Welcome to SAP Financial Services Network (SAP FSN)!
Join us and learn all about SAP FSN, SAP‘s cloud-based bank – company-integration solution.
1. Overview and business benefits
SAP Financial Services Network (SAP FSN) is an innovative on-demand solution that connects financial institutions and other financial service providers with their corporate customers on a secure network owned and managed by SAP. The network offers multi-bank and multi-corporate routing as well as multi-format documents. As key benefits, the solution automates financial transactions, reduces payment rejection rates, eases reconciliation and provides enhanced visibility to corporate treasury. It combines SAP expertise in applications, analytics, and in-memory computing to provide a standard, innovative technology for financial institutions and their corporate customers on a platform that accommodates future integration needs.
SAP FSN is SAP’s strategic initiative for financial institutions to corporate connectivity. In recent years, financial institutions and other financial service providers have looked to extend their business relationship with their corporate customers by offering value-added services. Additionally, corporate customers have looked to reduce their business risks through relationships with multiple financial institutions, increasing the need to manage their cash positions across those banks. To achieve this, banks and corporate customers need SAP FSN that is low-cost and flexible, and can on-board and establish connectivity between corporate customer’s and bank’s ERP applications more rapidly. SAP FSN is an innovative solution approach from SAP to address this need, namely to reduce operational risk and cost while supporting new business initiatives, and enablement of corporates & banks to transact, manage, and monitor a variety of corporate-to-bank services. SAP FSN offers seamless integration with SAP ERP and Treasury systems for better visibility to cash, improved liquidity management, at significantly lower operational costs. SAP FSN is an on-demand solution and consists of Integration as a Service, on-boarding framework, provisioning, management & monitoring capabilities that is hosted at SAP cloud.
SAP FSN is available to financial institutions and their corporate customers since March 2013. The development of SAP FSN is based on a customer co-innovation initiative including the validation of the solutions by major banks.This means that SAP has taken a collaborative approach with the world’s leading banks in order to develop SAP FSN. Through this co-innovation initiative it is ensured that customers can significantly contribute to the solution in terms of capabilities, such as security, operations, technology, as well as business value.
SAP FSN provides the following benefits:
Zero footprint connection between corporates and multiple financial institutes on one single channel with easy on-boarding through predefined rapid deployment packages (RDS)
Automation of financial transactions even in complex system landscapes with multiple banks, countries and currencies, supporting all important payment methods
Reduced payment rejection rates due to full vendor master data synchronization
Quick and easy reconciliation with minimal maintenance effort based on up-to-date ERP data with latest bank statement information
Improved visibility of payment transactions and therefore enhanced security and visibility of global cash
Faster onboarding of financial institutions and corporates
No additional cost for maintaining hardware and software
Standardize integration between financial institutions and their customers
SAP FSN runs on SAP HANA Cloud, is multi-tenant enabled and offers a high performance processing of messages. Key capabilities provided by SAP FSN are routing, mapping, diverse connectivity options, security on multiple levels, onboarding and service activation. SAP FSN supports the reliable and secure exchange of e. g. ISO20022 payment documents, such as payments (“pain.001”), payment status reports (“pain.002”), and statement messages (“CAMT.52/53”), between financial institutions and their corporate customers.
3.1. Routing & Mapping
The payment documents are routed via SAP FSN to the correct receiver bank or corporate; hereby SAP FSN determines the receiver of a message based on the content of the message header or payload. SAP FSN also supports the transformation (“mapping”) of data structures at sender and receiver side into each other. In scenarios spanning between different organizations and enterprises it is most likely that the structure of the data exchanged between the financial institutions and corporate customers differs on both sides. In order to enable a seamless exchange of data, the data structures on both sides of the connected bank and corporate have to be transformed or mapped into each other. SAP FSN allows the mapping of the exchanged documents.
3.2. Communication Protocols and Reliable Messaging
One or more corporate customers can exchange data with one or more financial service providers through SAP FSN. For the data exchange SAP FSN supports the following connectivity options for the communication between a corporation or a financial service provider on one side and SAP FSN on the other side:
SSH (secure shell) File Transfer Protocol (SFTP), client
SFTP server, i.e. SAP FSN provides its own SFTP server
Web Services Reliable Messaging (WS-RM) over HTTPS
SAP FSN supports the quality of service "At Least Once”. According to this service, once SAP FSN receives a message from a sender participant, it stores the message and sends a technical acknowledgment to the sender. It then tries to deliver the message to the receiver participant. In case the receiver is not available, SAP FSN retries sending the message after a defined time interval until the message is sent to the receiver.
Security is a key capability for Cloud based applications and the integration of the same. Therefore SAP FSN supports security on multiple layers.
During the operation of an SAP FSN scenario, the connected participants exchange data with each other based on the configured transport protocol. These protocols support different options to protect the exchanged data against unauthorized access, e. g. through certificate based authentication. In addition to security at transport level, the content of the exchanged messages can also be protected by means of digital encryption and signature, e. g. through message level security based on PKCS#7/CMS enveloped data and signed data. The encryption of data allows you to encode the content of a message in such a way that only authorized parties can read it. A digital signature ensures the authenticity of a message that way that it guarantees the identity of the signer and that the message was not altered after signing.
Data storage security
At several phases of the lifecycle of an SAP FSN scenario, data is stored and therefore exposed to the risk of unauthorized access. There are several measures to protect stored data in SAP FSN. In case of an error situation, dedicated experts at SAP have limited access rights to evaluate the situation. However, access to customer's business data is prevented hereby.
Security aspects of the onboarding process
During the connection set up between a participant and SAP FSN, data has to be exchanged between experts on SAP and customer's side. There are several measures applied to secure this data exchange. Through this onboarding process also confidential data has to be exchanged between SAP and the participant, like, for example, server addresses or public key certificates as well as names of the involved persons. To increase the security level of the SAP-participant information exchange, access to the relevant data is restricted to a small circle of experts involved in the onboarding process. In order to prevent unauthorized users to access such data, the person who starts the onboarding activity makes sure that only those persons are invited to the SAP StreamWork activity that need to be involved.
Several measures are taken to ensure robust operation and high level of operational performance of the SAP FSN runtime. In order to ensure reliable operation of a cluster even in case individual virtual machine crash, failover mechanisms are implemented: In case a virtual machine crashes that is processing a message, this incident is detected by the cluster and a new virtual machine automatically started to take over the task of the crashed virtual machine. Software update of the runtime environment is accomplished with a minimum downtime of about 1 minute.
For each participant connected to SAP FSN separate resources (in terms of: memory, CPU, file system) of the cloud-based integration platform are allocated – although all participants might share the same hardware. This concept is also referred to as tenant isolation. A tenant represents the resources of the cloud-based integration platform of SAP FSN allocated for a participant. At runtime, SAP FSN processes the data that is exchanged between the involved participants on a cluster of different virtual machines hosted in the SAP cloud, at which each virtual machine is assigned to the corresponding tenant allocated for the connected participant. SAP FSN is designed that way that it is always makes sure that the involved virtual machines are strictly separated from each other with regard to the related participants. In addition to that, each tenant uses a separate database schema which guarantees that data of different participants is strictly separated.
3.4. Onboarding & Service Activation
In order to start operating scenarios based on SAP FSN, two kinds of processes are relevant:
Is the process of connecting a participant (either a financial service provider or a corporation) to SAP FSN. Onboarding covers all tasks that are necessary in order to configure the data exchange and the connection between the corporate or financial service provider’s system and SAP FSN. The onboarding is a one-time activity and is a prerequisite for service activation.
Is the process when a financial service provider starts collaboration with a corporate customer. On request, SAP activates the connection between the two participants and informs them once the connection is complete. This allows the newly connected participants to carry out message flow testing across the service prior to moving into the production landscape.