Banca Móvil LABORAL Kutxa — API integration & OpenFinance services

1. Account & transaction APIs

Wraps the XS2A accounts, balances and transactions endpoints behind a single REST surface. Returns IBAN, currency, product code, opening/closing balance, and per-row creditor name, remittance information, value date and end-to-end ID. Used for automated bank reconciliation in tools such as Holded, Sage 50, Odoo or a custom ERP module.

2. Card movement & geolocation

Mirrors the Banca Móvil card screens that show every purchase with the merchant's location on a map. We surface the same payload — masked PAN, merchant category code (MCC), authorization status, geolocation — for fraud monitoring, expense management or loyalty back-ends.

3. Bizum & LK-Pay reconciliation

Bizum is integrated natively in the Laboral Kutxa app and is one of Spain's dominant mobile-money rails (covering ~99% of Spanish current-account holders). Our adapter joins Bizum receive events to the underlying account ledger so you can reconcile P2P credits against marketplace orders, donations or NGO campaigns.

4. Securities, DISPON loans & insurance

Reads the user's stock portfolio (positions, working orders, last quote), surfaces DISPON pre-approved loan offers, and exposes the active insurance policies plus claim status. Useful for wealth dashboards or for integrating Laboral Kutxa data into a multi-bank PFM.

5. ATM / branch finder & assistance

Since 2024 the app's branch and ATM finder ships with an Augmented Reality overlay; we expose the same dataset (latitude, longitude, opening hours, services available) as a plain GeoJSON feed, so kiosk apps, white-label assistants and chatbots can answer "nearest Laboral Kutxa branch" without scraping.

6. SEPA Credit Transfer initiation

Implements the XS2A payments/sepa-credit-transfers initiation including SCA redirect/decoupled flows, status polling and cancellation. Returns the paymentId and end-to-end identifier for downstream invoicing systems.

Scenario A — Multi-bank treasury for Basque SMEs

Many Mondragón-area cooperatives hold their main current account at Laboral Kutxa and a secondary at Kutxabank or BBVA. We pull balances and the last 90 days of transactions from each XS2A profile, normalise them to a single ledger schema, and post a daily cash-position report into Slack or Microsoft Teams. The OpenFinance angle: one consent per bank, one unified treasury view, no manual CSV downloads.

Scenario B — Bizum-driven invoice reconciliation

An online shop accepts Bizum on a Laboral Kutxa merchant account. Each incoming Bizum credit lands on the current account with a remittance line that includes the order ID. Our adapter listens (via short-poll on /transactions), extracts the order ID with a regex contract, and marks the matching invoice as PAID inside the merchant's ERP. The "OpenData" payoff is end-to-end auto-clearing without a payment-gateway middleman.

Scenario C — Wealth aggregation for an independent advisor

A regulated wealth advisor in San Sebastián consolidates client positions across Laboral Kutxa, Bankinter and Renta 4. We read the securities portfolio (positions, working orders, last quote) under explicit AISP consent, refresh nightly, and feed a portfolio-attribution dashboard. Because Laboral Kutxa exposes the broker side under the same login, a single consent covers cash and securities together.

Scenario D — Embedded assistance for an insurance broker

The Laboral Kutxa app already bundles tow-truck and locksmith dispatch inside its insurance section. We replicate that flow on the broker's own portal: read the active policy via the protocol, file a claim, and trigger the assistance number — without sending the customer back into the bank's app. The protocol-analysis angle keeps user credentials inside the bank session and only mirrors the displayed data.

Scenario E — Compliance-grade audit feed for a fintech aggregator

An EU-licensed AISP needs to prove to its regulator that every consent, every refresh and every dataset version is traceable. We deliver a write-once log table (consent ID, scope, SCA event, response hash, timestamp) on top of the Laboral Kutxa adapter, mapped to the EBA's PSD2 reporting taxonomy.

1. Consent & account list (PSD2 XS2A, Berlin Group)

# Step 1 — create an AIS consent against the Redsys hub
POST https://psd2-sandbox.redsys.es/api-entrada-xs2a/services/laboralkutxa/v1.1/consents
X-Request-ID: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721
PSU-IP-Address: 203.0.113.10
TPP-Redirect-URI: https://your-app.example/callback
Content-Type: application/json
Authorization: Bearer <TPP_QWAC_BEARER>

{
  "access": {
    "balances": [{"iban": "ES9130350031121234567890"}],
    "transactions": [{"iban": "ES9130350031121234567890"}]
  },
  "recurringIndicator": true,
  "validUntil": "2026-10-30",
  "frequencyPerDay": 4
}

# Response
{ "consentId": "f1c8...c3", "consentStatus": "received",
  "_links": { "scaRedirect": { "href": "https://..." } } }

2. Statement export (90-day window, paged)

# Step 2 — pull booked + pending transactions
GET /api-entrada-xs2a/services/laboralkutxa/v1.1/accounts/{account-id}/transactions
    ?bookingStatus=both&dateFrom=2026-02-03&dateTo=2026-05-03
Consent-ID: f1c8...c3
X-Request-ID: 11d47b...
Authorization: Bearer <TPP_QWAC_BEARER>

# Response (excerpt)
{
  "transactions": {
    "booked": [
      { "transactionId": "TX-2026-04-29-001",
        "bookingDate": "2026-04-29", "valueDate": "2026-04-29",
        "transactionAmount": {"amount": "-42.30", "currency": "EUR"},
        "creditorName": "EROSKI BIDEBARRIETA",
        "remittanceInformationUnstructured": "COMPRA TARJETA 4548**1234"
      }
    ],
    "pending": [],
    "_links": {"next": {"href": "...&page=2"}}
  }
}

3. SEPA Credit Transfer initiation + SCA

# Step 3 — initiate a single SEPA payment
POST /api-entrada-xs2a/services/laboralkutxa/v1.1/payments/sepa-credit-transfers
TPP-Redirect-URI: https://your-app.example/sca-return
PSU-IP-Address: 203.0.113.10
Content-Type: application/json

{
  "instructedAmount": {"amount": "150.00", "currency": "EUR"},
  "debtorAccount": {"iban": "ES9130350031121234567890"},
  "creditorAccount": {"iban": "ES7100750000010599999999"},
  "creditorName": "Cooperativa Mondragon SCL",
  "remittanceInformationUnstructured": "Invoice 2026-04-117"
}

# Response
{ "transactionStatus": "RCVD",
  "paymentId": "PMT-2026-05-03-981",
  "_links": { "scaRedirect": {"href": "https://..."},
              "self": {"href": "/payments/sepa-credit-transfers/PMT-2026-05-03-981"} } }

# Error (HTTP 400)
{ "tppMessages": [{"category":"ERROR","code":"FORMAT_ERROR",
  "text":"creditorAccount.iban failed checksum"}] }

Regulatory baseline

Production access to Banca Móvil LABORAL Kutxa data is governed by the EU revised Payment Services Directive (PSD2), supervised in Spain by Banco de España, plus the EBA RTS on Strong Customer Authentication. All flows we deliver run over the Redsys-hosted NextGenPSD2 XS2A hub published by the Berlin Group, with eIDAS QWAC for transport and QSeal where signing is required.

Privacy & data minimization

Personal data extracted from the app — IBANs, names, transactions — falls under the EU GDPR and Spain's LOPDGDD. Our adapter records consent scope, validity window (≤180 days) and SCA renewal events. Card PANs are tokenised at ingestion; only masked PANs and BINs ever leave the bank-side perimeter.

About us

OpenFinance Lab is an independent studio focused on mobile fintech protocol analysis and OpenBanking-style API integration. Our engineers come from EU payment institutions, Spanish acquirers, and TPP aggregators, and have shipped XS2A-grade adapters against the Redsys hub, the BBVA Open Platform and the EBA-listed sandbox banks. We deliver runnable Python / Node.js / Go source plus the OpenAPI spec, test harness and a compliance brief.

• PSD2 XS2A integrations against Redsys, Treezor and bank-built hubs
• Bizum & SEPA Instant reconciliation modules
• Securities, insurance and PFM data adapters
• End-to-end audit trail for AISP/PISP regulatory reporting
• Source code delivery from $300 — runnable API source & full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — hosted endpoints, pay only per call; no upfront cost

Contact

To request a quote, share an integration brief, or kick off a Banca Móvil LABORAL Kutxa adapter, open our contact page:

Contact page

We typically respond within one business day; NDAs available on request.

Engagement workflow

1. Scope confirmation: which surfaces (accounts, Bizum, cards, securities) and which output channels.
2. Sandbox bring-up against the Redsys XS2A sandbox (1–2 business days).
3. Adapter build, retry/backoff, consent-renewal helpers (3–8 business days).
4. OpenAPI spec, integration tests, compliance brief (1–2 business days).
5. Production cutover with the client's QWAC certificate; first delivery 5–15 business days end-to-end.

FAQ

Do I need a TPP license to call the Laboral Kutxa PSD2 endpoints?

How long does a Laboral Kutxa integration usually take?

What about PSD2 strong customer authentication and SCA renewal?

Can you also integrate the LK-Pay app and Bizum on top?