About FDX

No content found

No content found

No content found

No content found

No content found

No content found

FAQ

What is the Financial Data Exchange (FDX)?
FDX is a nonprofit organization operating in the US and Canada that is dedicated to unifying the financial services ecosystem around a common, interoperable, and royalty-free technical standard for the secure and convenient access of permissioned consumer and business financial data, aptly named the FDX Application Programming Interface (FDX API). FDX is governed by a diverse board of directors from across the financial services ecosystem, and FDX has a global membership that includes financial institutions, financial data aggregators, fintechs, industry utilities, payment networks, consumer groups, financial industry groups and other stakeholders involved user-permissioned financial data sharing.

All FDX members are given the opportunity to participate in the development, growth, and industry adoption of the FDX API and other objectives through FDX working groups and task forces.

FDX exists as an independent subsidiary under the umbrella of the Financial Services Information Sharing and Analysis Center (FS-ISAC), whose mission is to ensure resilience and continuity of the global financial services infrastructure.
Who is on the board of FDX?
The FDX board of directors is comprised of sustaining member financial institutions, financial data aggregators, permissioned parties, and financial industry groups within the user-permissioned financial data sharing ecosystem. Each board group maintains a consistent number of voting seats on the board. The FDX board will oversee and direct all aspects of the development and deployment of the FDX technical standards and will set other objectives as needed.
Who can become a member of FDX?
Tiered membership opportunities are available to any interested parties within the user-permissioned financial data sharing ecosystem. Most FDX members are stakeholders in the financial services arena and include financial institutions, financial data aggregators, fintechs, industry utilities, payment networks, consumer groups and non-profit financial industry groups. Specific information about membership tiers, pricing and enrollment can be found on the FDX Membership page.
What data standard does FDX support?
FDX supports the FDX API (formerly Durable Data API, or DDA) standard.

The FDX API began under the stewardship of the FS-ISAC and offers secure authentication with a restful API for data access to accommodate existing protocols. Upon the public launch of FDX in October 2018, FS-ISAC assigned the DDA to FDX and renamed it the FDX API. FDX recently released version 5.2 of the FDX API and some of the largest financial institutions in the world have implemented the FDX API standard.
What about OFX and other standards used to access financial data? How will they migrate over time?
FDX supports broad migration of the industry to a common standard to provide consumers and business a convenient, safe, and reliable method to access their financial records. The Open Financial Exchange (OFX) joined FDX in 2019 as an independent working group, with the goal of aligning all users to a single interoperable standard built on the most cutting-edge data specification, security, and authentication protocols. All existing implementations of OFX will continue to be supported, and users of OFX will have assistance to migrate to the FDX API standard at an appropriate juncture, such as during a technology refresh. FDX understands that this migration will take time and that other records access methods will continue to be used during the migration.
How does FDX impact the privacy and transparency of financial data?
The FDX API standard is fully predicated on user permissioned access to financial data. In other words, no financial records will be accessed or shared through the FDX API standard without a user’s full permission and control.

In addition, FDX is committed to five core principles of user permissioned data sharing which serve both as operating principles for FDX, as well as guidelines for the financial services ecosystem on the essential elements of a secure, transparent, and consumer-first approach to the sharing of financial data. The Five Core Principles of Data Sharing - Control, Access, Transparency, Traceability, and Security – are derived from and influenced by a diverse group of thought leaders in the financial industry as well as regulatory entities and worldwide standards bodies.
What are the Five Core Principles of Data Sharing?
The Five Core Principles of Data Sharing are Control, Access, Transparency, Traceability, and Security. They are embodied in the development and adoption of the FDX API standard and empower end users to better understand, leverage, and benefit from their own financial data in a secure, reliable, and user-centric manner.

Control: End Users should be able to permission their financial data for services or applications.
Access: End Users should have access to their data and the ability to determine which entities will have access to their data.
Transparency: Individuals using financial services should know how, when, and for what purpose their data is used. Only data that is required to provide such services should be shared with the organization providing the service.
Traceability: All data transfers should be traceable. Consumers should have a complete view of all entities within the user-permissioned financial data ecosystem that are involved in the data sharing flow.
Security: Financial data parties should follow industry best cybersecurity practices across the whole of their organization for safety and privacy of data during access and transport and when that data is at rest.
How does FDX impact user permissioning or user control of financial data?
User control and permissioning of data is being strengthened by the FDX API standard because the financial data ecosystem is unifying around a common interoperable data standard rather than a patchwork of data access tools that are often plagued by lack of interoperability, inconsistent data connectivity, quality, and governance. In addition, FDX’s User Experience Working Group is further strengthening control and permissioning mechanisms by continuing to develop and enhance focus group-tested user experience guidelines, which make granting, modifying, and revoking data access an intuitive and seamless experience.

Akin to the world before the Bluetooth Core Specification allowed wireless devices to seamlessly connect to one another, data standardization ensures an inclusive and secure environment that empowers consumers to better access data across financial accounts and use that data to better manage their finances and improve their financial health.
How can I access the FDX API standard?
The FDX API is available on the FDX website without charge for parties that accept the terms and conditions of the FDX API License Agreement. In addition, FDX membership also allows financial services stakeholders to participate in the FDX consortium, join and vote in over 25 different working groups and task forces, attend FDX’s bi-annual Global Summits and take part in the ever-growing network of financial industry organizations that are adopting and implementing the FDX API.
How will FDX interact and comply with General Data Protection Regulation (GDPR) and other privacy laws and regulations?
The FDX API standard provides the tools for secure and reliable financial records access and thus supports best practices for privacy. It is the responsibility of each organization to comply with all government regulations related to privacy. FDX makes no representations that it is GDPR-compliant.
As a global organization, how does FDX interact and work with other global data standard consortia?
FDX is currently focused on the United States and Canada, but many FDX members are global organizations and FDX is engaged in ongoing dialogue and work with other standards bodies to collaborate on innovation and implementation of best practices.
How does FDX certify implementations of the FDX API standard?
Developing the FDX API alone will not promote, drive adoption, or guarantee adherence to the standard. Consequently, a qualification and certification program are needed to ensure common implementation and interoperability of any technical standard and further limits the risk of data inaccuracy. Products (i.e., programs, services, and apps for consumer permissioned financial data sharing) can be approved by a certification program to test the technical compatibility/interoperability, prior to being marketed as a compliant product, or getting access to certain intellectual property rights.

FDX is continuing to define and build out this qualification and certification program for implementation of the FDX API standard. FDX recently released foundational requirements covering availability, performance, and security that implementations of the specification must meet and FDX has established a formal Qualification and Certification Working Group to explore the matter further.
What federal or state regulations impact the FDX API standard?
FDX technical standards can be tailored to accommodate regulatory requirements at any level of government. FDX is, by charter, neutral on the “what” of regulatory policy in this area and rather seeks to implement technical standards to accomplish the “how” of user-permissioned data sharing in a way that is responsive to market needs as well as any legal or regulatory compliance requirements.

FDX reflects the commitment of its members to provide secure and reliable access to financial records and advocates best practices for consumer transparency and consent (Five Core Principles of Data Sharing). In this, FDX reflects the industry unifying to adopt consumer protection principals that have been advocated by regulators and government agencies to date. In addition, FDX will continue to engage and work with regulators and policymakers to ensure that FDX standards provide the best technical pathway to accommodate any legislative or regulatory requirements in a given jurisdiction.
How will FDX address conflicts that have existed in the past between financial institutions, data aggregators and fintechs related to the sharing of financial data?
FDX is the result of years of work among all parties in the financial services ecosystem and has shown that unified commitment to common standards has served to resolve previous conflicts that have existed. All the members of FDX are deeply committed to providing value to the businesses and consumers that interact with all the members of FDX and are committed to building a consumer centric data sharing economy.
How do small fintechs and small regional and community financial institutions benefit from FDX?
Small fintechs and small financial institutions face unique challenges. Limited human, financial and technical resources create barriers to reaching customers and connecting to the broader financial services ecosystem

With this in mind, a non-profit standards body and a common API standard offers many benefits to small entities. First, a common interoperable standard informs the product offerings of technology service providers so that even the smallest financial institutions are able to experience and offer their customers the same common API powered services, tools and protections that are available to larger financial institutions at a fraction of the cost. Secondly, a market-led standard consortium eases the path to market and partnership by bringing the full spectrum of the financial services ecosystem together in one place and making participation and engagement very affordable. Such a model allows small fintech firms to bring innovative ideas forward so that they can be implemented in the marketplace rapidly for consumers to use their own financial data in new ways. Finally, FDX’s open membership structure allows all entities, regardless of size, to benefit and contribute to the FDX API via FDX working groups and task forces in a manner that crowdsources common industry problems and solutions and where every member’s vote is equal.
How did FDX become a subsidiary of FS-ISAC?
FDX had its origins in early 2017 as a grassroots effort led by financial institutions, financial technology companies and data aggregators that were seeking to find common ground for a secure, consumer-focused data sharing framework. Recognizing the significant progress already made by FS-ISAC’s Aggregation Working Group in the 2015-2017 time period with its Durable Data Application Programming Interface (DDA) standard, FDX became a wholly owned, independent subsidiary of FS-ISAC in 2018. FS-ISAC assigned all versions of the DDA (now known as the FDX API) to FDX in October 2018 in connection with FDX’s launch.
What global API best practices and standards does FDX adhere to?
Architecture

• OpenAPI - (OpenAPI 3.1.x or later), published in standard YAML format.
• REST - RESTful (Representational State Transfer) APIs over HTTPS
• JSON – FDX Schema Objects using JSON Schema 2020-12
• HATEOAS Links – (Hypermedia as the Engine of Application State) for contextually related properties
• Unicode UTF-8 payload in JSON Objects
• REST API Design Best Practices withJSON as the Request Response format

Security and Authentication

• HTTPS -
    • HTTP (as per IETF RFCs 7230 and RFC 7231)
    • HTTP Response, Status, and Error Codes
• TLS over HTTPS – (TLS version 1.2 or higher is mandated)
• FAPI – (FAPI 1.0 Advanced + CIBA and FAPI 1.0 Baseline) from Open ID Foundation
    • OIDC Core (part of FAPI 1.0)
• MTLS Sender Constrained Tokens – (Mutual TLS is part of FAPI 1.0)
• OAuth 2.0 Authorization Framework (IETF RFC 6749)
    • OAuth 2.0 Authorization Framework: Bearer Token Usage (IETF RFC 6750)
    • OAuth 2.0 Dynamic Client Registration (IETF RFC 7591)
    • OAuth 2.0 Step-up Authentication Protocol (IETF draft)
    • OAuth 2.0 Pushed Authorization Requests (IETF RFC 9126)
• JSON security
    • JSON Web Signature (JWS) (IETF RFC 7515)
    • JSON Web Encryption (JWE) (IETF RFC 7516)
    • JSON Web Key (JWK) (IETF RFC 7517)
    • JSON Web Algorithms (JWA) (IETF RFC 7518)
    • JSON Web Token (JWT) (IETF RFC 7519) and Nested JWT for message encryption
    • JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants (IETF RFC 7523)
• FIDO – FDX Control Considerations recommends FIDO for all biometric SCA/MFA
• NIST – FDX Control Considerations is based on the NIST Cyber Security Framework (CSF)

(Disponible en français)

What is the Financial Data Exchange (FDX)?
FDX is a nonprofit organization operating in the Canada and the US that is dedicated to unifying the financial services ecosystem around a common, interoperable, and royalty-free technical standard for the secure and convenient access of permissioned consumer and business financial data, aptly named the FDX Application Programming Interface (FDX API). FDX is governed by a diverse board of directors from across the financial services ecosystem, and FDX has a global membership that includes financial institutions, financial data aggregators, fintechs, industry utilities, payment networks, consumer groups, financial industry groups and other stakeholders involved user-permissioned financial data sharing.

All FDX members are given the opportunity to participate in the development, growth, and industry adoption of the FDX API and other objectives through FDX working groups and task forces.

FDX exists as an independent subsidiary under the umbrella of the Financial Services Information Sharing and Analysis Center (FS-ISAC), whose mission is to ensure resilience and continuity of the global financial services infrastructure.
What is the FDX Canada Working Group?
The FDX Canada Working Group includes Canadian financial institutions, fintechs, payment networks and data aggregators who are coming together with the purpose developing and adapting the FDX API financial data sharing standards for the Canadian market. The FDX Canada working group also has two related task forces. The FDX Canada Technical task force is responsible for adapting the FDX technical specifications for application in the Canadian market and the FDX Canada Government and Regulatory Engagement task force helps organize and guide FDX’s educational interactions with Canadian government representatives, policymakers, regulators, and industry stakeholders.

The FDX Canada Working Group is open to all Canadian financial industry participants involved in secure consumer-directed finance and will work within FDX to help ensure that uniquely Canadian market requirements are accurately reflected in the development and maintenance of the FDX API standard.
Why did Canadian financial services organizations launch the FDX Canada Working Group?
FDX is developing a secure and interoperable international API standard for consumer data sharing. Consequently, launching the FDX Canada Working Group gives any Canadian market participant involved in consumer-directed finance the opportunity to be engaged in defining this standard and ensuring it is responsive to the needs of Canadian consumers. Further, being a part of FDX offers Canadian financial institutions, fintechs, payment networks, data aggregators, and other interested parties the chance to work together to make consumer data sharing more secure and consumer centric in Canada.
Which organizations are currently members of the FDX Canada Working Group?
There are currently 70+ FDX member financial services organizations operating in Canada and participating in the FDX Canada working group listed here.
How is the formation of the FDX Canada Working Group related to the Canadian Government’s consultation on open banking and consumer-directed finance?
FDX Canada is an industry-led initiative that is complementary to the Canadian Government’s ongoing consultation on open banking and secure consumer-directed finance in Canada. FDX believes the full spectrum of the Canadian financial industry is best positioned to come together to develop and implement the FDX API data standard because the standard itself is flexible and can be tailored to different environments.
How is the FDX Canada Working Group organized and led?
In accordance with FDX’s structure of shared leadership between financial institutions and non-financial institutions, the FDX Canada working group is Co-chaired by Equifax Canada and CIBC. In addition, FDX Canada working group members are given the opportunity to participate in the development and growth of the FDX API standard and other objectives through other FDX working groups. Finally, Royal Bank of Canada and Interac Corp. are members of FDX’s Board of Directors as representatives of the FDX Canada working group.
Who is on the board of FDX?
The FDX board of directors is comprised of sustaining member financial institutions, financial data aggregators, permissioned parties, and financial industry groups within the user-permissioned financial data sharing ecosystem. And as mentioned above, Equifax Canada and National Bank of Canada are members of the board as representatives on behalf of the FDX Canada Working Group.

Each board group maintains a consistent number of voting seats on the board. The FDX board will oversee and direct all aspects of the development and deployment of the FDX technical standards and will set other objectives as needed.
How does contributing to the development and implementation of an international and interoperable standard benefit the Canadian ecosystem?
In today’s global economy, technical standards must be international in nature and interoperable in a multitude of jurisdictions and regulatory environments. Further, pursuit of an international standard rather than jurisdiction-specific standards ensures that the Canadian financial industry can immediately contribute to and learn from an international consortium rather than seeking to “reinvent the wheel.” The FDX Canada Working Group represents a unique opportunity for the Canadian financial industry to have an influential seat at the table of a global technical standard.
What is the FDX API technical standard, and when will it be implemented in Canada?
The FDX API (formerly Durable Data API, or DDA) standard began under the stewardship of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and offers secure authentication with a restful API for data access to accommodate existing protocols. At the public launch of FDX in October 2018, FS-ISAC assigned the DDA to FDX and renamed the FDX API.

With the standard now being a made in Canada solution with all of the Canada specific changes now in place, many FDX Canada member firms have already begun implementing the FDX API. Overall implementation timing will be tied to progress of the Department of Finance and the continued development of the FDX API technical standard in Canada and the needs of Canadian consumers.
How will FDX impact consumer permissioning or consumer control of their data?
User control and permissioning of data is being strengthened by the FDX API standard because the financial data ecosystem is unifying around a common interoperable data standard rather than a patchwork of data access tools that are often plagued by lack of interoperability, inconsistent data connectivity, quality, and governance. Specifically, the FDX API allows for users to be securely authenticated without the sharing or storing of their login credentials with third parties. In addition, FDX’s User Experience Working Group is further strengthening control and permissioning mechanisms by continuing to develop and enhance focus group-tested user experience guidelines, which make granting, modifying, and revoking data access an intuitive and seamless experience.

Akin to the world before the Bluetooth Core Specification allowed wireless devices to seamlessly connect to one another, data standardization ensures an inclusive and secure environment that empowers consumers to better access data across financial accounts and use that data to better manage their finances and improve their financial health.
As a global organization, how does FDX interact and work with other global data standard consortia?
FDX is currently focused on Canada and the United States, but many FDX members are global organizations and FDX is engaged in ongoing dialogue and work with other standards bodies to collaborate on innovation and implementation of best practices.
How will smaller fintechs, financial institutions and credit unions benefit from FDX?
Small fintechs, financial institutions and credit unions face unique challenges. Limited human, financial and technical resources create barriers to reaching customers and connecting to the broader financial services ecosystem

With this in mind, a non-profit standards body and a common API standard offers many benefits to small entities. First, a common interoperable standard informs the product offerings of technology service providers so that even the smallest financial institutions are able to experience and offer their customers the same common API powered services, tools and protections that are available to larger financial institutions at a fraction of the cost. Secondly, a market-led standard consortium eases the path to market and partnership by bringing the full spectrum of the financial services ecosystem together in one place and making participation and engagement very affordable. Such a model also allows small fintech firms to bring innovative ideas forward so that they can be implemented in the marketplace rapidly for consumers to use their own financial data in new ways. Finally, FDX’s open membership structure allows all entities, regardless of size, to benefit and contribute to the FDX API via FDX working groups and task forces in a manner that crowdsources common industry problems and solutions and where every member’s vote is equal.

Foire aux questions sur FDX Canada

Qu’est-ce que la Financial Data Exchange (FDX)?
Financial Data Exchange LLC (FDX) est une organisation sans but lucratif qui œuvre pour que le secteur financier se fédère autour d’une norme (FDX API) commune, sécuritaire, interopérable et libre de droits en finances axées sur les clients et autour de la consultation sécuritaire de données financières autorisées des entreprises et des particuliers.
Qu’est-ce que le groupe de travail de FDX Canada?
Le groupe de travail de FDX Canada réunit des institutions financières canadiennes, des entreprises de technologie financière, des réseaux de paiement et des agrégateurs de données afin d’évaluer et de développer le potentiel d’utilisation de la norme FDX API au Canada. Ouvert aux intervenants du secteur financier qui travaillent pour des finances sécurisées axées sur les clients, ce groupe de travail collaborera avec FDX pour que les besoins du marché canadien soient bien pris en compte dans la norme FDX API et ses mises à jour.
Pourquoi les sociétés canadiennes de services financiers lancent-elles le groupe de travail de FDX Canada?
FDX met au point une norme API sécuritaire, interopérable et internationale sur la transmission sécuritaire de données. Le lancement du groupe de travail FDX Canada donne ainsi aux intervenants du secteur financier qui travaillent pour des finances sécurisées axées sur les clients, la chance de participer à la définition de cette norme et de l’adapter à leurs besoins. De plus, les institutions financières canadiennes, les entreprises de technologie financière, les réseaux de paiement, les agrégateurs de données et les autres parties peuvent collaborer à davantage sécuriser la transmission des données au Canada et à l’orienter vers le client.
Quelles sont les organisations membres du groupe de travail de FDX Canada?
À l’heure actuelle, 31 organisations financières participent au lancement de FDX Canada : Blanc Labs, Banque de Montréal, Banque Nationale du Canada, Banque Royale du Canada, Banque TD, Capital One, CIBC, Desjardins, EEI, Envestnet | Yodlee, Equitable Bank, Finicity, FinTech Growth Syndicate (FGS), Flinks, Interac Corp., Intuit Canada, Inverite, KOHO, Mastercard, MX, Ninth Wave, Ozone API, Plaid, SecureKey, Simplii Financial, Tangerine, TrueLayer, TWG, Verify My Banks, Visa et Xero.
Y a-t-il un lien entre la création du groupe de travail FDX Canada et les consultations du ministère des Finances?
FDX Canada est une initiative du secteur privé, complémentaire aux consultations du ministère sur des finances sécuritaires axées sur les clients au Canada. FDX croit important de regrouper l’ensemble du secteur financier canadien pour établir et mettre en œuvre la norme FDX API, puisque celle-ci est flexible et peut être adaptée à différents environnements.
À quoi ressemblent l’organisation et la direction du groupe de travail de FDX Canada?
Conformément à la structure d’autorité partagée entre institutions financières et non financières, le groupe de travail de FDX Canada est coprésidé par Interac Corp. et la Banque TD. De plus, les membres du groupe de travail de FDX Canada peuvent participer à définir et à populariser la norme FDX API avec d’autres groupes de travail de FDX. Enfin, la Banque Royale du Canada et Interac Corp. siègent au conseil d’administration de FDX en tant que représentants du groupe de travail de FDX Canada.
Qui siège au conseil de FDX?
Composé de membres de divers milieux et pays, le conseil d’administration réunit institutions financières, agrégateurs de données, entreprises de technologie financière, réseaux de paiement, groupes de protection des consommateurs, groupes du secteur financier et autres parties autorisées de l’écosystème des finances axées sur les clients. Comme mentionné précédemment, la Banque Royale du Canada et Interac Corp. siègeront au conseil d’administration en tant que représentants du groupe de travail de FDX Canada.
En quoi la création et l’application d’une norme internationale et interopérable profitent-elles à l’écosystème canadien?
Dans une économie mondialisée, les normes techniques doivent être internationales, mais aussi interopérables avec une multitude de systèmes juridiques et de réglementations. De plus, miser sur la création d’une norme internationale plutôt que nationale, c’est donner au secteur financier canadien la chance de collaborer d’emblée avec un consortium international au lieu d’avoir à réinventer la roue.

Le groupe de travail de FDX Canada représente une occasion unique pour le secteur financier canadien d’être un acteur international important dans l’élaboration d’une grande norme technique.
Qu’est-ce que la norme technique FDX API et quand entrera-t-elle en vigueur au Canada?
D’abord élaborée sous la conduite du Financial Services Information Sharing and Analysis Center (FS-ISAC), la norme FDX API, précédemment connue sous le nom de Durable Data API ou DDA, propose une authentification sécurisée avec API RESTful pour la consultation de données conformément aux protocoles actuels. Au lancement public de FDX en octobre 2018, FS-ISAC a attribué la DDA à FDX et l’a renommée FDX API.

Son calendrier de mise en œuvre dépendra du développement de la norme technique FDX API au Canada et des besoins des particuliers canadiens.
Quel impact FDX aura-t-elle sur les autorisations ou le contrôle des particuliers sur leurs données?
Le contrôle et l’autorisation des données peut être renforcé par l’adoption de FDX API.
Avec la norme FDX API, les utilisateurs dans les marchés axés sur les clients peuvent être authentifiés en toute sécurité sans transmettre leurs identifiants de connexion à des tiers. Grâce à l’adoption généralisée de la FDX API, il est possible de transmettre les données autorisées par les particuliers entre les institutions financières, les applications d’entreprise de technologie financière, les agrégateurs de données financières et les réseaux de paiement et le crédit en ligne de façon plus sécuritaire et fiable.

Semblable à ce qui se passait avant que Bluetooth autorise la connexion directe entre appareils sans fil, l’uniformisation des données permettra aux Canadiens de mieux consulter leurs comptes financiers et d’avoir une meilleure gestion de leurs finances et de leur santé financière.
Est-ce que FDX est une organisation internationale? Quels seront ses liens avec les autres grands organismes de normalisation des données?
FDX concentre d’abord ses efforts aux États-Unis et au Canada, mais beaucoup de ses membres sont des organisations internationales. Elle collabore également avec d’autres organismes de normalisation sur l’innovation, l’interopérabilité et la mise en œuvre de bonnes pratiques.
Quel est l’intérêt de FDX pour les petites institutions financières et coopératives de crédit?
Les institutions financières de toutes tailles sont les bienvenues. La structure d’adhésion ouverte de FDX permettra à toutes les institutions financières et les fintech, sans égard à leur taille, de bénéficier et de contribuer au développement de FDX API via les groupes de travail de FDX.

Coming Soon!