Access Points are vital to eInvoicing. But why are they so important? As part of the four-corner model, Access Points send and receive trade documents between two parties. Organisations who want to connect to the Peppol eInvoicing network need an Access Point.
Access Points go through a certification process set by the Peppol framework. It sets out the standards and interoperability requirements for providers. Certification ensures providers have the capability and compatibility to function within the network, to help maintain reliability and stability of the network and manage risks that might damage the trust of the network.
Businesses have two options when it comes to Access Points:
- Choose to become an Access Point themselves by going through the certification process.
- Work with an Access Point service provider, such as MessageXchange, to connect you to the eInvoicing network.
In this blog we compare both options to help you decide what’s best for your organisation.
Cost and infrastructure
There are a number of costs and infrastructure requirements to become an Access Point. Costly hardware and infrastructure are one thing, but the associated maintenance costs are another substantial cost. There are also a number of compliance-related costs to become a Peppol-certified Access Point. Some include:
- ensuring your software is compliant with Peppol requirements
- security, which requires multiple controls, one of which is adherence to ISO 27001 or ASD/NZ ISM standards
- adherence to messaging and e-delivery standards.
All these are required to obtain and maintain your Peppol certification. On top of this, Peppol charge a sign-up fee and an annual membership fee.
When using an Access Point service provider, all the costs and requirements are covered by the provider, and the costs are often shared among all their clients. Overall, this makes it much less resource intensive and often much more cost effective.
Time
Becoming an Access Point is a very time-consuming process. The Australian certification process looks like this:
- Comply with operational framework
The operational framework is a set of standards used to enable access to the eInvoicing network. The framework is split into four areas:
- Legislation and policy: Ensure you comply with the implementation guidance and governance of the local authority.
- Organisational interoperability: Ensuring you are able to comply with all requirements for sending invoices (and adjustment invoices) and recipient created tax invoices. You must demonstrate you can connect with all corners within the four-corner model. Unique business identifier requirements need to be adhered to so businesses can be found. A business address needs to be established for all businesses to be able to send and receive documents.
- Semantic interoperability: Sets out requirements to ensure different applications can read and process information that is exchanged.
- Technical interoperability: This involves standards and protocols to exchange information securely and reliably between businesses (directly or via service providers).
- Security compliance
You’re required to implement security controls equivalent to ISO 27001 or ASD/NZ ISM standards, which can often be a lengthy and costly process in itself. You also need to implement encryption in transit and at rest, security monitoring and multifactor authentication.
- Join OpenPEPPOL
Fill in registration form and pay the annual subscription.
- Expression of interest
This is submitted to the local Peppol Authority, the Australian Taxation Office (ATO).
- Sign Transport Infrastructure Agreement (TIA)
Following membership approval, you need to sign the Transport Infrastructure Agreement (TIA) with the ATO. You will also need to sign the New Zealand Annex 5 if you want to be certified in New Zealand.
- Complete due diligence
Checks relate to business operations, senior staff, criminal record and insurance.
- Complete security questionnaire
You must show evidence of adherence to ISO 27001 or ASD/NZ ISM, encryption requirements, security monitoring and multi factor authentication.
- Testing
- Unit testing
Verify your ability to send and receive Peppol documents in line with eDelivery Network specifications within your own environment.
- Obtain test PKI certificate
Request a test PKI certificate from OpenPEPPOL and fill in the form. This form will then be reviewed by both Peppol and your local Peppol authority.
- Peppol acceptance testing – eDelivery network compliance
This happens within the OpenPEPPOL test environment to ensure you comply with Peppol eDelivery network specifications.
- Interoperability testing
This involves working with a partner to test interoperability. In Australia, scheduling and identifying your partner is done by the ATO. You need to allow a lead time of two weeks for the ATO to find a suitable partner.
- Receive certification
- Proceed into production
By using an Access Point service provider, you don’t need to go through any certification process. Instead, you just need to provide some information for them to tailor their service to your business. This includes:
- Determining your file format
If you’re software doesn’t produce the Peppol standard file format then your Access Point may be able to translate, or map, your file for you.
- Connection type
Your Access Point will need to know what connection protocol you require for your software. This might be API, sFTP or something else.
- Business identifier
Access Points require your business identifier to register you in the eInvoicing network. In Australia and New Zealand, the ABN and NZBN are needed to uniquely identify organisations when exchanging eInvoices.
Connecting to the Peppol eInvoicing network using an Access Point service provider can take less than a day.
Knowledge
Another fundamental aspect of becoming an Access Point is knowledge. You’ll need to keep up-to-date with developments and requirements from Peppol and the ATO. You’ll also need to connect with other Access Points and rectify any issues that come up to send and receive documents. All these things will require knowledgeable staff and dedicated resources.
Access Point service providers take care of all developments as they come out. There’s no need to connect with Access Points, Peppol or the ATO. It’s all taken care of.
Using an Access Point service provider can save businesses money, time and hassle when connecting to the Peppol eInvoicing network.
Request a call
Chat with one of our experts
Just fill out your details below and we'll be in touch within one business day.
