Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
PD ISO TS 12812 — Core Banking Mobile Financial Services Technical Specification Series
Core Banking — Mobile Financial Services (UK adoption of ISO/TS 12812)
📐 PD ISO TS 12812 is a series of Published Documents issued by the British Standards Institution (BSI) in the form of Technical Specifications (TS), corresponding to ISO/TS 12812. The series addresses financial services delivered over mobile networks and mobile devices, specifying the general framework, security and data protection, financial application lifecycle management, and mobile payments-to-persons. For mobile financial service providers, mobile network operators, banks, payment institutions and regulators, the series provides a unified reference for designing, deploying and operating compliant, secure and interoperable mobile financial services.
💡 Mobile financial services involve many parties (banks, mobile operators, agents, merchants, users), and their security and interoperability challenges are far more complex than traditional channels. The ISO/TS 12812 series is designed specifically for these characteristics.
1. Series Overview 📌
The ISO/TS 12812 series was prepared by working groups within ISO/TC 68 (Financial services); UK participation was entrusted to Technical Committee IST/12 (Financial services). A Technical Specification (TS) fixes technical requirements ahead of a full standard where refinement is still needed. Under the overall title “Core Banking — Mobile Financial Services (MFS)”, the parts cover the general framework, security and data protection, financial application lifecycle management, and mobile payment applications, forming a complete technical system for the mobile financial ecosystem.
⚠️ This series is a Technical Specification; its requirements should be applied together with local financial regulatory rules (e.g. anti-money laundering, payment services directives, data protection regulations).
2. Structure and Technical Highlights 🧩
The series mainly comprises the following parts, summarised by number, topic and core content.
| Standard | Topic | Core content |
|---|---|---|
| PD ISO/TS 12812-1:2017 | General framework for mobile financial services | MFS concepts, parties and roles, business models, interoperability requirements (not in this batch; scanned part) |
| PD ISO/TS 12812-2:2017 | Security and data protection for mobile financial services | Security management considerations, authentication, encryption, key management, device security, data protection and privacy, technical summary of clauses |
| PD ISO/TS 12812-3:2017 | Financial application lifecycle management | Basic principles of application lifecycle management, portability of MFS, participating institutions, application issuance and management |
| PD ISO/TS 12812-4:2017 | Mobile payments-to-persons | Concepts, user expectations, stakeholders (provider, operator, agent), transaction model and technical requirements |
| PD ISO/TS 12812-5:2017 | Mobile payments-to-businesses (scanned) | Merchant-oriented mobile payment applications and technical requirements |
⚠️ In this batch PD ISO/TS 12812-5 (and Part 1) is a scanned version; its content is written from public-domain knowledge. For detailed clauses, refer to the official BSI publication.
3. Key Technical Requirements 🔥
3.1 Security and data protection for mobile financial services (Part 2)
The core risks of mobile financial services are identity impersonation, transaction tampering, device loss and data leakage. The part specifies security management considerations (risk analysis and control strategy), user and server authentication methods, transport and storage encryption, key management, device security (e.g. SIM/secure element), application hardening, and data protection and privacy requirements. It summarises the technical nature of the clauses, providing a starting point for security architecture design.
3.2 Financial application lifecycle management (Part 3)
The full lifecycle of a financial application (payment wallet, banking app) — issuance, download, initialisation, update and decommissioning — needs unified management. The part specifies the basic principles of application lifecycle management, portability requirements of MFS, and the responsibilities of participating institutions (banks, operators, platform providers) in application issuance and management, ensuring safe and controlled distribution and operation.
3.3 Mobile payments-to-persons (Part 4)
Mobile P2P payments allow users to transfer funds between phones. The part describes the concepts of mobile P2P payments, user expectations, stakeholders (mobile financial service provider, mobile network operator, agent, etc.) and their responsibilities, and provides transaction models and technical implementation requirements (e.g. account identification, fund transfer, notification and reconciliation), supporting convenient yet secure person-to-person payments.
✅ Practice note: Security of mobile financial services is not a single-point issue but end-to-end protection across “identity + device + transport + data + application”. Implement a security baseline per Part 2, control the application lifecycle per Part 3, and standardise payment flows per Part 4/5, while meeting local regulatory requirements.
4. Engineering Practice 🛠️
- 🔍 Service design: define the business model and party responsibilities per the general framework, and design account and payment flows.
- 📊 Security compliance: build authentication, encryption, key management and data protection per Part 2, and pass security assessment.
- 📐 Application management: plan distribution, update, decommissioning and exit mechanisms for mobile financial applications per Part 3.
- 📋 Payment operations: standardise P2P and P2B payment flows per Part 4/5, and organise clearing, reconciliation and monitoring.
5. FAQ ❓
Q1: How do mobile financial services differ from online banking?
A: Mobile financial services rely on mobile networks and devices, involve more parties such as mobile operators, and have more complex security and interoperability requirements.
A: Mobile financial services rely on mobile networks and devices, involve more parties such as mobile operators, and have more complex security and interoperability requirements.
Q2: Why is device security especially important for mobile payments?
A: Phones are easily lost, stolen or controlled by malware; authentication credentials and keys must be protected in conjunction with device security or a secure element.
A: Phones are easily lost, stolen or controlled by malware; authentication credentials and keys must be protected in conjunction with device security or a secure element.
Q3: What does financial application lifecycle management solve?
A: It ensures the application is secure, controllable and traceable from issuance to decommissioning, preventing tampering or illegal distribution.
A: It ensures the application is secure, controllable and traceable from issuance to decommissioning, preventing tampering or illegal distribution.
Q4: What are the core steps of P2P mobile payment?
A: Account identifier resolution, transaction authorisation, fund transfer, notification and reconciliation, plus abnormal transaction monitoring.
A: Account identifier resolution, transaction authorisation, fund transfer, notification and reconciliation, plus abnormal transaction monitoring.
Q5: Can this series be used directly as a compliance basis?
A: It is a Technical Specification providing technical requirements; financial business compliance must still satisfy local regulations (payment services, AML, data protection).
A: It is a Technical Specification providing technical requirements; financial business compliance must still satisfy local regulations (payment services, AML, data protection).