Recently, the Peppol network has been discussed more and more often in connection with electronic invoicing. So let us look at how the Peppol network works technically.
Peppol started as a European network for electronic communication, and today it is used worldwide. It is a great example of how solving European fragmentation helped solve a global problem and opened space for additional value-added services. Currently, more than 3 million companies from 118 countries are connected to the Peppol network.
Basic facts:
- the central network nodes are operated by the European Commission
- network governance is handled by the independent OpenPeppol association. Its members include national tax authorities (Peppol Authorities) as well as individual access points (Access Points)
- Peppol Authorities: national tax authorities that define country-specific conditions
- access points (Access Points): connectivity providers for end companies and guarantors of identity at the same time
Peppol ID
Before we start, we need to explain Peppol ID. It is not complicated. An example is 9929:cz05574617. It consists of a prefix (here 9929) and an official identifier (for example VAT ID).
| Country | Identifier type | Registry code | What it means |
|---|---|---|---|
| Czech Republic | VAT ID | 9929 | Used for Czech VAT payers |
| Slovak Republic | Tax ID | 0245 | Used for Slovak non-VAT payers |
| Slovak Republic | VAT ID | 9950 | Used for Slovak VAT payers |
| International GLN | GLN | 0088 | Global Location Number (GS1 standard) |
So a Peppol ID does not need to be “assigned”. It only needs to be registered.
Central SML registry
A critical part of the Peppol network is the central SML registry. This is where an access point registers your Peppol ID. Thanks to that, it is clear at which access point a given Peppol ID is registered.
Writing to SML is done by the access point and secured by its electronic signature. Reading then happens via DNS.
Example:
- Peppol ID: 9929:cz05574617
- a hash is calculated and a DNS name is created: cyk3urzidlfsgubbofsguqc5vxoirfytk7ee4ebkcrypeznnshgq.iso6523-actorid-upis.edelivery.tech.ec.europa.eu
- from it, a NAPTR record is loaded, which determines with which provider the record is registered
This also means that a Peppol ID can be registered with only one provider. For receiving, you can therefore use only one provider. For sending, you can have more than one.
Technically, Peppol ID also includes the namespace prefix iso6523-actorid-upis::. It indicates that the addressing method in the Peppol network can be changed in the future. Since only one prefix is used today, it is omitted for users in most cases.
Service Metadata Publishing (SMP)
SMP is the service that returns which document types a recipient supports for a given Peppol ID.
You get the record by taking the SMP address from the NAPTR record and appending the Peppol ID (including the prefix).
https://smp.pepposh.eu/iso6523-actorid-upis::9929:cz05574617
This gives you addresses for individual supported document types (for example invoice or credit note).
Document types
In SMP, a separate record is registered for each document type (for example invoice, order, …). This tells the sender which documents can be delivered. The access point address (AS4), including its certificate and technical contact details, is also listed there.
The most commonly used document types are:
- invoice
- credit note
- delivery receipt
- orders
- delivery notes
- and others
Thanks to the published list of supported formats, it is possible to verify before sending that the recipient will really accept the specific document.
Access point
The AS4 protocol is used for transport in the Peppol network. Technically, it works similarly to SMTP, but it runs over HTTP and an electronic signature is mandatory.
Security
The last important area is network security. Access points are the guarantors of identity for individual end companies. They are required to verify the existence of the company (or organization in general) and also that the applicant is truly authorized to act on its behalf. It is necessary to perform KYC verification, check sanctions lists, and generally comply with anti-money-laundering (AML) rules.
If an access point violates these obligations, it can be excluded from OpenPeppol membership and lose direct access to the Peppol network.
Each access point then receives a certificate from the OpenPeppol certification authority. It is then used for identity verification and signing delivery receipts.
Changing access point
From the above, it follows that only the SML registration needs to be changed. In practice, you need to deregister with one provider and then register with another.
How much does it cost to become an access point?
If you want to become an access point, you must meet these conditions:
- become a member of OpenPeppol and pass certification
- operate SMP and AS4
- monitor changes and implement them
- provide support to end users
Fees are realistically from EUR 7,500 (that is what we paid) up to EUR 12,500 for the first year. In following years, it is EUR 2,500 less, i.e. EUR 6,000 to EUR 11,500 for each additional year (exact pricing is at https://peppol.org/join/fees/). On top of that, the application itself must be operated.
Our estimate is that minimum costs are roughly between CZK 1,000,000 and CZK 2,000,000 per year, not including end-user support. In our case at Pepposh, we are rather near the lower bound because we have long focused on integrations and transport and were able to leverage extensive infrastructure, experience, and an established team. That is why for our Pepposh service we set an unlimited tariff at CZK 80,000/month. The goal was to offer the service more cheaply than building it directly in-house.
