Bank integration
Payments out, statements in, reconciled every day
Host-to-host and API connections to banks: ISO 20022 payment files, MT940 and camt statements, and automatic reconciliation.
Overview
Many treasury teams still key payments into banking portals and match statements by hand. Bank integration removes both. Payments leave your ERP as signed files or API calls, and statements come back in a form your ERP can match on its own.
We connect your ERP or treasury system to each bank through the channel that bank supports: host-to-host SFTP, EBICS, SWIFT through a service bureau, or the bank’s own APIs. Payment files follow ISO 20022 pain.001, status reports come back as pain.002, and statements arrive as camt.053 or MT940, with camt.052 or MT942 for intraday positions.
Every connection is tested in the bank’s test environment before go-live, monitored once it runs, and documented so your team can operate it. When a payment is rejected or a statement line does not match, the right person is told, with the reason.
What we deliver
Bank and channel inventory
Every bank, account and channel in scope, with the formats, cut-off times and approval rules each bank expects.
Interface specification
A field-by-field mapping between your ERP and each bank’s format, including that bank’s own variant of pain.001 and camt.053.
Payment connector
Approved payment runs exported from the ERP, validated, signed or encrypted as the bank requires, and delivered on schedule.
Status and rejection handling
pain.002 status reports read back into the ERP, so every payment shows as accepted, rejected or pending, with the bank’s reason code.
Statement import
End-of-day and intraday statements collected, checked for gaps and duplicates, and loaded into the ERP.
Reconciliation rules
Matching rules that clear open items automatically and send the rest to a review list, within tolerances you approve.
Bank test evidence
The agreed test cases run in each bank’s test environment, with results recorded for your auditors and for the bank.
Monitoring and runbook
Alerts for missing files, failed transfers and expiring keys or certificates, and a runbook your team can follow.
How we work
- 01
Map banks and flows
We list your banks, accounts, payment types and manual steps today, and agree which flows go first.
- 02
Specify each format
We work from each bank’s implementation guide and write the mapping, including signing, encryption and file naming.
- 03
Build the connectors
We build payment export, status import, statement import and matching, with automated tests for every format.
- 04
Test with each bank
We run the agreed test cases in the bank’s test environment and fix whatever the bank’s validation rejects.
- 05
Go live bank by bank
We switch one bank at a time, with the current process ready as a fallback until the new one is proven.
- 06
Monitor and support
We watch transfers, keys and certificate expiry, and plan for format changes as banks announce them.
How it connects
Scroll sideways to see the whole drawing.
ERP to bank: payments out, statements in
Approved payments leave the ERP as signed ISO 20022 files over a host-to-host channel. Status reports and statements come back the same way and are matched to open items. Rejections and unmatched lines go to your team with the reason attached.
- Primary flow
- Asynchronous
- Exception path
The flow, step by step
- From ERP to Integration layer: Approved payment run, over REST/JSON · IDoc (primary flow).
- From Integration layer to Secure bank channel: Signed and encrypted payment file, over ISO 20022 pain.001 · OpenPGP (primary flow).
- From Secure bank channel to Bank: Delivered to the bank, over SFTP H2H (primary flow).
- From Bank to Secure bank channel: Status reports and statements, over pain.002 · camt.053 · MT940 (asynchronous).
- From Secure bank channel to Integration layer: Collected and validated, over SFTP H2H (asynchronous).
- From Integration layer to Reconciliation engine: Statement lines, over camt.053 (asynchronous).
- From Reconciliation engine to ERP: Matched entries posted, over REST/JSON (primary flow).
- From Integration layer to Treasury and finance team: Rejected payments, with the reason code, over pain.002 RJCT (exception path).
- From Reconciliation engine to Treasury and finance team: Unmatched lines: a reconciliation break (exception path).
- From Treasury and finance team to ERP: Corrected and resubmitted (exception path).
Scroll sideways to see the whole drawing.
Open banking: data and payments with the customer’s consent
The customer grants consent, the connector holds the tokens, and every call to the bank is authorised and logged. When consent expires or is withdrawn, the app asks the customer again instead of failing quietly.
- Primary flow
- Asynchronous
- Exception path
The flow, step by step
- From Customer to Your app or platform: Grants consent (primary flow).
- From Your app or platform to Open banking connector: Account and payment requests, over REST/JSON (primary flow).
- From Open banking connector to Bank APIs or aggregator: Authorised API calls, over OAuth 2.0 · FAPI · REST (primary flow).
- From Bank APIs or aggregator to Open banking connector: Balances, transactions and payment status, over REST/JSON · webhook (asynchronous).
- From Open banking connector to ERP or ledger: Normalised transactions, over REST/JSON (primary flow).
- From Bank APIs or aggregator to Open banking connector: Consent expired or withdrawn, over HTTP 401 · 403 (exception path).
- From Open banking connector to Your app or platform: Customer asked to renew consent (exception path).
Technologies
- ERP systems
- SAP S/4HANA
- Oracle NetSuite
- Oracle Fusion Cloud ERP
- Microsoft Dynamics 365 Finance and Supply Chain Management
- Odoo
- Sage X3
- Banking standards and channels
- ISO 20022
- pain.001
- pain.002
- camt.052
- camt.053
- camt.054
- MT940
- MT942
- SFTP (H2H)
- EBICS
- SWIFT
- OpenPGP
Ways to work with us
- Project-based deliveryXSIS delivers an agreed scope against written acceptance criteria, with a named delivery lead.
- Dedicated teamA complete team that works only on your product, run day to day by XSIS and directed by you.
- Staff augmentationEngineers and specialists who join your team, work in your tools and report to your managers.
Questions and answers
Which bank formats and channels do you work with?
We work with the ISO 20022 messages banks use for corporate payments and reporting: pain.001 for payments, pain.002 for status, and camt.052, camt.053 and camt.054 for account reports. We also handle the SWIFT MT940 and MT942 statements many banks still send. For transport we use host-to-host SFTP, EBICS where banks offer it, and bank APIs. Each bank has its own variant of each format, so we build from the bank’s implementation guide, not from the standard alone.
Link to this questionWhich ERP systems can you connect to banks?
We connect banks to SAP S/4HANA, Oracle NetSuite, Oracle Fusion Cloud ERP, Microsoft Dynamics 365, Odoo and Sage, and to treasury and custom systems. Some ERPs have their own bank communication modules. Where they do, we configure and extend them rather than build around them. Naming a product here does not mean a partnership with its vendor.
Link to this questionHow long does a bank integration take?
It depends mostly on the bank, not on the code. Each bank sets its own onboarding steps, test windows and approvals, and some need contracts or key exchanges before testing can start. The number of banks, payment types and countries matters too. After the mapping step we give you a plan per bank, and we start testing with whichever bank is ready first.
Link to this questionWhat drives the cost of a bank integration?
The number of banks and channels, the payment types and countries in scope, how much your ERP already supports, and how complex your matching rules are. Signing and encryption requirements and each bank’s test process add effort. We estimate per bank and per flow after discovery, so you can phase the work and its cost.
Link to this questionHow do you keep payment files secure?
Payment files are signed and encrypted as each bank requires, for example with OpenPGP, and travel only over the agreed channel. Keys and certificates are kept in your key vault or hardware security module, never in code, and only named people can reach them. Files are validated before they are sent, and every transfer is logged, so you can trace who approved and sent each payment.
Link to this questionWhat happens when a statement line does not match?
It goes to a review list with the likely candidates and the reason it did not match, such as a difference in amount or a missing reference. Your team clears it there, and the rules can be adjusted so the same case matches next time. Nothing is posted to the ledger without a match that you approved.
Link to this questionWhat happens when a bank changes its format?
Banks announce format changes in advance, as many did when moving from SWIFT MT to ISO 20022 messages. We follow those notices for the banks we connect, assess the impact, and schedule the change and its tests with the bank before its deadline. This can be part of a support agreement.
Link to this questionWho owns the code and the work you produce?
Intellectual property in the work we build for you is yours from the first commit — no assignment step at the end. That covers the custom code, documentation and other deliverables made for you. Anything we bring that existed before, such as internal tools or libraries, stays ours, and you receive a licence to use it in your systems. Open-source components keep their own licences, and we list them for you.
Link to this questionTell us what you need to build or connect.
Describe the systems, the timeline and the constraints. The right engineers take it from there.
- Our team will call you within 24 hours during your preferred time slot
- Our team is available 24/7