Tool 92 · Open Banking & APIs · Cat-5

SCA Exemption Calculator
+ Consent Scope Mapper + FAPI Generator

Three engines in one: deterministic SCA exemption eligibility under EBA RTS 2023 + UK FCA guidance; consent scope translation across UK OB v3.1, EU PSD3, AU CDR, and US CFPB 1033/FDX; and FAPI 1.0/2.0 JWT payload generation via browser-native WebCrypto. Zero network transit, zero PII.

Zero PII · Client-Side Only EBA RTS 2023 · UK FCA SCA-RTS FAPI 1.0 · FAPI 2.0 WebCrypto PKCE
Transaction Parameters
Excluded MCCs (gambling, securities, money lending) block TRA exemption per EBA RTS Art. 18.
Risk & Context Parameters
Your ASPSP's rolling fraud rate for this instrument type. Must be below EBA RTS thresholds to qualify for TRA exemption.
No data leaves your browser. Tab close = data gone. All logic runs locally via deterministic JS rules.

This engine implements the EBA Final Report on Guidelines on Exemptions from SCA (EBA/GL/2022/15) and UK FCA SCA-RTS as amended. Thresholds are deterministic and sourced from published regulatory texts. This tool does not constitute legal or compliance advice.

Tool 91
Consent Dashboard Builder
Design consent flows this tool maps → Tool 91
FAPI Security Header Validator
Validate FAPI payloads from Tab 3 → AINumbers.co
All 92+ Fintech Tools
Full tool index →
Jurisdiction Translation
Scopes to Translate
Use the canonical scope names for the selected source jurisdiction. UK OB uses PascalCase PermissionCodes.
Scope mapping runs entirely in-browser. No consent data is transmitted.

UK Open Banking v3.1: OBIE PermissionCodes are the canonical scope identifiers used in consent objects. v3.1.10 is the current production standard; some scopes (e.g. ReadTransactionsDetail) are deprecated in favour of separate credit/debit scopes.

EU PSD3/PSR: PSD3 uses high-level data categories (payment_accounts, account_balance, account_transactions) rather than granular permission codes. Scope mapping from OBIE is therefore often partial.

US CFPB 1033 / FDX v5: FDX uses data cluster identifiers (accounts:read, accounts:balance:read). The CFPB 1033 rule (finalized Oct 2024) does not prescribe specific scope names but delegates to FDX as the recognised standard body. Some OBIE concepts (e.g. Offers, Statements) have no direct FDX equivalent.

AU CDR: CDR scopes follow the bank:accounts.basic:read pattern under the Consumer Data Standards. CDR Data Holders must support all CDR-designated scopes within their sector.

PKCE Code Verifier / Challenge

Generate a cryptographically secure PKCE pair using browser-native crypto.getRandomValues() and crypto.subtle.digest('SHA-256'). No private key is generated or stored. Required for FAPI 1.0 RW and FAPI 2.0 conformance.

Mock JWT Authorization Request

Assemble a FAPI-conformant authorization request payload. All values are synthetic — no private key signing is performed. The signature section is explicitly labeled as a placeholder.

Crypto operations use browser-native WebCrypto API. No keys are generated, stored, or transmitted. Signature sections are explicit placeholders. Use only synthetic test values.