Connect your ERP to Nordea.
Corporate Access Webservice for accounts in Denmark, Finland, Norway and Sweden, and Corporate eGateway for the Nordics, the UK and the US. Payments go out as pain.001.001.03 or .09; status and statements come back as pain.002, camt.053 and camt.054.
The bank
- Legal name
- Nordea Bank Abp
- Head office
- Helsinki, Finland
- Business ID
- 2858394-9
- Supervisors
- ECB and Finnish FSA
- Channels
- Corporate Access, Corporate eGateway
- Payments
- pain.001.001.03 and pain.001.001.09
Published by the bank
Nordea's US Patriot Act certificate appendix (7 July 2026) and the entity lines in its MIGs.
Bank details
| Legal name | Nordea Bank Abp |
| Registered office | Satamaradankatu 5, FI-00020 NORDEA, Helsinki, Finland |
| Business ID | 2858394-9, Finnish Patent and Registration Office |
| VAT number | FI28583949 |
| Home supervisors | European Central Bank and Finnish Financial Supervisory Authority |
| Branches | Also supervised by the home supervisors |
| Country | Entity | BIC | Register | Supervisor |
|---|---|---|---|---|
| Finland (head office) | Nordea Bank Abp | NDEAFIHH | Business ID 2858394-9, Finnish Patent and Registration Office | European Central Bank and Finnish Financial Supervisory Authority |
| Denmark | Nordea Danmark, filial af Nordea Bank Abp, Finland | NDEADKKK | CVR 25992180 | Danish Financial Supervisory Authority |
| Norway | Nordea Bank Abp NUF | NDEANOKK | 920058817 MVA, Register of Business Enterprises | Financial Supervisory Authority of Norway |
| Sweden | Nordea Bank Abp, filial i Sverige | NDEASESS | Reg. no. 516411-1683, Swedish Companies Registration Office | Swedish Financial Supervisory Authority |
| Great Britain | Nordea Bank Abp London Branch | NDEAGB2L | Not published | Financial Conduct Authority and Prudential Regulation Authority |
| United States | Nordea Bank Abp, New York Branch | NDEAUS3N | Not published | Federal Reserve Bank of New York and New York State Department of Financial Services |
Published by the bank
Corporate Access Web Services and SFTP fact sheets, File Transfer service description v1.6, Corporate eGateway fact sheet 2025-1 and Implementation Guide v3.4, PGP fact sheet.
Channels
| Channel | Protocol | Transport | Content security | Keys and certificates | Agreement | Countries |
|---|---|---|---|---|---|---|
| Corporate Access Webservice | SOAP, WS Basic Profile 1.0 and WS-Security; request-response, the client always connects | HTTPS, port 443 | Secure Envelope: enveloped XML signature, SHA-256. Nordea signs its replies | X.509 certificate issued by Nordea from your certificate request, 2048-bit key, valid two years | Corporate Cash Management agreement with the Corporate Access File Transfer eService | Denmark, Finland, Norway, Sweden |
| Corporate Access SFTP | SFTP over SSH-2; push-push, so Nordea also connects to your server | SSH, port 22 by default; a static public IP address on both sides | Secure Envelope, signed with the Nordea certificate | Your own SSH key pair, RSA or DSA, 2048-bit; public keys, IP addresses and file names are exchanged at setup | Corporate Cash Management agreement with the Corporate Access File Transfer eService | Denmark, Finland, Norway, Sweden |
| Corporate eGateway | SFTP, AS2, FTP/VPN, SWIFTNet FileAct, Web Services, EBICS or a VANS operator | Set by the protocol | PGP (OpenPGP, RFC 4880), signed and encrypted, ASCII armour; PKI on Web Services | Your own PGP key pair; production keys go to Nordea's Security Department before go-live | Corporate eGateway Agreement with Schedule 3 (Authorisation document), and a Testing Agreement | Denmark, Finland, Norway, Sweden, the UK, the US (incl. Canada) |
| Corporate Access file service | https://ws.ebridge.prod.nordea.com/ws/CorporateFileService |
| Corporate Access certificate service | https://filetransfer.nordea.com/services/CertificateService/sha2 |
| Other Corporate Access protocols | AS2, EBICS, Norwegian PEPPOL Payment, SWIFTNet FileAct, manual upload in Corporate Netbank |
| Certificate requests | Web Services only, on every Corporate Access protocol |
| Service hours | 24 hours a day, 7 days a week, apart from scheduled breaks |
The setup steps at the foot of this page cover Corporate Access Webservice. Corporate eGateway is set up with PGP keys exchanged with Nordea’s Security Department, so those steps do not apply to it.
BankConnector
Payment types and pain.001 versions as built in our engine. BICs from Nordea's pain.001 MIGs.
Payment types by country
| Country | Debtor agent BIC | Channel | Payment types | pain.001 |
|---|---|---|---|---|
| Denmark | NDEADKKK | Corporate Access Webservice | SEPA credit transfer, Domestic account transfer, International payment, FIK payment | pain.001.001.03 and pain.001.001.09 |
| Finland | NDEAFIHH | Corporate Access Webservice | SEPA credit transfer, Domestic account transfer, International payment | pain.001.001.03 and pain.001.001.09 |
| Norway | NDEANOKK | Corporate Access Webservice | SEPA credit transfer, Domestic account transfer, International payment, KID payment | pain.001.001.03 and pain.001.001.09 |
| Sweden | NDEASESS | Corporate Access Webservice | SEPA credit transfer, Bankgiro, PlusGiro, Domestic account transfer, International payment | pain.001.001.03 and pain.001.001.09 |
| Great Britain | NDEAGB2L | Corporate eGateway | SEPA credit transfer, BACS, CHAPS, Faster Payment, International payment | pain.001.001.03 |
| United States | NDEAUS3N | Corporate eGateway | ACH payment, Wire transfer, International payment | pain.001.001.03 |
| Canada | NDEAUS3N | Corporate eGateway | Canadian EFT, Canadian wire, International payment | pain.001.001.03 |
Nordea lists no BIC of its own for Canada. A Canadian payment on Corporate eGateway names the New York branch, NDEAUS3N, as debtor agent.
Published by the bank
File Transfer service description v1.6, Corporate Access Payables service description (25 June 2025), pain.001.001.03 MIG v2.3, pain.001.001.09 MIG v1.2, the country appendices of May 2026 and the Corporate eGateway fact sheet.
Formats Nordea accepts
| Message | Version | File type | Content |
|---|---|---|---|
| pain.001 | 001.03, 001.09 | NDCAPXMLI | Payment orders |
| pain.002 | 001.03, 001.10 | NDCAPXMLO | Status reports |
| camt.053 standard | 001.02 | NDARSTXMLO | Account statement |
| camt.053 extended | 001.02 | NDAREXXMLO | Account statement with credit and debit notification details |
| camt.054 debit | 001.02 | NDCAPXMLD54O | Debit advices for executed payments |
| camt.054 credit | 001.02 | NDARCRAXMLO | Credit advices for incoming payments |
| camt.055 | 001.01 | NDCAPCANXMLI | Cancellation request for a payment sent earlier |
| camt.029 | 001.01 | NDCAPCANXMLO | Answer to a cancellation request |
| MT940, MT941, MT942 | SWIFT | NDSWMT940O, NDSWMT941O, NDSWMT942O | Statement, balance and intraday reports, every country |
| camt.052 | Not listed | None | Intraday reports come as MT942 (NDSWMT942O) |
| Character set | UTF-8. ¤, - and / in names, addresses and remittance text may become spaces on the SWIFT route |
| Creation date | No older than 15 calendar days |
| Unique references | MsgId, PmtInfId and EndToEndId unique per customer for at least 90 calendar days |
| Transaction count | NbOfTxs is validated and a wrong value rejects the message; CtrlSum is checked when present |
| Batching | One payment information block per debit account, currency and execution date |
| Initiating party | The agreement ID, scheme code CUST |
| Charge bearer | SHAR or SLEV inside the EU/EEA; DEBT is also allowed outside it |
| Service level SEPA | Processed as NURG |
| Debtor name and address | Replaced with the account holder's |
| Free text | Split into blocks of 35 characters; Danish clearing carries up to 41 lines |
| Regulatory reporting | International payments above NOK 100,000 from Norway and SEK 150,000 from Sweden |
| Secure Envelope | Signed, never encrypted; GZIP compression optional |
| Status reports | A first pain.002 confirms receipt; more follow for errors, a changed execution date or a payment awaiting confirmation |
| File storage | 15 months |
| Corporate eGateway status | pain.002 within an hour, normally within 20 minutes |
Published by the bank
File Transfer service description v1.6, Certificate Management (10 December 2024), Corporate Access Payables service description, Corporate eGateway Implementation Guide v3.4.
Onboarding at Nordea
| Step | Corporate Access Webservice | Corporate eGateway |
|---|---|---|
| Agreement | Corporate Cash Management agreement with the Corporate Access File Transfer eService, plus the Corporate Access Payables schedule | Corporate eGateway Agreement with Schedule 3 (Authorisation document), plus a Testing Agreement |
| Signed by | The company | The persons authorised to sign on behalf of the company |
| Set in the agreement | Sender ID, Signer IDs, pre-confirmed or netbank-confirmed payments, payment types, accounts and message types | The persons allowed to send new security keys to Nordea, in the Contact List |
| Identifiers | Sender ID, one per agreement, for the party that sends; Signer ID, one per certificate, for the party that signs | Not published |
| Activation | A 10-digit code by SMS to the phone registered for each Signer ID; single use, valid 7 days, a new one on request | Public keys exchanged with Nordea's Security Department |
| Certificate | Your PKCS#10 request (2048-bit, SHA-256; CN the holder's name, serialNumber the Signer ID, C the country of registration) with an HMAC keyed by the activation code; Nordea returns the signed certificate | Your own OpenPGP key pair |
| Validity and renewal | Two years; renewed before expiry with a request signed by the current certificate, with no new code | Not published |
| Through a third-party vendor | Your own Signer ID with the vendor's Sender ID | Not published |
| Before production | Nordea requires bank connection software to be tested with Nordea before production use | Nordea's test manager runs format and functional tests; new production keys go to Nordea's Security Department |
| Onboarding time | Not published | Not published |
BankConnector
Questions
- Which Nordea channel fits which company?
- Corporate Access Webservice covers accounts in Denmark, Finland, Norway and Sweden. The client always opens the connection, so no firewall opening or static IP address is needed, and files are signed with a certificate Nordea issues. Corporate eGateway is one file interface for the Nordics, the UK and the US including Canada, over SFTP, AS2, SWIFTNet FileAct, Web Services, EBICS or a VANS operator, secured with PGP or PKI.
- What does the Corporate Access agreement need?
- A Corporate Cash Management agreement with the Corporate Access File Transfer eService, plus the Corporate Access Payables schedule for payments. The schedule sets the Sender ID, the Signer IDs, whether payments are pre-confirmed or confirmed in the netbank, the payment types, the accounts and the message types. Each Signer ID gets a 10-digit activation code by SMS, valid for 7 days.
- Which countries does Nordea Corporate Access cover?
- Denmark, Finland, Norway and Sweden, with one file format for all four. Payments from Nordea's UK and US branches, or from another bank, are sent as Request for Transfer. Corporate eGateway covers the Nordics, the UK and the US including Canada.
- Does Nordea accept camt.055 payment cancellations?
- Yes, on Corporate Access: camt.055.001.01 under file type NDCAPCANXMLI cancels a payment or a batch sent earlier, and Nordea answers with camt.029.001.01. Corporate eGateway uses camt.055 for direct debit cancellations.
- Which pain.001 versions does Nordea accept?
- Corporate Access takes pain.001.001.03 and pain.001.001.09 under the same file type, NDCAPXMLI, and returns pain.002.001.03 or pain.002.001.10. Version 9 has been available since October 2025. Corporate eGateway takes pain.001.001.03.
- How long is a Nordea Corporate Access certificate valid?
- Two years. Before it expires, a renewal request signed with the current certificate replaces the activation code, so no new SMS is needed. An activation code is single use and valid for 7 days.
Published by the bank
Dates the bank has announced. What we do about each one is ours.
Upcoming events in our register
Nordea renews the TLS certificate used by Corporate Access Web Services and EBICS, around the end of November. Its TLS certificates now run for 200 days. It is neither a signing nor an encryption certificate.
Sweden: a credit transfer to a bank account can carry one free-text line of 140 characters.
Denmark, domestic payments: creditor name up to 140 characters (35 today), street name up to 70, and two address lines of 70.
Denmark, from week 21: standard, same-day and Easy Account transfers carry one line of 140 characters of unstructured text, invoice numbers (CINV) become allowed, and Purpose/Proprietary is no longer used.
Nordea’s response-signing certificate expires: Corporate Access File Transfer, issued by Nordea Corporate Server CA 03, valid from 21 July 2025.
If all of this looks like a lot, it does not have to be
Five steps to a live Nordea connection.
You do not need to know what any of the codes above mean. Our setup guide walks you through it one screen at a time.
- 1
Request the agreement from Nordea
A bank web service starts with an agreement, which you sign with your bank. There is nothing to configure until it is in place.
- 2
Enter your activation credentials
Your user ID and activation code come from Nordea, partly with the signed agreement and partly sent to you separately. The setup form asks for each of them.
- 3
Enrol your certificates
We generate your keys, send Nordea the certificate requests, authenticated with the activation code, and store the certificates the bank issues. Your private keys stay in BankConnector.
- 4
Verify Nordea's signatures
We check the certificates you are issued against the bank's root certificate, and the signature on every reply the bank sends. A reply whose signature fails is refused before it reaches your books.
- 5
Go live with one small payment
Choose who approves payments and switch the connection on. Start with one small payment and follow it all the way to your statement. Payments go out as pain.001; status and statements come back as pain.002 and camt. We alert you 30, 14 and 7 days before a certificate expires.
Sources: Nordea’s Corporate Access documents (Web Services and SFTP fact sheets, File Transfer service description v1.6, Certificate Management, Secure Envelope specification v1.8, Corporate Access Payables service description and country appendices, pain.001.001.03 MIG v2.3, pain.001.001.09 MIG v1.2, pain.002.001.10 MIG v1.0, camt.053 and camt.054 MIGs), its Corporate eGateway fact sheet, Corporate eGateway Implementation Guide, PGP fact sheet, Corporate eGateway pain.001.001.03 MIG v3.2, the File Transfer page and its US Patriot Act certificate appendix. BankConnector is not affiliated with Nordea Bank Abp.