EBICS 3.0 in the home stretch

By 22 November this year at the latest, the time will have come. From that day on, German payment service providers are obliged to offer their corporate customers EBICS 3.0, to be precise EBICS 3.0.1, alongside the previous version 2.5. For Switzerland, SIX has also issued a recommendation for the support of EBICS 3.0 from November 2021, and in France, EBICS 3.0 can already be officially offered by financial service providers since January 2018.

The Deutsche Bundesbank has announced that it will switch completely to EBICS 3.0 from 22 November 2021 for a transitional period of one year. EBA CLEARING has a similar position regarding its EBICS services.

What does the EBICS changeover mean for all those involved in EBICS?

Financial institutions and financial service providers are preparing for November 2021. EBICS 3.0-capable systems are already in use in many cases. It is possible that EBICS 3.0 has merely not yet been activated.

For the transition period from EBICS 2.x to EBICS 3.0, the specified or agreed BTF and order type mappings must be stored on bank side and corporate customer side. They can be discontinued later if no order types or FileFormat parameters are specified for new EBICS business transactions in the future. 

All parties should consider the crypto life cycle (see crypto life cycle on https://www.ebics.org/en) for EBICS before migrating to EBICS 3.0. This includes minimum key lengths, key procedures, and TLS requirements that must be met. Due to the key procedures it defines, EBICS 2.3 will automatically expire on 22 November.

All this requires the latest EBICS software. Corporate customers should therefore arrange for an EBICS 3.0 update of their EBICS clients at an early stage so that they can react to the EBICS changeover of the financial institutions. In order to avoid a time-consuming reinitialisation, corresponding EBICS and key updates should already be completed on client side before the bank-side shutdown of key procedures and lengths as well as EBICS versions. The key updates may be required to migrate to EBICS 3.0.

Since the text-based customer protocol (order type PTK) is no longer specified for EBICS 3.0, financial institutions may no longer offer it for EBICS 3.0. If the customer protocol monitoring of corporate customers is still based on the PTK, an early changeover to the XML-based HAC is recommended for them.

Corporate customers can also look forward to a few new functions that EBICS 3.0 provides. These include the technical double submission check, the optional specification of the original file name when uploading and the EDS flag (EDS= electronic distributed signature), with which the corporate customer can directly control whether the submitted order should undergo the EDS process or be checked directly. 

Those are some of the relevant points that I would like to share with you to help you cross the finish line successfully. Ultimately, it is important to be prepared for the approaching EBICS changeover and to take the necessary precautions.

And what about you? Have you already started your final sprint to EBICS 3.0?

Author: Michael Lembcke