PUBLIC 2023-10-19 © 2023 SAP SE or an SAP affiliate company. All rights reserved. Bank Preboarding Guide for SAP Multi-Bank Connectivity THE BEST RUN Content 1 Document History. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2 About This Guide. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 3 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 4 Organization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6 5 Connection Methods Available. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 5.1 Host-to-Host. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 5.2 Member Bank. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 5.3 EBICS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 6 Security Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 7 Message Types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 8 Sharing Bank Connection Template/Bank's Own Documentation Responses. . . . . . . . . . . . . . 19 9 Next Steps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 10 Glossary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 2 PUBLIC Bank Preboarding Guide for SAP Multi-Bank Connectivity Content 1 Document History Version Status Date Change 1.0 Released to Customer 16-May-2019 Initial Release 1.1 Released to Customer 07-Aug-2019 EBICS section added 1.2 Final 22-Oct-2019 IP Range replaced with link to Help page 1.3 Final 24-Feb-2021 Revised for complying with Inclusive Language Guidelines 1.4 Final Bank Preboarding Guide for SAP Multi-Bank Connectivity Document History 31-Mar-2022 Revised outdated details PUBLIC 3 2 About This Guide This guide provides information to financial institutions for onboarding to SAP Multi-Bank Connectivity. To onboard to SAP Multi-Bank Connectivity, a few preparatory steps are necessary before the kick-off call with the customer. This document describes the necessary preparation prior to kicking off the onboarding, which is vital to using SAP Multi-Bank Connectivity. Target Audience This document is for the technical implementation teams involved in the integration and onboarding process, potentially including: • • • • 4 Implementation and integration teams System administrators Information security officers Network administrators PUBLIC Bank Preboarding Guide for SAP Multi-Bank Connectivity About This Guide 3 Introduction SAP Multi-Bank Connectivity is an innovative on demand solution that connects financial institutions and other financial service providers with their corporate customers on a secure network owned and managed by SAP. The network offers multiple services in one single channel while supporting the deployment of new services. As key benefits, the solution simplifies connectivity, automates financial transactions, reduces payment rejection rates, eases reconciliation, and provides enhanced visibility to corporate treasury. Related Documentation SAP Multi-Bank Connectivity Product Page SAP Multi-Bank Connectivity Help Bank Connection Template You may have your own documentation containing the relevant technical information about your test and production environment to be provided at a later point, or you may need to complete the Bank Connection Template, or you may need to submit both. The relevant documentation to be completed and submitted depends on the information available in the bank's own documentation. The following sections provide information and guidance for completing the Bank Connection Template or the bank's own documentation. The template includes the following main sections: • • • Your organization and team details Connectivity Messages Bank Preboarding Guide for SAP Multi-Bank Connectivity Introduction PUBLIC 5 4 Organization SAP recommends that one person coordinates all relevant parties needed to complete the Bank Connection Template. The first portion of the template is related to organizational information in relation to your bank. Bank Details The following information is required: • • Bank address Bank Identification Code (BIC): Please provide the BIC for your organization relevant to the integration for your corporate customers through SAP Multi-Bank Connectivity. Your Onboarding Team SAP determines the technical information required to build connectivity for onboarding to SAP Multi-Bank Connectivity. Therefore, it’s essential to compose your onboarding team accordingly. Assembling the members of your team is very important. In some cases, all or some of these roles may be performed by the same person. Roles may include: • • Project Lead: Keeps the integration project running smoothly from start to finish. Security and Network Lead: Provides technical information in relation to connection and encryption methods used by the bank. This person may be responsible for certificate and key procurement, along with IP and host allowlisting. • Messaging Expert: Assists with messaging formats used. Advises on standards, regulations, and special message formats used. • Support Lead: Key point of contact for support issues post go-live. Once the connection is activated, the support contact assists with any issues. • Technical Lead: Provides the expertise and task delegation from an integration point of view – acts as the link between the various technical teams. You’ll be asked to state if you have previously performed B2B or cloud integrations in the past. If yes, please state how many you have completed. Corporate Connection If your organization has corporate customer IDs to uniquely identify your customers, please provide SAP with the IDs. 6 PUBLIC Bank Preboarding Guide for SAP Multi-Bank Connectivity Organization Environments You need a test and a production environment during the onboarding process. In the template, please confirm that you have a test and a production environment for integrating to SAP Multi-Bank Connectivity. The test system is used to simulate and test connectivity, validation, and file transmission. Once testing is completed for all applicable scenarios, the production system will be activated. Bank Preboarding Guide for SAP Multi-Bank Connectivity Organization PUBLIC 7 5 Connection Methods Available The decision on which connection type to use for the onboarding depends on the agreement made between the corporate customer and the bank. SAP offers the following options when setting up a connection with SAP Multi-Bank Connectivity: • Host-to-Host: A host-to-host connection sends messages from the corporate system to the corporate tenant and then to a bank back-end system. • SWIFT: A SWIFT connection sends messages from the corporate tenants to SWIFT tenants and then SWIFT transfers it to the bank back-end system. SAP Multi-Bank Connectivity customers who are also existing SWIFT customers or who wish to become a SWIFT customer can now access SWIFT banks through SAP Multi-Bank Connectivity. Note Disclaimer: SWIFT is not an option for all banks. • Member Bank: A member bank means that a bank has its own bank tenant. This means that messages are exchanged using this tenant. If a bank has several corporate connections, this is the best option as it reduces the number of direct connections from multiple corporates. Note Disclaimer: Member bank is not an option for all banks – it depends on the banks that have subscribed with SAP Multi-Bank Connectivity. If you are not sure if your bank is a member bank, ask your account executive. • EBICS: The Electronic Banking Internet Communication Standard (EBICS) adapter allows SAP Multi-Bank Connectivity and corporates to communicate with banks using the EBICS protocol. 5.1 8 Host-to-Host PUBLIC Bank Preboarding Guide for SAP Multi-Bank Connectivity Connection Methods Available Host-to-host (H2H) is an automated solution for high volume data transfer between banks and their corporate clients. In a host-to-host scenario, your organization is connected directly to the corporate customer’s tenant in SAP Multi-Bank Connectivity. Host-to-Host Connection Methods SAP Multi-Bank Connectivity offers the following connection methods: • • • SFTP Push/Pull SSH SOAP AS2 For banks, SAP recommends self-hosted connectivity SFTP for message exchange as it provides simple and effective scalability options. SFTP – Recommended Secure File Transfer Protocol (SFTP) provides file access, file transfer, and file management over any reliable data stream. SFTP using Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over a network. • SFTP Connections SSH is the default authentication method for SFTP connections using the Push/Pull scenario. • Non-SFTP Connections For non-SFTP connections, your system must mutually authenticate using X.509/SSL certificates. SAP has a list of trusted certificate authorities that include the most common, globally recognized certificate authorities. Note Please ensure that you have or procure different certificates for your TEST/QA and PROD environments, that they are signed by a trusted SAP certificate authority, and that they are valid for at least two years. Web Services SAP also offers connectivity using SOAP. SOAP Simple Object Access Protocol (SOAP) is a protocol designed to exchange information in the form of Web services. It’s primarily based on XML documents exchanged over HTTP. Bank Preboarding Guide for SAP Multi-Bank Connectivity Connection Methods Available PUBLIC 9 SOAP Web services are generally based on a Web Services Description Language (WSDL), which is an XML contract that defines the data and services offered by a given Web service. The client and the server use this contract for exchanging information and making remote procedural calls. If you choose SOAP in the Bank Connection Template, you’ll be requested to provide an endpoint for your test and production environments. AS2 AS2 is a direct point-to-point connection. Messages are transmitted securely using HTTP and S/MIME. If you choose AS2 in the Bank Connection Template, you’ll be requested to provide the following information: • • Endpoints for your test and production environments AS2 IDs for your test and production environments Communication Patterns SAP Multi-Bank Connectivity supports two communication patterns: • • Push/Pull Push/Push This section outlines the communication patterns and use cases. Push/Pull – Default for SFTP In this scenario, SAP Multi-Bank Connectivity pushes data to a bank's hosted server, and SAP Multi-Bank Connectivity pulls response data from the bank's server. Example: SFTP server is on the bank's side An SFTP server is hosted by the bank. SAP Multi-Bank Connectivity tenant acts as an SFTP client Inbound SAP Multi-Bank Connectivity tenant pushes file to SFTP @Bank inbox Outbound SAP Multi-Bank Connectivity tenant pulls responses from SFTP @Bank outbox 10 PUBLIC Bank Preboarding Guide for SAP Multi-Bank Connectivity Connection Methods Available Push/Push – Default for Web Services In this scenario, SAP Multi-Bank Connectivity pushes data to the bank's hosted server and the bank pushes response and reconciliation data back to SAP Multi-Bank Connectivity. Note If these scenarios aren’t suitable for your organization, please inform SAP in the Bank Connection Template. 5.2 Member Bank As part of your subscription, you'll be provided with one test and one productive tenant in the SAP Multi-Bank Connectivity network. Note When a tenant is provided as part of your SAP Multi-Bank Connectivity member bank, an S-user is assigned to your tenant. The SAP Multi-Bank Connectivity team requires this user number and user name to enable access to your tenant for the SAP Multi-Bank Connectivity Onboarding team. Please provide the S-user ID for your tenants. Bank Preboarding Guide for SAP Multi-Bank Connectivity Connection Methods Available PUBLIC 11 S-user: When a member bank subscription is signed, an S-user is assigned to the test and productive tenants. This S-user usually equates to the same person who signs the contract. It's important for you to determine who the S-user is in your organization and determine if that person wishes to continue as the administrator for your organization. SAP recommends that this S-user be one of your technical leads. More information on S-users can be found here 5.3 . EBICS The Electronic Banking Internet Communication Standard (EBICS) adapter allows SAP Multi-Bank Connectivity and corporates to communicate with banks using the EBICS protocol. For more information, visit the EBICS Web site . EBICS is a transmission protocol created by the German Central Credit Committee and it's used for the secure transmission of financial data. It operates as a message protocol over HTTP(S) with XML as the underlying message structure. Further development and maintenance of the EBICS standard is done by the EBICS SC. Supported Versions EBICS 2.4 and 2.5 DK and EBICS 3.0 are currently supported. For more information on EBICS 3.0, see the following SAP Multi-Bank Connectivity What's New topic: EBICS 3.0 Support. 12 PUBLIC Bank Preboarding Guide for SAP Multi-Bank Connectivity Connection Methods Available 6 Security Requirements To set up a secure connection between a customer system and SAP Multi-Bank Connectivity, several artifacts must be exchanged, such as public keys for Transport Layer Security (TLS) and Message Layer Security (MLS) encryption/decryption. In addition, it may be necessary to allowlist SAP IP ranges depending on your firewall position. The artifacts required depend on connectivity options and security levels. Note Security artifacts will be required for your test and productive systems. IP Allowlisting To onboard to SAP Multi-Bank Connectivity, you may need to allowlist SAP hostnames and IP ranges for SFTP and Web service connection. If you’re using SFTP and your firewall is in front of the SFTP server, you must allowlist. Please check with your network administrator. To ensure a smooth onboarding project, if allowlisting is necessary, please do so before starting the connectivity to SAP Multi-Bank Connectivity. This is a mandatory requirement. If you're required to complete the Bank Connection Template, you’ll be asked to confirm that you have allowlisted the necessary ranges. Confirm the appropriate ranges to be allowlisted with SAP Multi-Bank Connectivity as it depends on the customer’s data center. For a list of IP ranges, see Regions and Hosts Available for the Neo Environment. Transport Layer Security (TLS) TLS is a cryptographic protocol designed to provide communication security over a network. The primary goal of the TLS protocol is to provide privacy and data integrity between two communicating applications, for example, between a client (bank system) and a server such as the SAP Business Technology Platform load balancer. As part of the onboarding process, you’ll be asked to provide TLS security artifacts for your test and productive environments. Note The same security artifacts can’t be used for your test and production environments. You’ll be asked to upload your test and production security artifacts. If you can’t provide these artifacts, you can provide the date when you'll agree to provide each of these artifacts to SAP. Bank Preboarding Guide for SAP Multi-Bank Connectivity Security Requirements PUBLIC 13 Note Providing a date is a mandatory question to proceed with the Bank Connection Template. Message Layer Security (MLS) MLS ensures the integrity and privacy of messages through encryption and signing using public and private keys. While TLS provides a secure channel for data to pass through, MLS provides an additional layer of security to message content. Message level security is strongly recommended in TEST and PROD environments. In the template, you'll be asked if you’ll be using MLS. If you're using MLS, ensure that you have one of the following: • • PKCS7 certificates (signed or self-signed) for your TEST and PROD environments PGP public keys (OpenPGP Standard) for your TEST and PROD environments Please ensure these are available before starting the onboarding process and that they are valid for at least two years. You’ll be able to upload these public certificates in the template. If you can’t use MLS, please inform your corporate customer. You’ll be asked in the template if you have notified the customer regarding this. Related Information Certificate Requirements and Trusted Certificate Authorities 14 PUBLIC Bank Preboarding Guide for SAP Multi-Bank Connectivity Security Requirements 7 Message Types Inbound and outbound refers to the messages going in and out from your organization. The following is a list of recommended message and file formats exchanged with a corporate customer. The message type is made of the instrument type, such as credit transfer, the definition, and message format, for example, PAIN.001 in XML. There may be other format types, such as SWIFT MT message types, or bespoke message types specific to a corporate to bank relationship. Please select or enter the file formats you can accept and select or enter the payment status report formats and statement file types you send. Please advise the corporate customer if the file formats you intend to exchange with the customer are not listed here. Corporate Customer Files In the Bank Connection Template/bank's own documentation, you indicate if you support IS0 20022 Payment Message Formats. If you don’t support ISO 20022 Standards, please inform the customer. Structure Format Message Name ISO 20022 PAIN.001.001.03 Customer Credit Transfer Initiation ISO 20022 PAIN.008.001.02 Customer Direct Debit Initiation Responses Files In the template/documentation, please specify if you support the following Payment Status Report Format. This file will be sent from your system in response to the corporate customer sending a PAIN.001.001.03 or PAIN.008.001.02 file. Structure Format Message Name ISO 20022 PAIN.002.001.03 Customer Payment Status Report In the template/documentation, please specify which Statement File Types your system will send to the corporate customer. Bank Preboarding Guide for SAP Multi-Bank Connectivity Message Types PUBLIC 15 Structure Format Message Name ISO 20022 CAMT.053.001.02 Bank to Customer Statement ISO 20022 CAMT.052.001.02 Bank to Customer Account Report Delimited Text MT940 Previous day customer statement Delimited Text MT942 Current day customer Report Delimited Text (Previous or current day) BAI/BAI2 statements Previous Day Statement or Current Day Report Rules and Constraints of Message Usage In the template/documentation, please describe any constraints or rules that are in place regarding message usage. Sometimes a message field may have an associated rule or constraint that isn’t part of ISO or other standardized rulesets. These rules may be part of an approach agreed between a customer and a specific bank. Implementation Guideline for Message Types In the template/documentation, please indicate if you follow specific implementation guidelines for messages. Implementation guideline documents are sometimes provided by a bank to define how the bank expects to receive a message. Some banks may comply fully with ISO rules. Therefore, there will be no difference between their implementation guidelines and ISO rules. However, in some cases, an implementation guideline contains variances that a corporate customer needs to review as part of onboarding. File Naming Convention Banks require certain elements in a file name so that their systems know where to send a payment for processing. SAP Multi-Bank Connectivity also uses a file naming convention. SAP Multi-Bank Connectivity requires certain elements in the file name to know where to route a file (receiver), how to handle the file, and how to populate the SAP Multi-Bank Connectivity header fields based on file type. The SAP Multi-Bank Connectivity header is applied to outgoing messages from a corporate customer to a bank. The header wraps the message payload with fields such as Sender ID, Receiver ID, and Message Type, which are used to determine routing in SAP Multi-Bank Connectivity. 16 PUBLIC Bank Preboarding Guide for SAP Multi-Bank Connectivity Message Types In the template/documentation, indicate the type of files the banks require, if any. If none, please follow the SAP Multi-Bank Connectivity format. The customer can implement the bank’s routing at the SAP S/4HANA side (this is preferable as it allows consistency from SAP S/4HANA through to the bank). If you can’t use the SAP Multi-Bank Connectivity file naming convention, then SAP must use content in the file to route the file to the receiver. Inbound from SAP Multi-Bank Connectivity to Bank The format of the SAP Multi-Bank Connectivity file naming convention for messages from SAP Multi-Bank Connectivity to a bank is as follows: • Corporate Customer ID – usually agreed on with the bank how the bank identifies their corporate customer • • File Type – for example, PAIN.001.001.03; PAIN.008.001.02 Unique Message ID – for example, SAP Multi-Bank Connectivity Header <MessageId> element Example: Customer123_PAIN001v3_1234567890.xml Outbound from Bank to SAP Multi-Bank Connectivity The format of the SAP Multi-Bank Connectivity file naming convention for messages from SAP Multi-Bank Connectivity to a bank is as follows: • • • Corporate Customer ID – usually agreed on with the bank how the bank identifies their corporate customer File Type – for example, PAIN.002.001.03; CAMT.053.001.02; MT940 Unique Message ID Example: Customer123_CAMT053v2_9012345678.xml In the template, please indicate for which files you can follow the SAP Multi-Bank Connectivity file naming convention. If you can’t use the SAP Multi-Bank Connectivity file naming convention, please indicate what data in a message is used to determine the receiver and file type. SAP needs information about the receiver of a message and the type of message. Sample Message Payload Please prepare one sample payload message file (XML or flat file) for each of the following: • • • Payment File (expected inbound format) Customer Payment Status Reports Customer Statements The template includes one section to upload all sample files. To ensure that files reach a receiver bank in the expected format, this is a mandatory step in the onboarding process for validation purposes. If you can’t provide sample files, please provide a date when the files will be available. Bank Preboarding Guide for SAP Multi-Bank Connectivity Message Types PUBLIC 17 Related Information ISO Standards 18 PUBLIC Bank Preboarding Guide for SAP Multi-Bank Connectivity Message Types 8 Sharing Bank Connection Template/ Bank's Own Documentation Responses The corporate customer may ask SAP to share your answers to the Bank Connection Template. If you agree, please give your consent in the relevant section of the template. Bank Preboarding Guide for SAP Multi-Bank Connectivity Sharing Bank Connection Template/Bank's Own Documentation Responses PUBLIC 19 9 Next Steps 1. Please perform all tasks in this guide to prepare for completing the Bank Connection Template. The template captures your technical and business integration scoping choices and collects your keys, certificates, and other integration artifacts where applicable. It is vital that preparatory steps identified in this document are completed before starting the template. 2. When you complete the Bank Connection Template, the SAP Multi-Bank Connectivity Onboarding team reviews your responses and communicates the onboarding sequencing. 3. For queries relating to this guide or the Bank Connection Template, contact the SAP Multi-Bank Connectivity Onboarding team: sapmbconboarding@sap.com 20 PUBLIC Bank Preboarding Guide for SAP Multi-Bank Connectivity Next Steps 10 Glossary For an overview of terms and abbreviations regularly used in SAP Multi-Bank Connectivity, please have a look at the glossary. Please use the comment function there if you think a term is missing and should be added. Related Information Glossary Bank Preboarding Guide for SAP Multi-Bank Connectivity Glossary PUBLIC 21 Important Disclaimers and Legal Information Hyperlinks Some links are classified by an icon and/or a mouseover text. These links provide additional information. About the icons: • Links with the icon : You are entering a Web site that is not hosted by SAP. By using such links, you agree (unless expressly stated otherwise in your agreements with SAP) to this: • • • The content of the linked-to site is not SAP documentation. You may not infer any product claims against SAP based on this information. SAP does not agree or disagree with the content on the linked-to site, nor does SAP warrant the availability and correctness. SAP shall not be liable for any damages caused by the use of such content unless damages have been caused by SAP's gross negligence or willful misconduct. Links with the icon : You are leaving the documentation for that particular SAP product or service and are entering an SAP-hosted Web site. By using such links, you agree that (unless expressly stated otherwise in your agreements with SAP) you may not infer any product claims against SAP based on this information. Videos Hosted on External Platforms Some videos may point to third-party video hosting platforms. SAP cannot guarantee the future availability of videos stored on these platforms. Furthermore, any advertisements or other content hosted on these platforms (for example, suggested videos or by navigating to other videos hosted on the same site), are not within the control or responsibility of SAP. Beta and Other Experimental Features Experimental features are not part of the officially delivered scope that SAP guarantees for future releases. This means that experimental features may be changed by SAP at any time for any reason without notice. Experimental features are not for productive use. You may not demonstrate, test, examine, evaluate or otherwise use the experimental features in a live operating environment or with data that has not been sufficiently backed up. The purpose of experimental features is to get feedback early on, allowing customers and partners to influence the future product accordingly. By providing your feedback (e.g. in the SAP Community), you accept that intellectual property rights of the contributions or derivative works shall remain the exclusive property of SAP. Example Code Any software coding and/or code snippets are examples. They are not for productive use. The example code is only intended to better explain and visualize the syntax and phrasing rules. SAP does not warrant the correctness and completeness of the example code. SAP shall not be liable for errors or damages caused by the use of example code unless damages have been caused by SAP's gross negligence or willful misconduct. Bias-Free Language SAP supports a culture of diversity and inclusion. Whenever possible, we use unbiased language in our documentation to refer to people of all cultures, ethnicities, genders, and abilities. 22 PUBLIC Bank Preboarding Guide for SAP Multi-Bank Connectivity Important Disclaimers and Legal Information Bank Preboarding Guide for SAP Multi-Bank Connectivity Important Disclaimers and Legal Information PUBLIC 23 www.sap.com/contactsap © 2023 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. The information contained herein may be changed without prior notice. Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies. Please see https://www.sap.com/about/legal/trademark.html for additional trademark information and notices. THE BEST RUN