3 · Three gates, not one

The short account of the bottleneck now in circulation runs: a contract is missing. That is correct, and it is the smaller half. The Swissdec Transmitter specification of 06.03.2026 («Technische Spezifikation eBILANZ · Version 20260306 · Anforderungen Transmitter») (Technical specification eBILANZ · Version 20260306 · Transmitter requirements), read together with the 35 XML schemas shipped with it, the single WSDL file, and the eleven SOAP examples, documents not one admission condition but three: contractual, certificate-based, and identity-based. They are independent of one another; each is documented separately, and each would have to fall separately. The third sits furthest from tax law: the identity of a Swiss company on the national transmission network is proven through its insurer.

Gate 1 — the contract

Directly below the communication matrix (Table 2.1, Part 2) sits a note. The debate tends to quote half of it. In full it reads:

«Aus vertragsrechtlichen und statuarischen Gründen seitens Swissdec können aktuell nur kantonseigene Deklarationslösungen die E-Bilanz via Distributor elektronisch empfangen. Für die Anbindung von privaten Deklarationslösungen an den Distributor müssen zuerst die vertraglichen Grundlagen geschaffen werden.» (for reasons of contract law and of Swissdec's own statutes, at present only the cantons' own Deklarationslösungen can receive the E-Bilanz electronically via the Distributor; for private Deklarationslösungen to be connected to the Distributor, the contractual basis must first be created)

— Swissdec, Technische Spezifikation eBILANZ, edition 06.03.2026, ch. 2, note directly below Table 2.1 (statuarischen sic)

Three observations that only the full text yields.

First: «seitens Swissdec». (on Swissdec's side) The clause names who carries the barrier. It is not a federal rule, nor a rule of the Schweizerische Steuerkonferenz (the Swiss Tax Conference), nor a rule of a canton. It is the contractual and statutory position of the association that runs the network, as that association describes it. Anyone who wants the barrier to fall knows which table to sit down at.

Second: the two readings. Sentence 1 speaks of receiving — «können aktuell nur kantonseigene Deklarationslösungen die E-Bilanz via Distributor elektronisch empfangen» (at present only the cantons' own Deklarationslösungen can receive the E-Bilanz electronically via the Distributor). Read narrowly, it governs who may be the addressee of a DeclareRawBalanceSheet, that is, the target side of the XBRL track. Sentence 2 generalizes: it speaks of «der Anbindung von privaten Deklarationslösungen an den Distributor» (the connection of private Deklarationslösungen to the Distributor) as such, without a direction. The two sentences do not say the same thing. That ambiguity belongs in the open rather than settled in one direction or the other, because the same matrix the note sits under already carries a numbered row DISTRRIBUTOR[2] (sic, three Rs) for the route Private Deklarationslösung → SwissdecAdapter, Teil 7, DeclareBalanceSheet, eCH-0276. The process description in §2.2 lists the «Private Deklarationslösung Transmitter» as the third of three participating systems. The architecture knows this actor. It is suspended, not excluded.

Third: «zuerst». (first) The word presupposes a «dann» (then). It points forward; it does not close. A sentence meant to exclude a category permanently would have no need of that adverb. This is neither a commitment nor a deadline, but it is the difference between a wall and a door without a key.

A note in the margin, on diligence: we cite this passage structurally, not by page number. Our own extraction places it between page mark 6 and the heading §2.1; an earlier note of ours gives «§2, S. 6» (§2, p. 6). Where we cannot establish the page with certainty, we do not name it.

Gate 2 — certification

The second gate is not in the prose but in the interface description. schema/BalanceSheetDeclarationService.wsdl (SHA-256 3ca8a5806b283649b154bb79008fb4bbc6e7ed2f8ca811ce18a0e88af7175879) defines seven operations. Six of them carry an identically worded wsdl:documentation:

This operation must be signed by: ERP Certificate

The six are DeclareRawBalanceSheet, SynchronizeDeclareRawBalanceSheet, DeclareBalanceSheet, GetStatusFromDeclareBalanceSheet, SynchronizeDeclareBalanceSheet, and CheckInteroperability. The seventh, Ping, carries:

This operation must be signed by: None

That matches §8.15 of the guidelines: «Ausser dem Erreichbarkeitstest muss jede Übermittlung signiert und verschlüsselt werden.» (apart from the reachability test, every transmission must be signed and encrypted). Everything that carries data needs a certificate; the bare knock at the door does not.

On the name of this certificate: the published interface carries no authorization class of its own for a Deklarationslösung. Even the two operations that per Table 2.1 are called exclusively by Deklarationslösungen — the cantons' own and private ones alike — require an «ERP Certificate», that is, the authorization of the actor on the other track. That is in the first place an observation about wording, not about intent. It has a practical edge all the same: a provider going through the certification process today would find no credential in the interface cut for them.

Tables 4.2 and 8.3 state how this credential appears in the message, under UserAgentType, verbatim:

Certificate — «Zertifikatsnummer, xxxx.yy wie auf dem physischen Zertifikat abgebildet» (certificate number, xxxx.yy as shown on the physical certificate)

Producer — «Name des Softwareherstellers» (name of the software manufacturer)

§8.1.1.1 adds to that, and the original marks the passage with a bold warning word: «Der UserAgent muss im Anschluss an die abgeschlossene Swissdec-Zertifizierung aktualisiert werden und muss sämtliche Informationen zum ERP-System (und nicht zum Endbenutzer) enthalten.» (the UserAgent must be updated once Swissdec certification is complete, and must contain all information on the ERP system rather than on the end user).

That makes the finding exact: every message on this line carries the name of the software manufacturer and a physical certificate number. In effect that is an admission register kept per manufacturer, at the interface itself. We write the sentence from a house that sits in exactly such a register: a German manufacturer ID that travels with every filing we transmit, and by which the tax administration counts each month how many real payload blocks we have submitted. A manufacturer register is a long-established instrument, and it carries a price worth knowing before paying it: whoever is not in it does not exist on the line.

The examples shipped show how early the programme stands. All eleven SOAP samples in the package carry <ep:Producer>Swissdec</ep:Producer>, <ep:StandardVersion>0.0</ep:StandardVersion> and <ep:Certificate>n/a</ep:Certificate>. The certification level for eBILANZ 1.0 is not yet numbered in the artefacts shipped.

Gate 3 — SUA, and what a company is recognized by

The third gate concerns not the software but the filing company. Annex C describes the «Swissdec Unternehmens-Authentifizierung» (SUA, Swissdec company authentication). C.1, verbatim:

«Grundlage einer SUA Registrierung ist eine bestehende Geschäftsbeziehung des Unternehmens zu einer Versicherung, welche Identität des Unternehmens bereits geprüft hat. Auf diese überprüfte Identität stützt sich Swissdec für die Identifikation des Unternehmens. Der Distributor prüft während der Registrierung die Angaben zum Unternehmen sowie die bestehende Vertragsbeziehung beim Versicherer.» (the basis of an SUA registration is an existing business relationship between the company and an insurer that has already verified the company's identity; Swissdec rests its identification of the company on that verified identity; during registration the Distributor checks the company's details and the existing contractual relationship held at the insurer)

The mandatory fields, likewise verbatim from the table: company name «Identisch mit Angaben aus dem UID-Register» (identical with the details from the UID register); UID number identical with the UID register and with the details held at the insurer; «Bestehende Vertragsverbindung (Vertragsnummer und Kundenummer)» (existing contractual connection: contract number and customer number) — identical with the details held at the insurer.

For representation, C.2.1.1 applies:

«Als Sicherheitsmassnahme muss der identische Stellvertreter beim Versicherer auch hinterlegt sein, was der Distributor im Rahmen der Registrierung überprüft.» (as a security measure, the identical representative must also be on file at the insurer, which the Distributor checks as part of registration)

We set that sentence down flat, and we source it. A Treuhandgesellschaft that wants to register for a client along this route has to be on file at the client's insurer. What that means for a Treuhandgesellschaft registering for several clients is not in the documents; C.2.1.1 governs the individual representative.

The access credentials do not arrive electronically. C.2.1:

«Zu diesem Zeitpunkt wird ein Brief an die beim Versicherer hinterlegten Adresse des Unternehmens gesendet. Dieser Brief enthält ein einmaliges Registrierungspasswort sowie das Sperrpasswort. Der physische Versand wird aus Sicherheitsgründen gemacht …» (at this point a letter is sent to the company address held at the insurer; the letter contains a one-time registration password and the blocking password; the physical dispatch is made for security reasons …)

(in the extracted text «Brief and die», sic)

The parameters, from Table C.3.1: security feature of the registration «Brief/ A+» (letter / A+), expressly a «Zweiter, nicht elektronsicher Kanal» (second, non-electronic channel) (sic); registration password at least 12 characters, valid 1 year; blocking password at least 12 characters, valid 5 years; renewal window 60 days before expiry; «3x (3 Jahre) Anzahl möglicher automatischer Erneuerungen» (3× — 3 years — number of possible automatic renewals) — after that, C.2.3: «Ist eine Zertifikat abgelaufen, kann die Erneuerung nicht mehr durchgeführt werden. In diesem Fall muss eine neue Registrierung durchgeführt werden.» (once a certificate has expired, renewal can no longer be carried out; in that case a new registration has to be made). The certificate itself is X.509v3 per RFC 5280, issuer CN = Verein Swissdec Issuing CA by DigiCert, subject CN = NTRCH-{UID}@swissdec.ch, O = {Name aus dem UID Register}, validity 1 year.

Then comes the observation that needs no verdict: a company without a swissdec-connected insurance relationship has no documented route in these papers. Not «einen schwierigen» (a difficult one). None is described. Nowhere is that written as an exclusion; it follows from a registration that knows no second root.

Where the chassis comes from

That explains itself as soon as one counts what this network is built on. The glossary in Annex B defines Domäne as: «Im Swissdec-Ökosystem bekannte Domänen sind; AHV, FAK, UVG, UVGZ, KTG, BVG, Lohnausweis, Quellensteuer, Grenzgänger und Statistik.» (the domains known in the Swissdec ecosystem are: AHV, FAK, UVG, UVGZ, KTG, BVG, Lohnausweis, Quellensteuer, Grenzgänger and statistics). The E-Bilanz does not appear in the list of known domains in its own specification. Institution there means: «Empfänger, der Daten erhält. Hier handelt es sich um Versicherungen, die den jeweiligen Domänen angehören.» (recipient that receives data; these are insurers belonging to the respective domains). Amounts throughout are of type ep SalaryAmountType, including the two operands and the results of the interoperability test. And §8.1.1.2, in a balance-sheet specification: «Es wird empfohlen, dass bei der Übermittlung grösserer Datenmengen (>2000 Personen) die Daten bereits vorher gefiltert werden.» (it is recommended that, when transmitting larger data volumes (>2000 persons), the data be filtered beforehand).

We quote that because the vocabulary shows where the network comes from. A network that has been distributing payroll data to insurers for years takes on a second freight, and the vocabulary remains the old one. That is why identity is proven through the insurer: for the freight this chassis was built for, an insurance relationship is not a precondition but the business purpose.

The address, and the fourth gate

The endpoint sits in the same WSDL, named for what it is:

<soap:address location="https://distributor.swisscom.com/services/ebilanz/BalanceSheet/V1"/>

We name the URL and claim nothing about the arrangement behind it. We have never called this endpoint — not even Ping, the one operation that needs no certificate.

Three gates, then, and none of them technical: a contract that, per the body that carries it, is still to be created; a credential named after the actor on the other track; an identity that hangs on an insurance contract. For Zürich there is a fourth, on an entirely different level and with nothing to do with the national network: a login that, per the canton, represents «immer eine natürliche Person» (always a natural person). It is called AGOV, and Part 5 takes it up.

All four are decisions. Decisions have authors, and authors can change them.

---