SID — the Agenzia delle Entrate data exchange channel

SID is the infrastructure through which financial operators send the Agenzia delle Entrate the data Italian and EU tax rules require — and it is machine-to-machine by design, with no screen to fall back on. A firm with an Italian branch cannot file the annual financial-account return without first accrediting to it, and accreditation is four separate steps that each fail differently. This is what SID is, how you get onto it, and what the deadlines and rejection paths actually are.

1. What SID is

The Sistema di Interscambio flussi Dati is the IT infrastructure the Agenzia delle Entrate built for the exchange of data flows with the entities obliged to report to it — banks, financial intermediaries, holding companies, insurers, payment service providers and professional bodies among them. It was created by the provvedimento of the Director of the Agenzia delle Entrate of 25 March 2013, protocol 2013/37561, which implements Article 11, paragraphs 2 and 3, of decree-law 6 December 2011 no. 201, converted with amendments by law 22 December 2011 no. 214.

The design point that matters operationally is stated in the provvedimento itself: SID provides for application-to-application dialogue between information systems, operating in a fully automated way. That was a deliberate privacy design, adopted in line with the opinions of the Italian data protection authority, and it has a direct consequence for build teams. There is no portal where a person pastes a file and clicks send. If the pipeline does not run, nothing is filed.

2. Getting onto it: four steps, four failure modes

Accreditation is sequential, and each stage has its own owner inside a firm. Treating it as one IT ticket is the classic first-year mistake.

Alongside the four steps sits an architectural choice: the firm must either accredit its own nodo di interscambio — an interchange node — or select one of the nodes already accredited. The provvedimento permits financial operators with adequate technological capability to use autonomous nodes, including on a consortium basis, or to use nodes already certified for dialogue with the Agenzia; the list of active nodes is published on the Agenzia’s own website.

There is a hard limit on what a shared node may do. Where an FTP node is used to exchange data on behalf of third parties, it may operate exclusively as a transmission channel and may have no active role in preparing the files to be sent. A firm that reads “we use a node provider” as “someone else builds our return” has misread the rule.

3. FTP and PEC, and where the 20 MB line falls

Two transmission methods exist and they are not equivalent.

• FTP through the firm’s own interchange node, or through one of the nodes previously accredited by operators offering transit services to third parties. This is the route for anything of size.
• Certified email (PEC), available only for files not exceeding 20 MB in compressed form. The provvedimento ties it to the requirements set by the Director’s provvedimento of 22 December 2005 and later amendments. Two further conditions bite: the PEC box must be fed in fully automatic mode, with no operator intervention, and it must remain active for 60 days even after a request to close it.

File naming is not cosmetic. Each flow carries a specific transmission code in the filename, and the qualifier consists of seven alphanumeric characters identifying the type of flow. Files that do not meet the standard are rejected before any content check happens.

Whichever channel is used, the firm must keep it active long enough to receive what comes back — the Agenzia returns the ricevuta and esito files through the same channel used for the transmission. A pipeline that opens a connection, pushes, and closes has completed half the obligation.

4. What travels through it: the annual financial-account return

The flow SID was built for is the comunicazione integrativa annuale to the Archivio dei rapporti finanziari, the section of the Anagrafe Tributaria provided for by Article 7, sixth paragraph, of DPR 29 September 1973 no. 605. The obliged population is the operatori finanziari named in that provision who were already subject to the reporting obligation under the provvedimento of 19 January 2007.

For each relationship active during the reference year, the return carries:

• Identifying data of the relationship, including its unique code, referred to the natural or non-natural person having disposal of it — expressly including procuratori and delegati — and to all co-holders where it is held jointly;
• Balances: the opening balance at 1 January and the closing balance at 31 December of the reference year;
• For relationships opened during the year, the opening balance at the date of opening; for those closed during the year, the balance booked before the closing date;
• Total movement amounts, split between debit and credit for each type of relationship, counted on an annual basis.

The deadline is annual: transmission by 20 April of the year following the year to which the information refers.

5. Worked example — first year for an Italian branch

Facts: an EU e-money institution opens an Italian branch in March, offers payment accounts to Italian residents from July, and closes its first calendar year with roughly 40,000 relationships, of which some 3,000 were opened and 400 closed inside the year.

Which rules apply: the branch is a financial operator holding relationships in scope, so the annual return is due by 20 April of the following year. Because relationships were opened and closed mid-year, three of the four balance rules apply simultaneously: 31 December closing balances for everything still live, opening balances at the date of opening for the 3,000, and the last booked balance before closure for the 400. There is no 1 January opening balance for anything opened after that date.

What the practitioner does: works backwards from 20 April to the accreditation, not from the accreditation to the deadline. Entratel registration, SID registration with a channel choice, the Agenzia certificate and the software are four dependencies in series, and the node decision — own node or an accredited one — determines whether an infrastructure build is in scope at all. A firm at 40,000 relationships should assume FTP: the 20 MB PEC ceiling is a genuine constraint at that volume, and discovering it in April is not recoverable.

Outcome: the return is prepared in-house, because it must be. Preparation of the file is the exclusive responsibility of the obliged party holding the data, without the possibility of using intermediaries for tax assistance and return transmission — the exemption that covers ordinary Italian tax filings does not reach this one.

6. How the file has to be built

The provvedimento prescribes the pipeline, not just the output. From the first stage of collecting data from their own IT systems, and for both transmission methods, financial operators must use automated mechanisms of extraction, composition into the prescribed record formats, compression and immediate encryption, in order to form and protect the information. The record layout and technical specifications sit in allegato 2 to the provvedimento.

Order matters at the end. Once the file is properly composed, compressed, encrypted and electronically signed, it is automatically sent by one of the two channels. The signature exists to assure the integrity of the content and is applied once preparation is complete — last, not first. A build that signs before compressing produces a file that will not pass.

The words “immediate encryption” are the ones to design against. They mean the extract does not sit in the clear on a staging volume while a batch waits for a window. Encryption belongs inside the extraction job.

7. Worked example — a negative esito

Facts: a firm transmits its return on 15 April. The ricevuta confirms acquisition. Three weeks later an esito arrives listing inconsistencies between the data communicated and what the Archivio dei rapporti already holds — several hundred relationships whose unique codes do not match those previously reported.

Which rules apply: the two return files do different jobs. The ricevuta certifies that the communication was presented, following a positive formal control, and carries the file identifier assigned by the user and the protocol assigned to the file; a ricevuta di scarto instead reports non-acceptance for breach of transport rules, filename anomalies, irregular data structure or inconsistency between the data communicated, in which case the communication is treated as not presented and the reason for rejection is given. Save force majeure, the ricevuta is made available through the same channel used for transmission within five working days of the day the file was protocolled. The esito is the separate, later check against the Archivio, and it lists every inconsistency found.

What the practitioner does: reads the calendar off the esito, not off the original deadline. On receiving a negative esito the firm must assess what corrective action is needed, and where that action requires a fresh transmission of the file, the new file must be sent within two months of receiving the negative esito. That is a second clock, invisible to anyone monitoring only 20 April.

Outcome: unique relationship codes are reconciled against what was previously reported rather than regenerated, and the corrected file goes back inside the two-month window. The lesson generalises: a ricevuta is not an acceptance of content.

8. What happens to the data

Two facts here are worth knowing before a firm answers a customer question about it. First, the data is used analytically: under Article 11, paragraph 4, of decree-law 201/2011, the Agenzia processes it through centralised procedures to form specific selective lists of taxpayers at higher risk of evasion, and the same information is used to simplify and to verify the dichiarazione sostitutiva unica. Second, it does not sit there forever — it is retained within the maximum time limits for income-tax assessment, that is until 31 December of the sixth year following each year to which the communication refers, and is then integrally and automatically deleted.

The data protection authority was consulted in preparing the provvedimento, as Article 11(3) required, and issued opinions on 17 April 2012, 15 November 2012 and 31 January 2013; the specific recommendations it formulated for financial operators are annexed to the provvedimento as allegato 4. A firm building this flow should read that annex as part of the specification rather than as background.

FAQ

What to do, today

• Reporting lead: confirm which of the four accreditation steps is actually complete. An Entratel registration alone is not SID access.
• Architect: decide own node versus accredited node before scoping anything else, and size against the 20 MB PEC ceiling rather than assuming PEC will do.
• Engineer: move encryption inside the extraction job and apply the electronic signature last, after composition and compression.
• Compliance officer: instrument two clocks — 20 April for the return, and two months from any negative esito — and treat a ricevuta as receipt, never as acceptance.

Related: Anagrafe dei rapporti finanziari · INFOSTAT — the Banca d’Italia reporting channel · Reporting channels compared across the EU · Italy reporting calendar for payment institutions