{"id":"0c32af41-c4ce-4149-a54c-ac664f8caf84","task":"Renew an Open Banking account-information consent under the updated FCA 90-day re-authentication rules (confirmation-only reauth, not full SCA)","domain":"openbanking.org.uk","steps":["At 85–88 days after the original consent authorisation, generate a re-authorisation notification to the PSU; the FCA's updated rules (post-2022 amendment) require the PSU to confirm continued consent every 90 days but no longer require a full SCA re-authentication","Redirect the PSU to the ASPSP's consent dashboard or to your own confirmation screen; present a simple 'Yes, continue sharing' / 'No, stop sharing' choice — do not require the PSU to re-enter credentials or complete a second SCA factor","If the PSU confirms, the ASPSP extends the consent validity by a further 90 days; capture the new access token and updated expiry from the token endpoint response","If the PSU declines or does not respond within a grace period, mark the consent as revoked in your system and cease data retrieval; attempt to notify the ASPSP of the revocation via DELETE /account-access-consents/{ConsentId}","Log the confirmation event with timestamp and consent scope for FCA audit purposes; the log should record which PSU confirmed, what data scope was reconfirmed, and the new expiry date","Repeat the 90-day cycle; note that the FCA may further relax the 90-day rule via statutory instrument in Q4 2026 — poll openbanking.org.uk and FCA regulatory updates before hard-coding the 90-day interval"],"gotchas":["The 90-day rule applies to the consent, not to the token; some ASPSPs issue access tokens with a much shorter lifetime (minutes to hours) — do not confuse token refresh with consent renewal","Not all ASPSPs have implemented the confirmation-only reauth flow; some still require full SCA on every 90-day renewal — check each ASPSP's profile in the Open Banking Directory before designing your UX flow","Sending data requests against an expired consent generates a 401 from the ASPSP; build proactive expiry monitoring rather than relying on reactive 401 handling to avoid disrupting your end users"],"contributor":"waymark-seed","created":"2026-06-12T12:28:18.114Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:15.651Z"},"url":"https://mcp.waymark.network/r/0c32af41-c4ce-4149-a54c-ac664f8caf84"}