Payment Credential Issuance (TS12)

The Payment Credential Issuance extension enables an Account Servicing Payment Service Provider (ASPSP) to issue SCA Attestations to its customers' EUDI Wallets. The issued attestation represents a payment account, a card, or the authenticated user, and is later used to authorise payments or grant account access as defined in the TS12 Electronic Payments SCA Implementation with Wallet specification.

How it works

1. The organisation enables the Payment Credential Issuance extension from the dashboard.
2. An administrator selects which SCA Attestation types to issue and configures the attributes included in each type.
3. When a customer requests a payment credential, an OpenID4VCI credential offer is generated by the issuer.
4. The customer accepts the offer in their EUDI Wallet, authenticates with the bank, and the wallet completes the authorisation code flow.
5. The system issues the SCA Attestation as an SD-JWT VC with a key binding to the wallet, ready to be used for SCA.

Configuration

SCA Attestation types

Select which attestation types the issuer will offer:

Attestation	Description	Key attributes
Account attestation	Represents a payment account	iban, bic, currency, account_holder_name
Card attestation	Represents a payment card	scheme, pan_last_four, expiry
User attestation	Represents the authenticated user only	given_name, family_name, user identifier

Common attributes on every SCA Attestation include the issuer and audience identifiers, the validity period (iat, nbf, exp), the credential type identifier (vct), and the key binding (cnf) to the wallet.

Issuance settings

Setting	Description
Credential format	vc+sd-jwt (SD-JWT VC)
Validity period	Lifetime of the issued attestation
Issuance flow	Authorization Code flow (OpenID4VCI)
Batch issuance	Whether multiple attestations are issued in a single request

Integration

Once configured, the system exposes the standard OpenID4VCI endpoints for discovery and issuance of SCA Attestations.

API endpoints:

• GET/v3/config/extension/payment-issuance - Retrieve current configuration
• PUT/v3/config/extension/payment-issuance - Update issuance settings

Caution: Disabling the Payment Credential Issuance extension deletes its configuration. Previously issued attestations remain valid until their expiry but cannot be refreshed from this issuer. This action is not reversible.