Verifying the hash value of the bank keys in the EBICS initialisation request

EBICS transactions are divided into different phases: initialisation, data transfer and acknowledgement (the latter only for download transactions).

The scope of the initialisation includes, among other things, checks of the following aspects:

- Order type

- Authentication signature

- Hash values of the bank keys

- User-related authorisations

Only once the initialisation is successfully completed does the transaction continue with the transfer phase, during which the actual order data is sent. The hash values of the bank keys are checked during initialisation to ensure that the client uses the current bank keys. If the check is not successful, the server sends the return code EBICS_BANK_PUBKEY_UPDATE_REQUIRED. For the client, this indicates that the most recent bank keys should be downloaded by means of the order type HPB.

Before the EBICS 3.0 harmonisation, the bank keys could be used directly or within certificates. As per EBICS specification, up to EBICS 3.0 the hash values of the public bank keys must be specified in the transaction initialisation – irrespective of whether it is certificates or keys that are exchanged with the bank.

As of EBICS 3.0, certificates are mandatory for key management. In this context it was decided that both for uploads and for downloads, the hash values of the certificates will have to be specified in EBICS initialisation requests in the future.

Usually the manufacturers of EBICS bank servers enable their customers to have a gradual transition by allowing them to specify both the bank keys and the certificates in DER format. This means that customers do not have to perform a download via the order type HPB after the migration to EBICS 3.0. Both keys and certificates can be specified either in a specification compliant hex layout or in an alternative Base64 layout. A mixture of both layouts in one request is usually not intended.

By the way: with EBICS 3.0, the key management has been unified not only for bank keys, but also for user keys. It is thus now mandatory to initialise users with certificates not only in France (CFONB), but in all countries. Usually EBICS bank servers allow for a gradual transition in this aspect, as well. User keys with a minimum length of 2.048 bits can also be used for EBICS 3.0. For key updates (order types HCA, HCS and PUB) new certificates can usually be signed with the keys of older EBICS versions.
CA-based certificates are still only used in France. From the bank server perspective, however, nothing should stand in the way of introducing them in other countries.


Author: Hendrik Chlosta

gpi and EBICS – how do they work together?

Isn't gpi purely a SWIFT topic? At first glance it might be. The abbreviation originates from SWIFT and means "Global Payments Innovation". The gpi initiative was launched at the end of 2015 and was already broadly supported by many global financial institutions.

gpi is based on the unique end-to-end transaction reference (abbr. UETR), which accompanies a payment throughout the sometimes long correspondence bank chain. The reference may be a monstrosity of 36 characters in a format defined by a universal algorithm (xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx), but that monstrosity ensures an end-to-end uniqueness without an "issuing authority". Though initially, the UETR was only used in a CUG (closed user group) for (corporate) customer payments in MT103 messages, by now all payments in the FIN network have such a reference – a reference that remains unchanged throughout the entire payment process chain.

The second substantial part of gpi is the so-called Tracker. The Tracker is a central database for all gpi payments and is hosted at SWIFT. It provides the participating banks with comprehensive information on the status of payments in the correspondent bank chain, on fees and on currency conversion rates. While the FIN transport reads this information directly from the transported messages, non-FIN banks can also actively inform the Tracker. Currently under discussion is the so-called confirmation – a notification on the credit arriving in the beneficiary's account at the end of the payment process chain. As of 2020, all FIN banks shall be obligated to use the confirmation.

But why all this effort? gpi tackles the two core challenges in correspondent banking – transparency and speed. The extensive use of the UETR has yielded statistical data: on average, 40 percent of the gpi credit transfers are booked on the account of the end beneficiary within five minutes, 50 percent within 30 minutes, 75 percent within six hours, and almost all of them within 24 hours. Such a statement was simply impossible to make before gpi. On the contrary, all treasurers have experienced cases of payments arriving too late or not at all, with high, inexplicable fees, and with unclear or missing purpose information.

In addition to technical details such the UETR and Tracker, gpi provides a rulebook that stipulates the preferably same-day forwarding of a payment with complete remittance information and specification of deducted fees and currency conversion details. As there is no global transparency guideline, these stipulations have to be enforced on the basis of multi-lateral contracts. And that is a good thing – it's about time.

The (corporate) customer shall receive better service in cross-border payments. Aside from speed and transparency, another aspect is the acknowledgement. Acknowledgements, or receipts, have so far been used in cash transactions only. In electronic payments, the motto was mostly "shoot and forget". If no complaints come in, the money must have reached its destination. Recent years have seen a remarkable development in the SEPA, and with instant payments according to the SCTinst scheme, electronic payments now have acknowledgements, too. With SWIFT gpi, such an acknowledgement can also be generated, even if it (still) requires a complete FIN chain in the settlement process. However, there is a long way left to go: so far, the broad, bank-internal implementations have been in the focus. The connection of customer systems for access to the information or even for forwarding of statuses and fee information to the customer system is still in its early stages. But alone the possibility to check on a payment's status via a central database in case of doubts shows considerable progress in the vast correspondent bank network.

Is this potential only applicable to FIN? Not at all. Current developments, e.g. the migration of real-time gross settlement systems (RTGS) such as TARGET2, EURO1 or CHAPS from MT to XML messages according to the ISO 20022 standard, are going in this direction. The (newer) ISO message formats contain dedicated fields for the UETR, meaning that the reference is transferred outside the FIN network, as well. Just recently, SWIFT made an announcement: "SWIFT trials instant cross-border gpi payments through TIPS"[1].

For the connection of gpi return messages to customer systems such as TMS or ERP, PSR messages (payment status reports, i.e. pain.002) are more efficient than manual processes. These self-services alone are already a significant step towards more transparency. By the way, the standards for these return messages, i.e. fields (tags) and codes, were made multi-bank compatible in the harmonisation initiative CGI-MP. PPI is now also actively partaking in this initiative.

Furthermore, the customers shall be enabled to initiate their reference in the payment as UETR – in the pain.001.001.03 within special fields according to the CGI-MP, or even in more current ISO versions within dedicated fields.

This customer-bank or bank-customer interface is where both customer payments and PSR return messages are often also transferred via EBICS. Which means that gpi and EBICS do not contradict each other, but are rather complementary concepts – as is often the case in payments.

Author: Dr. Mario Reichel

[1] Source: https://www.swift.com/news-events/press-releases/swift-trials-instant-cross-border-gpi-payments-through-tipshttps://www.swift.com/news-events/press-releases/swift-trials-instant-cross-border-gpi-payments-through-tips

EBICS tests with customers in a productive bank server?

As of EBICS 2.4, in France it is possible to not use the business transactions with 3-character order types that are customary in Germany and other countries, but to instead exchange FileFormat parameters of up to 40 characters. These must each be introduced with the FUL or FDL order types. Here, it is possible to specify a so-called test flag. Using this flag, during the productive operation, an EBICS customer can make a test submission and signal this to the financial institution, for example when sending a file. Provided that there is a bilateral agreement on the use of the test flag, the financial institution may accept the order, classify it as a test case and separate it prior to the actual processing. The use of a test flag in the running operation is not uncontroversial to the financial institutions. Presently, the German financial institutions mainly reject such an option.

With the current EBICS version 3.0 and the unified use of BTFs instead of order types and FileFormat parameters the existing test flag is omitted in the EBICS specification. In addition, with the EBICS CR EB-17-01 Element Group Parameter a stricter check of the use of not bilaterally agreed upon specifications in the generic parameters of the BTF has been introduced. Specifications that are not permitted are now rejected with the EBICS return code 09-0-0-06: EBICS_UNSUPPORTED_REQUEST_FOR_ORDER_INSTANCE.

To assist with the introduction of EBICS 3.0 in France, the French CFONB has created their own migration guidelines (EBICS 3.0 Aide à la migration BTF & Table de correspondance File Format/BTF). Since in France the test flag has been used by financial institutions in the past and there will continue to be a need for such an option in the future, for the BTF migration the CFONB has defined the use of the test mode for BTF and added it as an optional feature in the guidelines. Therefore, in the case of bilateral agreements between the financial institution and the customer even for BTF the parameter TEST can be used in test cases. If the specification of the parameters differs, a rejection occurs with the return code mentioned above. EBICS bank servers and EBICS clients can optionally offer this functionality.

Independent from this, for EBICS there is also the alternative to use business transactions (BTFs) that have been especially agreed upon bilaterally for the test submissions.

In the end, however, it must be noted that when using the test option in the production environment there is always a risk that the test data may negatively affect the production or even unexpectedly be introduced into the production data.

The more secure option then remains to have an own EBICS bank server installation for EBICS tests with customers. And why not?


Author: Michael Lembcke

Standardisation and automation in external asset manager relations thanks to EBICS

External asset managers (EAMs) offer their wealthy private customers or institutional customers such as pension funds and insurance companies a multitude of services (for example, tax and real estate consulting as well as trading and investment transactions). The customer accounts are usually held at one or more custodian banks. Interactions with the financial institutions are often neither standardised nor automated. Communication by mail, telephone, e-mail and sometimes even fax dominates everyday business.

Few big asset managers have a SWIFT connection and are using it for treasury and foreign currency transactions (message category 3), securities transactions (message category 5), precious metal transactions (message category 6) or cash management transactions (message category 9). Some have implemented proprietary system-to-system connections, for example via FTP, to exchange financial messages. In Switzerland we are currently observing a trend towards EBICS as an alternative connection type for these use cases.

During the PPI Petit Déjeuner in April 2019 in Lausanne, a representative of Credit Suisse presented the offer "Private swift Network (PsN)". It deals with the extension of the EBICS service scope in the sense that about 20 new EBICS order types (reports for download) based on the EAM use cases mentioned above are available. Thanks to their cooperation with leading software manufacturers of portfolio management systems (such as Allocare or Expersoft), Credit Suisse achieves a significantly higher level of standardisation and automation when interacting with their partners. In concrete terms, the SWIFT messages of the above message categories can now also be transferred via EBICS.

As the EBICS protocol is flexible with regard to the content transferred, Credit Suisse additionally offers other formats like CSV or XML for reporting on the transactions and assets, including the master data of the respective customer depositories. All players stand to profit from the new offer: asset managers can connect more financial institutions via EBICS at low cost and automate their processes, software manufacturers can effectively extend their functional scope, and financial institutions can boost their appeal for EAMs. Viewed across all parties and processes, the error rate decreases and the implementation speed increases through elimination of manual operations.

Swiss financial institutions that are currently implementing projects in this area are already planning the next steps of the EBICS offer extension. In addition to the reporting functions (EBICS download), the order functions (EBICS upload) shall also be offered in the future. Especially orders in the trading business (SWIFT message category 5) are well-suited for uploads via EBICS. Particularly stock exchange orders (like SWIFT MT502) shall be transmitted from the asset manager to the financial institution. In the same way as the known payment order interfaces, the stock exchange interfaces are connected on bank side. The use of an EDS is also conceivable in this context.

In conclusion:

The first financial institutions in Switzerland are extending their EBICS offer beyond the use cases of payments. The Credit Suisse offer for medium and larger asset managers paves the way for EBICS in the EAM customer market and will likely prompt others to follow suit. Software manufacturers of portfolio management systems are slowly but surely learning to understand the EBICS protocol and extending their connectivity options with this connection type. When it comes to formats and standards that may be transferred via EBICS in the future, there are no limits to the possibilities. It is safe to say that for a certain customer segment, EBICS presents a viable alternative to the communication via SWIFT even in domains outside of payments.

Carsten Miehling

You are a bank customer and you are using EBICS: Will your EBICS monitoring still work with EBICS 3.0?

Since EBICS 2.5, EBICS clients cannot only use the purely text-based customer protocol but also an XML-based customer protocol for monitoring EBICS processes and results. The XML-based customer protocol is particularly suitable for automated evaluations. For downloading the protocol from the EBICS server, the EBICS client can use the order type PTK for the text-based protocol and the order type HAC for the XML-based protocol. With EBICS 3.0, the text-based protocol is no longer part of the specification. Moreover, changes of the HAC protocol have to be considered during automated result evaluation. Due to the required overall version interoperability, these changes partly affect EBICS clients of previous EBICS versions too, if an EBICS bank server supports EBICS 3.0.

Hence, software manufacturers and EBICS users must be prepared for changes of EBICS clients that already provide functions for the automated customer protocol evaluation. First, a change from PTK to HAC should be performed for automated evaluations in EBICS clients. Furthermore, users of the HAC protocol must be aware that with EBICS 3.0 the final HAC protocol is displayed differently.

Up to now, the HAC end flag with the identifiers ORDER_HAC_FINAL_POS and ORDER_HAC_FINAL_NEG has provided information on whether the submission was positive or negative. With EBICS 3.0, only the HAC end flag ORDER_HAC_FINAL is still available which informs on the submission’s result in conjunction with the last reasons code only. The final code DS04, for example, stands for the order’s rejection whereas code DS05 proves that the order was successfully submitted and forwarded to the bank system. Further reason codes have to be considered.

To make sure that your EBICS monitoring will still provide the correct results, I recommend to rely on the HAC customer protocol and to focus on the evaluation of the reason codes. This way, you can easily keep track of the EBICS communication with your financial institution.



Michael Lembcke

Migration to EBICS 3.0 in France

EBICS 3.0 entered into force in France on 27 November last year. A good two months have passed since then and we think this is a good time to assess the progress of the migration to the new version.

The aim of this new version is to harmonise EBICS and thus ensure the following: 

  • a uniform EBICS version in all countries in which EBICS is used
  • uniform identification of BTF (Business Transaction Formats)
  • a uniform X.509 format for filing the key

The date of entry into force only applies to French financial institutions and is not mandatory for corporate customers. The latter can decide for themselves when they would like to migrate.

The big French financial institutions have been working on the migration projects for several months and most of them are now able to offer their customers the EBICS 3.0 channel. The others are in the final testing phase and will soon be opening the EBICS 3.0 channel.

The smaller financial institutions have not reached this stage yet. Only a few have started their migration projects and much suggests that they will only be able to offer the EBICS 3.0 channel in a few months' time, possibly even in 2020.

However, these differences in time implementation should not pose a hindrance to corporate customers keen to migrate to EBICS 3.0 in the near future. For in a transition phase of some length, even financial institutions that have already migrated to EBICS 3.0 will continue to support the 2.4.2 version that has been in force since EBICS was introduced in France (version 2.5 is currently used in Germany). This transition phase will give corporate customers time to update their client software.

Due, however, to a lack of interest in the new version, particularly on the part of corporate customers, the transition phase could drag on. To prevent this from happening, the financial institutions can offer their corporate customers additional services that will become possible with the extensions of the new version. These include simpler setup of transfers and the electronic distributed signature. The latter allows corporate customers to sign orders asynchronously after file transfer (in version 2.4.2, the electronic signature had to be sent together with the order file), thereby offering them greater mobility.

The impact of this will be particularly felt when the X.509 certificates are completely virtual and the mobile signature can really be used. Experts are working on this subject and efficient solutions can therefore be expected in a few months...

Marc Dutech 


How EBICS can be improved (Part 10) - EBICS downloads based on date and time specifications

In payments, it is becoming increasingly important for bank customers to be kept up to date on intraday payment movements, especially since the introduction of new procedures such as instant payments. This development also poses new challenges for the EBICS standard in the corporate customer business. EBICS customers usually have to actively retrieve information on payment movements from the bank server. The so-called historical download with date specification is the suitable method, especially for corporate customers using several EBICS clients. As, however, the historical download through EBICS is only specified to the day, in practice large volumes of data are downloaded several times intraday. Moreover, business timestamps for EBICS depend on the provision format and are therefore at best specified to the day and at worst simply not available on the bank server. The downloading clients then have the task of automatically filtering the redundantly downloaded data. Such behaviour currently places significant additional burdens on all systems involved, both on the part of the customers as well as the banks.

This situation could be remedied by extending the EBICS specification by defining specified time-controlled downloads.

In this case, the EBICS server would support an additional variant of the historical download. Unlike the previous standardised historical EBICS download, the time would now also be taken into account for the start and end times. Moreover, the stated times and dates should always refer to the time and date of provision. This would enable the EBICS server to deliver all data records that had been provided within the specified time period. For more flexible handling, it should also be permissible when making download requests to specify in each case only one of both times and dates. Otherwise, the download would behave in the same way as the previous standard download in the acknowledgement phase.

I think specifying such a uniform solution for all EBICS users in the EBICS standard could refine the download process for EBICS, reduce the burden on servers and significantly improve the process, especially given the growing need to be kept up to date. This would make the proprietary solutions already used in EBICS products superfluous.


Michael Lembcke