Electronic Banking Internet Communication Standard
The Electronic Banking Internet Communication Standard (short: EBICS ) denotes a new, multi- bankable in Germany standard for the transmission of payment data over the Internet. EBICS dissolves after a transitional period from the previous standard BCS -FTAM, for which there is no internet protocol.
History and Future Development
The EBIC standard was from the Central Credit Committee (CCC; Today The German banking industry ) developed and incorporated January 1, 2006 in the Dial-Up Agreement. Since 1 January 2008 there is an obligation for credit institutions to support EBICS. December 31, 2010 ended for the banks the obligation to support BCS -FTAM on.
In anticipation of a possible development of a Europe-wide standard was created with the leading "E" of the acronym, the ability to change the name to " European Banking Internet Communication Standard". The French banks, represented by the Comité Français d' Organisation et de Normalisation Bancaire ( CFONB ) have with the CCC already signed a cross-border co-operation agreement for the sharing of EBICS.
As part of the introduction of SEPA EBICS will receive a decisive role. The German Bundesbank supports EBICS for submission of SEPA payment orders since January 28, 2008.
Technical details of the protocol
All data are embedded in an XML container and sent over HTTP with TLS encryption to ensure secure transmission. The data is transmitted block by block, each block and secured with an electronic signature. When transmission errors a restore function allows the resumption of transfers from the last successfully transmitted block. With regard to PKI -based models, the optional use of X.509 certificates is supported for the replacement of the current RSA key between customer and bank.
Authorization concepts
In EBICS communication as opposed to communication via F -TAM (via telephone / ISDN line ) able to get different permissions options are displayed:
1 ) This authorization concept provides that detected users are not made known to the receiving EBICS system. In the case of a payment application in which files can be collected, for example, the variant is usually considered that only a technical participant with a so-called e- signature (one signature ) initiated the transfer and provides with its electronic signature. The receiving system controls the authority to receive and performs the payment.
2 ) This authorization concept provides that detected users are made known to the receiving EBICS system. It can be used variants A signature, B- and T- signature signature (transport signature) in the normal case. For example, a detection power, which does not have signing authority in external relations is provided in the receiving system with a transport signature. The authorized signatories and similar authorized signatories of the company occur with their respective A or B signature. The system for receiving routed file then contains in addition to the payment file and the A- and B- signatures.
3 ) This Authorization concept is a reference to point 2 The difference, however, is that the signatures are not shipped in a transport request, but that the file will be sent only with a T- signature and signed only after the event with another transport request is. The advantage may be that some companies use payment services provider to create the data, but want to keep confirming the data better in their hands.
Variants of the EBICS system
Within the EBICS system distinguishes between two variants: