Connect your ERP to HSBC.
HSBC Connect, HSBC’s host-to-host channel over SFTP, with SSH keys for the connection and PGP for every file. Payments go out as pain.001.001.03; status and statements come back as pain.002 and camt.053.
The bank
- Group
- HSBC
- Channel
- HSBC Connect, host-to-host over SFTP
- Connection
- SSH key, RSA
- File security
- PGP, encrypted and signed both ways
- Payments
- pain.001.001.03 (XMLv3)
- Statements
- camt.053.001.02 and MT940
Published by the bank
Issuer notices in HSBC's Poland tax and split payments guide, UAE XMLv3 Client Integration Pack and Egypt purpose of payment requirement; the debtor-agent rules in the China, Hong Kong, Indonesia and Malaysia usage guidelines; about.hsbc.de, hsbc.co.uk, hsbc.com.hk, hsbc.com.cn and hsbc.com.my.
Bank details
| Group | HSBC |
| Issuer of the HSBCnet formatting guides | HSBC Bank plc, authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority |
| Usage guidelines | Published by HSBC Direct Channels on SWIFT MyStandards, one per country and payment kind |
| HSBC Continental Europe head office | 38 Avenue Kléber, 75116 Paris, France |
| HSBC UK Bank plc registered office | 1 Centenary Square, Birmingham, B1 1HQ |
| Country | Entity | BIC | Register | Supervisor |
|---|---|---|---|---|
| United Kingdom | HSBC UK Bank plc | Not published | Company no. 9928412, England and Wales; FS Register 765112 | Authorised by the Prudential Regulation Authority, regulated by the Financial Conduct Authority |
| United Kingdom | HSBC Bank plc | Not published | Registration number 114216 | Authorised by the Prudential Regulation Authority, regulated by the Financial Conduct Authority and the Prudential Regulation Authority |
| France (head office) | HSBC Continental Europe | Not published | SIREN 775 670 284, RCS Paris | European Central Bank, ACPR and AMF |
| Germany | HSBC Continental Europe S.A., Germany | TUBDDEDD | HRB 96934, Local Court of Düsseldorf | European Central Bank and BaFin, with ACPR and AMF |
| Poland | HSBC Continental Europe (Spółka Akcyjna) Oddział w Polsce | Not published | Not published | Not published |
| United Arab Emirates | HSBC Bank Middle East Limited, U.A.E. Branch | Not published | Not published | Central Bank of the U.A.E.; lead regulated by the Dubai Financial Services Authority |
| Egypt | HSBC Bank Egypt S.A.E. | Not published | Not published | Not published |
| Hong Kong | The Hongkong and Shanghai Banking Corporation Limited | HSBCHKHH | Not published | Not published |
| China | HSBC Bank (China) Company Limited | HSBCCNSH | Not published | Not published |
| Indonesia | PT Bank HSBC Indonesia | HSBCIDJA | Not published | Not published |
| Malaysia | HSBC Bank Malaysia Berhad | HBMBMYKL; HMABMYKL for Islamic accounts | 198401015221 (127776-V) | Not published |
Published by the bank
HSBC's PGP key-expiry notice for host-to-host (SFTP) profiles (31 August 2026), the SEPA Credit Transfer Core guideline (1 November 2017), HSBC Germany's processing-times overview (February 2025). Host, port, mailbox and key type: HSBC's host-to-host onboarding packs, as held in our engine.
Channels
| Channel | HSBC Connect, host-to-host over SFTP |
| Protocol | SFTP; the client connects, uploads payment files and collects reports |
| Host | ecom-sftp.fguk-prd2.hsbc.com, port 10022 |
| Mailbox | Upload and download both in the root folder (/), under the file name set in the onboarding pack |
| SSH key | RSA, sent in RFC 4716 (SSH2 PUBLIC KEY) form |
| SFTP username | Set per agreement in HSBC's onboarding pack |
| Content security | PGP, profile type File encryption with signing, Inbound to HSBC and Outbound to Client: files in both directions encrypted and signed |
| HSBC's PGP key | HSBC Bank PGP key; HSBC loads a new key on its side before it announces the change |
| Customer identifier | HSBC Connect Customer ID, written into every pain.001 in InitgPty/Id/OrgId/Othr/Id |
| Agreement | Not published |
| Regions | Usage guidelines in collections for Europe, Asia Pacific, Latin America, North America and Middle East North Africa and Turkey |
| Other channels | HSBCnet File Upload; SWIFT; EBICS in Germany |
| SEPA files | Through HSBC Connect or HSBCnet File Upload, from HSBC accounts in the United Kingdom, Belgium, Ireland, the Netherlands, France, Germany, Spain, Italy, Malta, Greece, the Czech Republic, Poland, Luxembourg and Switzerland |
| Germany, SEPA-Urgent | Over EBICS only. HSBC Germany takes no SEPA-Urgent through HSBCnet, MCconnect, host-to-host or SWIFT |
BankConnector
Payment types and pain.001 version as built in our engine. BICs from HSBC's usage guidelines for China, Hong Kong, Indonesia and Malaysia and from HSBC Continental Europe's German site disclosure.
Payment types by country
| Country | Debtor agent BIC | Payment types |
|---|---|---|
| Australia | Not published | International payment |
| Belgium | Not published | SEPA credit transfer, International payment |
| Brazil | Not published | Domestic transfer (TED/DOC), Boleto, PIX instant payment, International payment |
| China | HSBCCNSH | International payment |
| Egypt | Not published | International payment |
| France | Not published | SEPA credit transfer, SEPA Instant credit transfer, Domestic account transfer, International payment, Treasury transfer |
| Germany | TUBDDEDD | SEPA credit transfer, SEPA Instant credit transfer, Domestic account transfer, International payment |
| Hong Kong | HSBCHKHH | International payment |
| India | Not published | International payment |
| Indonesia | HSBCIDJA | International payment |
| Ireland | Not published | SEPA credit transfer, SEPA Instant credit transfer, Domestic account transfer, International payment |
| Italy | Not published | SEPA credit transfer, SEPA Instant credit transfer, International payment |
| Japan | Not published | International payment |
| Malaysia | HBMBMYKL; HMABMYKL for Islamic accounts | International payment |
| Mexico | Not published | International payment |
| Netherlands | Not published | SEPA credit transfer, SEPA Instant credit transfer, Domestic account transfer, International payment |
| New Zealand | Not published | International payment |
| Philippines | Not published | International payment |
| Poland | Not published | SEPA credit transfer, Split payment (MPP), International payment |
| Singapore | Not published | Domestic account transfer, International payment |
| Spain | Not published | SEPA credit transfer, SEPA Instant credit transfer, International payment |
| Taiwan | Not published | International payment |
| Turkey | Not published | International payment |
| United Arab Emirates | Not published | International payment |
| United Kingdom | Not published | SEPA credit transfer, BACS, CHAPS, Faster Payment, International payment |
| United States | Not published | ACH payment, Wire transfer, International payment |
Every country runs on HSBC Connect, with payments as pain.001.001.03.
Published by the bank
HSBC's pain.001.001.03 usage guidelines on MyStandards (country cuts 2014 to 2024), the UK priority payment guide (12 November 2021), the core pain.002 and camt.053 guidelines, the UAE XMLv3 Client Integration Pack, the Poland tax and split payments guide (December 2020), the Egypt purpose of payment requirement, the RMB Payment Purpose Code Requirement (February 2014), HSBC France's SCT guide v2.3 and hors-SEPA guide v1.0.
Formats HSBC accepts
| Message | Version | HSBC guideline | Content |
|---|---|---|---|
| pain.001 | 001.03 (XMLv3) | One usage guideline per country and payment kind: High Value or TARGET and International, Low Value, Urgent/Priority, SEPA Credit Transfer Core, and local ones such as TED, Boleto, Payroll | Payment files |
| pain.001 | 001.02 (XMLv2) | Guidelines on file for Argentina, South Korea and Poland | Payment files in the older XML version |
| pain.002 | 001.03 | Payment Status Report, File Level and Transaction Level (Core) | Level 1 is the file; levels 2 to 4 are transactions. ISO reason code, with HSBC's own error code and description in the additional information |
| camt.053 | 001.02 | BankToCustomerStatement (Core) | End-of-day statement |
| camt.052 | 001.02 | BankToCustomerAccountReport (Core) | Intraday account report |
| MT940 | SWIFT | HSBCnet MT940 layout specification and country end-of-day specifications | End-of-day statement |
| CFONB 120 | France | Uploaded statement of account (September 2014) | French statement |
| Bacs Standard 18 | United Kingdom | HSBC Bacs Standard 18 MIG | UK Bacs file format |
| Character set | UTF-8; only SWIFT characters: a to z, A to Z, 0 to 9, / - ? : ( ) . , ' + and space. HSBC France also takes ISO 8859-1; Polish letters only in PLN Elixir and Sorbnet payments |
| Authorisation code | GrpHdr/Authstn: AUTH (pre-authorised), FDET (file level details), FSUM (summary) or ILEV (instruction level) |
| Initiating party | HSBC Connect Customer ID in InitgPty/Id/OrgId/Othr/Id; otherwise a BIC in BICOrBEI or a SIRET ID |
| Debtor agent | Must be HSBCCNSH in China and HSBCHKHH in Hong Kong, with the country; HSBCIDJA in Indonesia; HBMBMYKL in Malaysia, HMABMYKL for Islamic accounts |
| Service level, priority payments | URGP, SDVA or PRPT |
| Charge bearer | SLEV ignored on priority payments; SHAR by default with DEBT and CRED as options (Indonesia); DEBT only (India); SLEV only on SEPA (France) |
| Creditor agent, Asia Pacific | BIC preferred; with a member ID alone, name and postal address (at least town and country) are mandatory |
| Unstructured remittance | Up to 140 characters per line; no / at position 1, 36 or 71 in Asia Pacific priority payments, or the file is rejected |
| United Kingdom | CHAPS and international: structured debtor and creditor address with town, country subdivision and country; debit reference 16 characters. Faster Payments: at most GBP 250,000.00, execution date the day the file is sent |
| France | Category purpose TREA for treasury transfers, INTC for intercompany transfers; a file without BIC carries NOTPROVIDED in the agent |
| Poland | Tax and split payments in the Tax block or as tagged remittance: /TI/ /OKR/ /SFP/ /TXT/ for tax, /VAT/ /IDC/ /INV/ /TXT/ for split payments; one invoice per split payment |
| United Arab Emirates | Purpose of payment mandatory for priority payments and ACH credits: the central bank's 3-character code in RgltryRptg/Dtls/Cd |
| Egypt | Purpose of payment mandatory on every payment: a 4-character code on ACH; /BENEFRES/EG// or /ORDERRES/EG// with the purpose on priority payments; relationship detail on domestic foreign-currency payments |
| Indonesia | Foreign-currency priority payments carry the beneficiary's residence, category and affiliation, and the purpose of transfer. A non-IDR creditor name is cut at 35 characters, the rest moved to the first address line |
| Cross-border CNY | Purpose in RgltryRptg/Dtls/Inf, one of /BUSINESS/CAPITAL TRF, /BUSINESS/CHARITY DONATION, /BUSINESS/CURRENT ACC TXN, /BUSINESS/GOODS TRADE, /BUSINESS/SERVICE TRADE |
| Statements | EndToEndId reads NOT PROVIDED when the payment had none. Where HSBC de-batches, one entry per transaction; elsewhere one bulk entry without PmtInfId |
Published by the bank
HSBC's PGP key-expiry notice for host-to-host (SFTP) profiles (31 August 2026), the usage guidelines' rule HSBC_InitiatingParty, the UAE XMLv3 Client Integration Pack. SSH key type and onboarding pack values: our engine.
Onboarding at HSBC
| Agreement | Not published |
| Signed by | Not published |
| From HSBC | Onboarding pack with the SFTP host, port, username and file name; the HSBC Connect Customer ID; HSBC's PGP public key |
| From the customer | SSH public key (RSA, RFC 4716) and PGP public key |
| Authorisation | Set per profile: pre-authorised files carry AUTH; FDET, FSUM and ILEV are the other codes |
| PGP key change | HSBC loads its new key first and both keys work until the old one expires. HSBC signs statements with the key the customer's last payment file was encrypted to |
| Statements-only profiles | A profile with no payment files changes key through the Client Service Manager |
| Onboarding time | Not published |
BankConnector
Questions
- Which pain.001 version does HSBC host-to-host take?
- pain.001.001.03, which HSBC calls XMLv3. HSBC publishes one usage guideline per country and payment kind on SWIFT MyStandards, such as High Value Payment, Low Value Payment and SEPA Credit Transfer Core. Older XMLv2 guidelines (pain.001.001.02) exist for Argentina, South Korea and Poland.
- What is the HSBC Connect Customer ID?
- The identifier HSBC gives a host-to-host customer. It goes in every pain.001 under InitgPty/Id/OrgId/Othr/Id, as HSBC's rule HSBC_InitiatingParty asks; a BIC in BICOrBEI or a SIRET ID are the alternatives.
- How does HSBC change its PGP key?
- HSBC loads the new key on its side before it sends the notice, and the old key keeps working until it expires. HSBC signs statements with whichever key the customer's last payment file used, so the switch happens with the first file sent under the new key. A profile that only receives statements changes key through the Client Service Manager.
- Which authorisation codes can an HSBC XMLv3 file carry?
- AUTH for pre-authorised files, FDET for file level details, FSUM for a summary and ILEV for instruction level authorisation, all in GrpHdr/Authstn. HSBC's pre-authorised digital pack for the UAE lists AUTH alone.
- Which HSBC accounts can a SEPA file debit?
- HSBC's SEPA Credit Transfer Core guideline lists accounts in the United Kingdom, Belgium, Ireland, the Netherlands, France, Germany, Spain, Italy, Malta, Greece, the Czech Republic, Poland, Luxembourg and Switzerland, through HSBC Connect or HSBCnet File Upload.
- Does HSBC Germany take SEPA-Urgent payments over host-to-host?
- No. HSBC Germany processes SEPA-Urgent only in EBICS format; its processing-times overview of February 2025 rules out HSBCnet, MCconnect, host-to-host and SWIFT for them.
Published by the bank
Dates the bank has announced. What we do about each one is ours.
Upcoming events in our register
HSBC’s current production PGP key expires for host-to-host (SFTP) profiles. Its successor is already loaded at HSBC; the first payment file encrypted to it moves the profile over.
HSBC’s replacement production PGP key expires.
If all of this looks like a lot, it does not have to be
Five steps to a live HSBC connection.
You do not need to know what any of the codes above mean. Our setup guide walks you through it one screen at a time.
- 1
Request the agreement from HSBC
A host-to-host connection starts with an agreement, which you sign with your bank. There is nothing to configure until it is in place.
- 2
Send your public keys
We generate two key pairs for you: SSH, which signs you in to HSBC's server, and PGP, for the files you and HSBC exchange. You send HSBC the public halves the way it asks for them. Your private keys stay in BankConnector.
- 3
HSBC registers your keys
The bank sets up your user on its server and sends you the server address, your username and its own PGP public key. You enter them in the setup form, with any file-name values the bank assigned you.
- 4
Pin HSBC's server
You enter the fingerprint of the bank's server key, as the bank gives it to you. We connect only to a server that presents that key, then list its folders, read-only, so you can pick the one that holds your statements.
- 5
Go live with one small payment
Choose who approves payments and switch the connection on. Start with one small payment and follow it all the way to your statement. Payments go out as pain.001; status and statements come back as pain.002 and camt. We alert you 30, 14 and 7 days before your PGP key expires.
Sources: HSBC’s pain.001.001.03 usage guidelines on SWIFT MyStandards (country cuts for Europe, Asia Pacific, Latin America, North America and the Middle East, 2014 to 2024), the UK priority payment guide (12 November 2021), the SEPA Credit Transfer Core guideline (1 November 2017), the core pain.002, camt.052 and camt.053 guidelines, the XMLv3 Client Integration Pack for the UAE and its purpose of payment list, Remittance Formatting for Poland Tax and Split Payments (December 2020), HSBC Egypt’s purpose of payment requirement, the RMB Payment Purpose Code Requirement (February 2014), HSBC France’s SCT guide v2.3 and hors-SEPA guide v1.0, HSBC Germany’s processing-times overview (February 2025) and site disclosure, HSBC’s PGP key-expiry notice for host-to-host profiles (31 August 2026), the HSBC UK legal page and the footers of hsbc.com.hk, hsbc.com.cn and hsbc.com.my. BankConnector is not affiliated with HSBC.