EBICS Banking Protocol

Exchange files directly with your banks from Odoo, with no portal and nobody logging in.

EBICS, the Electronic Banking Internet Communication Standard, is the channel European banks open to companies that want their software to talk to the bank. Bank statements are downloaded on a schedule and payment files are uploaded from Odoo, authenticated by your own cryptographic keys instead of a login page.

This module implements that protocol in Odoo. It has been developed and maintained by Noviat since 2015, on every major version of Odoo from 8.0 onwards, which matters when a bank connection has to survive your next migration.

If you are still working out whether EBICS is the right channel for you, we explain it without the jargon, with screen recordings of the flow in Odoo, on noviat.com/ebics.

Statements come down as camt.053 or camt.052 files, payment files go up as pain.001 or pain.008, and your keys stay on your own server

What you get

Statements that arrive on their own. A scheduled task collects the files your bank publishes, for every account, and processes them into bank statements.
Payments that leave the same way. A payment batch or a payment order is uploaded to the bank in the format the bank expects, without exporting a file and re-uploading it somewhere else.
Several companies, one connection. Keys are held per bank rather than per company: when fifteen entities bank with the same institution, the bank sends a single daily file carrying fifteen statements and the module puts each statement in the right company.
No bank credentials in Odoo. The connection uses your own company keys, generated on your side and kept on your server. Access to the EBICS configuration is a permission of its own ('EBICS Manager'), separate from ordinary accounting rights.
A test mode, where your bank offers one. French banks accept a test flag, so a file can be submitted and validated before anything is switched to production. German and Swiss banks generally do not: there the first payment is a real one, kept small and sent to an account you control.
A trace of every exchange. Each download and each upload is a record, with the file it carried, the moment it happened and the user behind it.

EBICS 2.4, EBICS 2.5 and EBICS 3.0 are supported. EBICS 3.0, the current specification since December 2022, names what is exchanged with BTF instead of the country-specific order type codes of EBICS 2.x. Many banks still run 2.4 or 2.5 in parallel.

What travels over the link

Coming in: camt.053 for the end of day statement, camt.052 for intraday movements where the bank offers them, and national formats such as the French CFONB.
Going out: pain.001 for credit transfers and pain.008 for direct debits, generated by Odoo from your payment batches.

We do not process MT940 statements: the format carries bank and country specific variations, and the Odoo community stopped maintaining a general parser for it after Odoo 10. Where a bank publishes camt.053 alongside it, which is now the usual case, that is the format to use.

Which banks

Any bank that publishes an EBICS access point can be connected. The standard is maintained by EBICS SC, a company held by the German, French, Swiss and Austrian banking bodies (DK, CFONB, SIX and PSA), and it is the standard corporate channel in those countries.

To check a specific bank before you start, joonis publishes a public directory at joonis.de/en/fintech/banks. Enter a BIC and it returns the SEPA services the bank offers, the EBICS versions it supports and its Host-ID.

A bank missing from that directory is not a no: it is joonis' own list, not an official register. Ask your bank whether it publishes an EBICS access point.

What it costs

This module is free software, published under LGPL-3. There is no licence fee, no subscription and no per-connection charge from Noviat.

It does however rely on the fintech library from joonis, and that library requires a commercial licence for production use: as soon as you upload SEPA files with more than five transactions, retrieve statements older than the last three days, or use the distributed signature. The licence is contracted directly with joonis, not with Noviat.

joonis charges a one-off setup fee plus a monthly fee per EBICS user id. Current pricing is published on joonis.de.

Your bank may also charge a subscription for the EBICS channel itself. It varies from one bank to another and is billed by the bank, separately from anything on the Odoo side.

Requirements

The module depends upon

Because the connection needs a Python library and your key files on the server, it runs on Odoo.sh or on an on-premise installation.

Remark:

The EBICS 'Test Mode' for uploading orders requires fintech 4.3.4 or higher for EBICS 2.x and fintech 7.2.7 or higher for EBICS 3.0.

SWIFT 3SKey support requires fintech 6.4 or higher.

Fintech license

If you have a valid fintech.ebics license, you should add the following licensing parameters to the [options] section of the odoo server configuration file:

fintech_register_name

The name of the licensee.

fintech_register_keycode

The keycode of the licensed version.

Example:

; fintech
fintech_register_name = MyCompany
fintech_register_keycode = AB1CD-E2FG-3H-IJ4K-5L

Companion modules

account_ebics_oe

Required if you are running Odoo Enterprise

Cf. https://github.com/Noviat/account_ebics

account_ebics_batch

This module adds a cron job for the automated import of EBICS files.

Cf. https://github.com/Noviat/account_ebics

account_ebics_batch_payment

Recommended if you are using the Odoo Enterprise account_batch_payment module

Cf. https://github.com/Noviat/account_ebics

account_ebics_payment_order

Required if you are using the OCA account_payment_order module.

Cf. https://github.com/OCA/bank-payment

account_usability

Recommended if you have multiple financial journals. This module adds a number of accounting menu entries such as bank statement list view which allows to see all statements downloaded via the ir.cron automated EBICS download.

Cf. https://github.com/OCA/account-financial-tools

account_statement_import_fr_cfonb

Required to handle french CFONB files.

Cf. https://github.com/OCA/l10n_france

account_statement_import_camt

Required to handle camt.052 and camt.054 files.

Cf. https://github.com/OCA/bank-statement-import

Getting your bank online

The configuration on the Odoo side takes fifteen to thirty minutes. What sets the pace of a project is the bank, and it is almost never for a technical reason:

The bank opens the access. You receive the host ID, the address of the access point, your partner and user identifiers, and a letter carrying the hash values of the bank's keys.
INI and HIA. Odoo generates your key pairs for signature, authentication and encryption, sends the public keys to the bank and produces the initialisation letters, which you print, sign and send. The bank compares them by hand with the keys it received online.
HPB. Once the bank has activated your access, you retrieve its public keys and compare their hash values with the letter it sent you. That comparison is what makes the channel trustworthy.
The first exchange. Statements come down first. Payments follow, as a test file where the bank supports the test flag, otherwise as a real transfer of a small amount.

Count in weeks per bank rather than days, and start the contract and the paperwork early.

Configuration

Go to Settings > Users

Add the users that are authorised to maintain the EBICS configuration to the 'EBICS Manager' Group.

Go to Accounting > Configuration > Miscellaneous > EBICS > EBICS File Formats

Check if the EBICS File formats that you want to process in Odoo are defined.

Most commonly used formats for which support is available in Odoo should be there already.

Please open an issue on https://github.com/Noviat/account_ebics to report missing EBICS File Formats.

For File Formats of type 'Downloads' you can also specify a 'Download Process Method'.

This is the method that will be executed when hitting the 'Process' button on the downloaded file.

The following methods are currently available:

cfonb120
camt.053
camt.052
camt.054

All these methods require complimentary modules to be installed (cf. Companion modules supra).

You'll get an error message when the required module is not installed on your Odoo instance.

Go to Accounting > Configuration > Miscellaneous > EBICS > EBICS Configuration

Configure your EBICS configuration according to the contract with your bank.

A downloaded camt.053 statement file in Odoo, before processing

Usage

Go to Accounting > Bank and Cash > EBICS Processing

Downloaded files are listed there and can be processed into bank statements. Uploads are launched from the payment batch or payment order, and the file, its format and the order type are taken from the EBICS configuration rather than chosen by the user.

Uploading a pain.001 SEPA credit transfer file over EBICS 3.0, with the test mode option

Diagnostics

Add the following to your Odoo config file in order to diagnose issues with the EBICS connection with your bank:

log_handler = fintech.ebics:DEBUG

EBICS Return Codes

During the processing of your EBICS upload/download, your bank may return an Error Code, e.g.

EBICS Functional Error: EBICS_NO_DOWNLOAD_DATA_AVAILABLE (code: 90005)

A detailed explanation of the codes can be found on http://www.ebics.org. You can also find this information in the doc folder of this module (file EBICS_Annex1_ReturnCodes).

Electronic Distributed Signature (EDS)

Where your bank supports EBICS T, Odoo prepares the file and holds no signing credentials at all: the payment is approved in your own signing application, which is what a segregation of duties policy usually demands. Where it does not, which happens with German and Swiss banks, the signing key sits on your Odoo server, and you can protect it with a separate signature passphrase that is never stored and is asked for every signed transaction.

External signing apps include BankingVEU:

Roadmap

The end user is currently not able to change his passphrases (only the users with 'EBICS Manager' rights can do so).
Add support to import externally generated keys & certificates (currently only 3SKey signature certificate).
Add support for SWIFT 3SKey signing javascript lib (SConnect, cf https://www2.swift.com/3skey/help/sconnect.html).

Issues and pull requests are welcome on https://github.com/Noviat/account_ebics.

Credits

This module is developed and maintained by Noviat, an Odoo partner in Belgium specialised in accounting and finance since 2009.

We implement it, we configure the connection with your banks and we support you through the first cycles. If you want help getting a bank online, tell us which banks you use on noviat.com/ebics and we will tell you what it takes.