Enable Banking Sweden

Overview

enable-banking-api

enable-banking-sandbox

enable-banking-faq-best-practices

Workflow

1. Identify whether the flow is AIS, PIS, or both.
2. Identify PSU type: personal or business.
3. Identify the Swedish ASPSP/brand: Swedbank/Sparbanken, SEB, Handelsbanken, Nordea, Nordea Corporate, Nordea First Card, Länsförsäkringar Bank, Danske Bank, or another Swedish ASPSP.
4. Check whether the flow needs BankID, Swedish SSN/personnummer, business ID, debtor account, Bankgirot, OCR, or sandbox-specific behavior.
5. Read references/sweden-open-banking.md for the relevant ASPSP and payment specifics.

Core Rules

• Swedish banks commonly support redirect and decoupled auth flows; Danske Bank is redirect-only.
• BankID, especially Mobile BankID, is the primary SCA method across major Swedish banks.
• Swedish SSN/personnummer can be required for BankID-based authentication and is supported by most major Swedish banks as part of the auth flow.
• For business accounts, some ASPSPs require extra business identifiers or prior power of attorney setup.
• Swedish domestic payments use SEK and domestic account number formats based on clearing number plus account number.
• Swedish banks also support SEPA Credit Transfers in EUR, but SEPA Instant Credit Transfers are not supported in Sweden.
• For Bankgirot payments, use

  reference_number

  for OCR and

  remittance_information

  for message. If both are provided and the ASPSP accepts only one,

  reference_number

  has priority.
• Do not assume individual payer details are available for Bankgirot batch settlements in AIS transaction data.
• For Swedbank historic transactions, handle empty pages with continuation keys and missing

  entry_reference

  for older transactions.

Project Placement

• Keep ASPSP-specific request shaping and validation in backend services.
• Keep Swedish payment form validation in shared form/domain code only if it is reused; otherwise keep it near the Sweden payment flow.
• Store personnummer/business identifiers carefully as sensitive user-provided data; avoid logging them.
• Keep user-facing Swedish bank instructions in frontend code, but source behavior from typed domain rules so API requests remain consistent.