot checks against production, using controlled test accounts, confirming that your Ozone Connect endpoints respond as expected through the production API Hub.
Performance test
The performance test MUST demonstrate that the LFI's Ozone Connect endpoints remain responsive under a reasonable level of load. The load profile and the results to submit are set out on the Performance Testing page.
Penetration test
The penetration test MUST be carried out by an independent third party. Internal security assessments and self-attested reviews do not satisfy this requirement. The test MUST cover:
- the consent journey — authentication and authorisation of the end user at the LFI;
- the consent management interface; and
- every Ozone Connect endpoint the LFI has delivered.
Production spot checks
Once connected to the production API Hub, the LFI MUST run spot checks against production using controlled test accounts (for example, bank-staff accounts) to confirm that its production Ozone Connect endpoints respond as expected. The LFI then attests the results to Nebras. See Attestation & Self Testing.
Raise one Service Desk ticket per certification area
Certification evidence is submitted to Nebras through the Service Desk, using the dedicated Providing certification evidence request type. The link is the same for every area, but each area is its own ticket: raise one for Functional, one for User Experience, one for Performance, and one for Security — and pick the matching Certification Type from the dropdown on each.
Functional evidence is split further: each functional area, such as Bank Data Sharing or each domestic payment type, is its own submission and its own ticket. The Functional Certification page lists every area.
The Service Desk is gated by Sandbox Trust Framework SSO — see Support & Service Desk for access prerequisites, what to include in a ticket, and the alternative email and telephone channels.
Certification at go-live is the entry bar, not the finish line
Once live, the LFI MUST maintain its certified state across every area continuously, not only at the point of certification. Material changes to the LFI's platform or to the Open Finance standards may trigger re-certification of the affected area; Nebras may also request fresh evidence at any time after go-live.
- Functional conformance — the LFI's Ozone Connect endpoints MUST continue to behave as specified in the LFI OpenAPI specifications as the standards evolve.
- User experience — the consent journey and consent management interface MUST continue to meet Open Finance CX requirements as those requirements are updated.
- Performance — the LFI's Ozone Connect endpoints MUST remain responsive as production traffic grows, and SHOULD be re-tested after significant infrastructure changes.
- Security of the LFI's systems — the LFI MUST keep dependencies patched, monitor for vulnerabilities, respond to incidents, and repeat penetration testing whenever significant changes are made to the consent journey, the consent management interface, or its Ozone Connect endpoints.
What these requirements do and do not cover
The certification requirements in this section are set by Nebras and govern technical and operational readiness for participation in the Open Finance UAE ecosystem. They do not constitute legal or regulatory advice, and they do not replace any obligation the LFI holds towards the Central Bank of the UAE (CBUAE), including regulatory compliance deadlines.