Where the FI provides APIs, including open APIs used by third parties such as FinTech firms, it should have safeguards for secure development and provisioning: a vetting process for third parties connecting via APIs based on nature of business, cyber security posture, reputation and track record; a risk assessment before connection, with each API's implementation commensurate with the sensitivity, criticality and confidentiality and integrity needs of the data; security standards for API design including protection of API keys and access tokens and an enforced token expiry; strong encryption and key management for sensitive data in transit; security screening and testing with the third party before production; logging of third-party access sessions (identity, date and time, data accessed); real-time monitoring and alerting on API use and performance with prompt revocation of keys or tokens on a breach; and adequate capacity for high call volumes with measures against denial of service.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.