BetaBuilt by the community
Navigation
Metrics
Program
Service DeskPricingPoliciesDocument RepositoryIn Production
Developer Docs
TPP — Open Finance StandardsLFI — Integration GuideAPI SpecsKnowledge BaseProposals & VotingRelease Notes & Erratas
TPP · Trust Framework · Directory

Trust Framework 4 min read

The Trust Framework facilitates secure data sharing between Licensed Financial Institutions (LFIs) and Third-Party Providers (TPPs) by delivering key services such as API discovery, client onboarding, and client authentication.

01 Trust Framework Environments

Sandbox and Production endpoints

Sandbox Trust Framework

Production Trust Framework

02 Core Functions

What the Trust Framework provides

Trust Anchors

Maintain a registry of authorized participants, defining their roles and scopes of access within the ecosystem.

API Portal for Discovery

Serve as a centralized directory of all servers, clients, and APIs participating in the ecosystem.

Keystore

Manage a registry of active cryptographic keys for each participant. These keys are used to validate identities, enabling mutual trust — an essential foundation for secure data sharing.

Public Key Infrastructure (PKI)

Issue and manage TLS, signature, and encryption certificates. The PKI also provides mechanisms for verifying certificates generated within the platform.

03 Keystore Caching

How long to cache a JWKS fetched from the keystore

Every participant's public keys are published as JWKS documents on the keystore — keystore.directory.openfinance.ae in production and keystore.sandbox.directory.openfinance.ae in sandbox — including application.jwks, transport.jwks and their inactive/ counterparts. The keystore is served through a CDN and returns each JWKS with:

  • Cache-Control header: public, max-age=300
  • Cache duration: 5 minutes
  • Validators: ETag and Last-Modified — a conditional request for an unchanged JWKS returns 304 Not Modified with no body

Fetching a JWKS

A participant that verifies signatures or encrypts with another participant's keys:

  • MUST cache each JWKS, keyed by its URL, and MUST NOT fetch it on every request.
  • SHOULD treat a cached JWKS as fresh for the max-age it was served with (currently 300 seconds), and MUST NOT treat it as fresh for longer than 10 minutes.
  • SHOULD refresh the cached JWKS before it expires, continuing to use the cached copy meanwhile, so that signature verification and encryption do not wait on a keystore request.
  • SHOULD revalidate using If-None-Match with the cached ETag.
  • SHOULD refetch the JWKS immediately when a JWS references a kid that is not in the cached copy, no more than once every 60 seconds per URL, before rejecting the JWS.
  • SHOULD NOT cache a 404 Not Found for longer than 60 seconds. A newly registered organisation or software statement returns 404 until its keys are published.
  • SHOULD apply a timeout of 5 seconds to keystore requests and, when a refresh fails, continue to use the last JWKS it fetched successfully while retrying with backoff, for no longer than 1 hour.

Publishing a key

A participant that adds or rotates a key in the Trust Framework:

  • MUST wait at least 10 minutes after publishing a new key before signing with it. A JWKS can take around a minute to propagate through the CDN, and a consumer may hold the previous copy for a further 5 minutes.
  • SHOULD keep the private key of a retired encryption key available for decryption for at least 10 minutes after removing it, so that payloads encrypted against a cached copy of the JWKS can still be decrypted.
04 Organisations

LFIs, TPPs, and how they coexist in the directory

All organisations participating in Open Finance operate within the Trust Framework. Upon successful onboarding, participants are registered within the Framework and gain visibility of other authorised organisations in the ecosystem.

Organisations are classified according to their role:

Licensed Financial Institutions (LFIs) provide capabilities into the Open Finance ecosystem. For example, an institution such as ADCB may expose payment initiation services or account information APIs for consumption by authorised participants.

Third Party Providers (TPPs) consume the capabilities made available through Open Finance. For example, a fintech organisation such as Spare Technologies may access payment or data services provided by LFIs to deliver customer-facing solutions.

Where permitted by their regulatory licence, an LFI may also operate in the capacity of a TPP. In such cases, the organisation retains its LFI classification within the Trust Framework while exercising TPP capabilities.