managed gateway
terms

Last updated: 12th February 2024

Version 1.6

 

INTRODUCTION
TELL MONEY LIMITED (Company number 12429774) (‘Tell’) is a financial technology business, providing a range of products and services to financial institutions, businesses and consumers.

Service descriptions cover the different services offered by Tell. This description is provided for the sole purpose of giving an approximate idea of the Services. It shall not form part of any contract nor have any contractual force.

The Conditions shall apply to all provision of services by Tell.

By subscribing to Tell Gateway and using the Services, the following Conditions shall be deemed to
have been accepted by the Customer (referred to as the ‘Client’ in the Conditions).

1.1 General
The Tell Gateway service enables Account Providers to comply with the PSD2 requirement for a Dedicated Interface. It includes a co-branded developer portal, API gateway and online specification, TPP on-boarding and management, sandbox & production environments,
authorisation simulators and sandbox data.

The service provides TPPs with access to a Customer’s resources and services, where the TPP is acting as AISP and/or PISP on behalf of a user (“PSU”) of the Customer’s products. The Customer is responsible as an ASPSP, or as an agent or outsourced provider to the regulated
ASPSP, to make available a dedicated interface for such purposes, and the TPP may use the Tell gateway for such a purpose.

A TPP is able to access the developer portal, request access to sandbox and production, access support and assistance for integration, and ultimately to perform TPP activities on behalf of its users, all via the Tell service, without recourse to working directly with Tell’s
Customer / the ASPSP.

1.2 TPP Process
To begin the process, a TPP must visit the relevant developer portal and register. They will be able to view the publicly available API specification and instructions. In order to access the service, they will be prompted to enter their name, email address, phone number, and
information about their company. This information is submitted to Tell. Tell will carry out initial checks on the TPP to ensure that they are (a) registered as a TPP with the relevant competent authority and (b) that the contact details provided are valid, after which the TPP
will be granted access to the Customer’s partitioned sandbox environment. Please note that at this stage, the TPP has not been fully qualified and will not be permitted to access live services.

When granted access to the sandbox, the TPP may then register one or more “applications”. An application is a subset of their approved access and allows the TPP to operate multiple variations of the service across their estate. For example, they may operate multiple brands
under their license. For each application, the TPP must provide a set of redirect URLs.

The TPP will now be able to begin integration with the sandbox environment, including initiating consent requests and performing test actions such as resource requests (obtaining account details, balance etc.) and, where supported by the Customer and where the TPP is
also a PISP, initiating payments. All tests are ring-fenced to the sandbox environment and will not interact with any production data or environments.

When sandbox integration is completed, the TPP may create an application in production. To do so, Tell will perform a number of pre-live validations;
● Certificate validation – the TPP’s certificate will be validated against the relevant register;
● Competent authority validation – Tell will verify the TPP’s presence on the relevant
competent authorities register;
● Customer approval – where specified as a Customer Service, Tell will seek final approval from the Customer. It is highly recommended that the Customer performs adequate due diligence on the TPP to ensure that they are who they purport to be and do not
represent any form of risk to the Customer’s security or regulatory status. The Customer/ASPSP is ultimately responsible for all regulatory and legal checks.
 

When pre-live validations are complete and (where applicable) the Customer has approved the TPP, Tell will enable the application within the production environment, and the TPP can begin performing live activities.
 

1.3 Account Holder Consent, Resource Access & Initiation
To initiate a new consent, the TPP must redirect the account holder to the Tell authorisation service indicating which scope / services they require access to (account resources, payments etc). Tell will validate the TPP and its associated certificate and permissions, then authorise
the account holder in conjunction with the Customer/ASPSP and gain their consent, after which they will be redirected back to the TPP’s application along with an Authorisation Code. At this point, the TPP will exchange the Authorisation Code for an Access Token and Refresh
Token via the Tell API.

The Access Token can now be used to make requests.
 

The requests made available will depend upon the scope of services provided by the Customer.

An Access Token expires after 60 minutes, after which a new one may be obtained by the TPP using the Refresh Token.

Unless revoked by the account holder, an account access consent persists indefinitely.
 

1.4 TPP Support

As Tell is providing an enhanced level of “Premium” support, a TPP may contact Tell by email and telephone in order to gain advice and assistance, as well as for the purposes of troubleshooting and investigation.

1.5 Developer Portal
Tell Money will provide a dedicated Developer Portal. The Developer Portal is a co-branded website which is unique to the Customer and which is defined by a unique website URL, for example:
https://developer.tell.money/client-name
 

The Customer should link to the Developer Portal from their website / application in order
allow TPPs to discover their service and to begin the implementation process.
 

The Developer Portal serves a number of functions:
● A live published specification for the various APIs and services required by a TPP
● Instructions for onboarding and usage of the service
● FAQs and support information
● Initiation of the TPP onboarding process
● Usage and performance statistics
 

Tell will host and maintain the Developer Portal on behalf of the Customer. If the Customer requires any customisation or bespoke development, requirements should be shared by the Customer with their Integration Partner who will work with Tell to provide a quote to
progress the work. All customisation or bespoke development work will be agreed by the Parties prior to work commencing.
 

1.6 Authentication Service
The service includes an API Gateway and an Authentication Service. The Authentication Service is the engine which sits behind gateway and enables all secure communication with TPPs. The Authentication Service supports initiation, management, revocation and usage of
secure tokens using an OAuth methodology.

All API-based interaction with the TPP is performed by Tell and the Customer does not need to Interact with the TPP or understand / have access to any secure token elements. This is operated as a fully managed service by Tell.

The Authentication Service interacts with TPPs and is responsible for ensuring clear and PSD2-compliant operability.

The Authentication Service hands off user / customer authentication to the Customer such that the Customer can perform Secure Customer Authentication when a new consent is required. However, for the purposes of describing the Services, it is important to note that
the user / customer authentication process is decoupled from the Tell Authentication Service such that the Customer or their Integration Partner is able to perform ring-fenced validation of their end-user without recourse to, or technical interaction with, the TPP or any technical
or token-based assets within the Tell Authentication Service.

​

1.7 API Gateway
As well as the Authentication Service, Tell also provides the API Gateway. This is published on the Customer’s Developer Portal, which a TPP uses to request access to resources and / or to initiate payment requests (where applicable) on behalf of a consented user.
The API Gateway is made available in both sandbox and production.

The requests received by Tell are first run through the Authentication Service to ensure that (a) the TPP is valid by use of client credentials and certificate verification, and (b) the access token (and therefore the user’s consent) is valid. If so, the request is registered in the
platform, allocated a unique ID, and fulfilled by calling an agreed Customer endpoint.

1.8 Hosting
The platform is hosted in a serverless environment within the Amazon Web Services (AWS) estate, under an account owned and maintained by Tell.

1.9 Support & Maintenance
Tell will support and maintain the service on a 24*7 basis, 365 days per year. The service will be maintained at the Service Levels set out in the Conditions.

All consumer (end-user) support will be provided, in the first instance, by the Customer.

Where an enquiry cannot be resolved by the Customer, or where a more in-depth analysis of the issue is required, it shall be escalated to the Customer’s Integration Partner Support team who will assist to resolve the consumer enquiry. Where the Integration Partner is unable to
resolve an enquiry, they may choose to escalate to Tell.

TPP support will be provided, in the first instance, by Tell. Where an enquiry cannot be resolved by Tell, or where a more in-depth analysis of an issue is required, the enquiry shall be escalated to the Integration Partner’s Support team or the Customer’s Support team who
will assist to resolve the enquiry to the best of their ability.

The Customer acknowledges that the remit of Tell’s control ceases at the perimeter of where a third party is required. In practice, this means that Tell is responsible for all aspects of the service within its control but cannot directly control the behaviour, reliability or availability of
TPPs or of the Customer’s environment, particularly with regards to the timely and accurate delivery of information.

1.10 Term
The term of this Agreement is the period from the Effective Date to the expiry of (whichever occurs later): (i) Initial Term; (ii) any Renewed Term.

Initial Term Two 2 years from accepting this Agreement (Order Form)

Renewed Term One 1 year

1.11 Pricing

As set out in the Conditions, Tell makes a number of services and features available that are classified as Premium Services and attract a fee as agreed by the Parties (charged by the Integration Partner and payable by the Customer). Tell reserves the right to charge the
Customer directly where payment is not made via the Integration Partner.
 

An overview of the services related to this Product Tell Gateway are as follows:

​

Professional Edition

• 1 Dedicated Interface

• Unlimited API Calls

• Unlimited Connected TPPs

• Unlimited Consents Per Month

• Hosted Co-Branded Developer Portal

• Standard TPP Support

• Indirect Customer Support

• Access to Regulatory Reporting Data

• Conformance Testing & Certification

​

DEVELOPER PORTALS
The Professional Edition includes a co-branded developer portal developed and hosted by Tell Money, including Customer's logo, company name and endpoints relating to the services supported.
 

INTEGRATION TESTING
Professional Edition clients can use the Test Harness to generate calls within our Console. No knowledge of OBIE and OIDC specifications and workflows necessary.
 

CLIENT SUPPORT
Support requests should be progressed via the Integration Partner in the first instance.
 

Where the Integration Partner is unable to resolve an issue directly with a Customer, they will be able to utilise Email & telephone support during business hours, with a 4 hour response SLA.
 

CERTIFICATION
Upon request, Tell can perform end-to-end testing of an individual Customer’s implementation, following which, where successful, Tell will issue the Customer with a Certificate of Conformance. This service is chargeable.
 

THIRD PARTY PROVIDER SUPPORT
TPP support is provided by Tell Money. All enquiries are sent to us and responded to within
72 hours.

​

REGULATORY REPORTING
Customers can utilise the console to prepare and produce regulatory reporting.