Blog series: How to enhance EBICS, Part 4 – Every person gets their own bank statement

A large proportion of the data that I get from a bank computer as a corporate client relates to an account. But how can I control, already at the point of access, which of my employees can obtain which bank statements for this data? Controls on the bank’s side can be helpful here.


EBICS regulates the provision and collection of any data via order types and format parameters. The data format relating to the order type ultimately determines the processing options in the EBICS bank computer. However, the actual content of the data provision and collection is not regulated via EBICS; therefore, this can differ from one EBICS bank computer to another, and from bank to bank.

Which EBICS subscriber receives which account information?

The data that employees obtain as EBICS subscribers is usually provided for each customer as a download on the bank computer. Every EBICS subscriber of the customer’s that has the relevant order type receives all the data available for the customer. This also applies to account-related data such as bank statements and interim transactions. When an EBICS data collection is performed, the account authorisation of the EBICS subscriber is not checked, but it is checked when payment transaction orders are submitted in the customer-bank relationship. EBICS itself does not provide for any account details in the EBICS message. Account-related checks and processing depend on the implementation of the bank computer – and essentially also on whether the account details for the data to be provided are complete and the accounts are found.

Account authorisation for obtaining data

In certain cases, an EBICS subscriber should only receive information for certain accounts. An obvious solution would be to provide the data per subscriber instead of per customer. However, because the data relates to the corporate customer, when there are multiple subscribers per customer this leads to redundant data and therefore an increased data volume. Therefore, it is preferable to store the data per customer as usual and control the collection of the data by means of the subscriber’s account authorisation (if the data is actually account-related). In this way, the subscriber always obtains precisely the data for all the accounts for which they are authorised.

It would make sense to also have an EBICS enhancement that allows one or even multiple accounts to be entered in the EBICS request – similarly to entering a time period in the historical request. With this EBICS function, an EBICS subscriber could optionally also obtain data for specific accounts. It is not always important to the subscriber for the account information for all accounts to be up-to-date. A corresponding EBICS enhancement enables a more targeted data collection and ultimately provides the customer with more flexibility when accessing accounts.

Michael Lembcke