1. Present situation - DRAFT Emile Bartolé CEN/WS XBRL: Improving transparency in financial and business reporting CWA2 Situation & latest evolutions 1CWA2

2. Objectives of CWA2 Dual objective of CWA2: standardize The way of submitting instances, a container with standardized Encryption Digital signature Compression … The way of transmitting the usual metadata that determine the context of an xbrl reporting instance the sender of the document contact details date and time of submission … Page 2CWA2

3. Deliverables Specification document(s)Delivered (draft) Header XML schemaDelivered (draft) Instance Feedback XML schemaDelivered (draft) Container Feedback XML schemaDelivered (draft) Container Test toolsIn progress (draft) CBV in dimensional XBRLIn progress (draft)

4. Enhanced workflow Submission container Declarer header.xml nationalinstance1.xbrl nationalinstance2.xbrl Subcontainer National Supervision Authority European / OtherSupervisionAuthority Feedback

5. Submission container Multiple XBRL instance documents packed with one xml header file Header is the only file with a naming convention: header.xml; it is located on top-level of the compression package Header lists xbrl instances contained in the container Instances should always have extension.xbrl Use of folders is optional; in case they are used, all references (in header to XBRL instances; in XBRL instances to taxonomy files) must respect them. Folder names used here (Instances, Taxonomy) are given as examples Authorities may define their naming convention (files, folders) Multiple compression packages per security envelope are allowed Other files in adequate file formats (e.g. an audit report to prove the validity of the figures) are allowed, particularly also valid subcontainers, whether up to the ZIP, the Xades-EPES (SignedSubContainers) or to the encryption structure (FullSubContainers) Page 5 Package & Compress (zip) Signature (XADES-EPES) header.xml Instances instance1.xbrl instance2.xbrl … instancen.xbrl Taxonomy taxonomy-file1.xml |.xsd taxonomy-file2.xml |.xsd … taxonomy-filen.xml |.xsd SignedSubContainers XadesSignedSubcontainer.xml FullSubContainers EncryptedSubcontainer.xml Attachment AuditReport.pdf Encryption (XML Encryption)

6. Page 6 Signature 1 (contributor 1 - private key) Encryption (public key of the first destinee) Zip Header Instance 1 Instance 2... Instance n SignedSubContainers XadesSignedSubcontainer.xml not encrypted potentially signed by a different contributor FullSubContainers EncryptedSubcontainer.xml encrypted for final destinee potentially signed by a different contributor usual container structure National Supervision Authority Single collection - multiple dispatching Encryption (next destinee) & transfer OtherAuthority: e.g. EBA OtherAuthority: BIS / ESRB / Banking Union / … Transfer only

7. EBA requirement: Ensure integrity Solution: use signed subcontainers! Integrity of data is guaranteed for both receivers respectively, for NSA in the Instances integrity area, for subsequent institutions in their respective subcontainers integrity area If InstanceAn.xbrl is meant to have identical content as InstanceAn.xbrl, enhanced services possible are possible by NSA: guarantee identity of information delivered to NSA and ESA (via simple file comparison) Page 7 Package & Compress (zip) Signature (XADES-EPES) header.xml Instances InstanceA1.xbrl InstanceA2.xbrl … InstanceAn.xbrl SignedSubContainers SignedSubcontainer.xml Header.xml InstanceB1.xbrl InstanceB2.xbrl … InstanceBn.xbrl Encryption (XML Encryption) NSANSA ESAESA Integrity areas

8. EBA requirement: use with secure transport Page 8 Package & Compress (zip) Signature (XADES-EPES) header.xml Instances InstanceA1.xbrl InstanceA2.xbrl … InstanceAn.xbrl SignedSubContainers SignedSubcontainer.xml Header.xml InstanceB1.xml InstanceB2.xml … InstanceBn.xml Encryption (XML Encryption) Unsecure or undefined transport: Package & Compress (zip) header.xml Instances InstanceA1.xbrl InstanceA2.xbrl … InstanceAn.xbrl SignedSubContainers SignedSubcontainer.xml Header.xml InstanceB1.xml InstanceB2.xml … InstanceBn.xml Secure transport:

9. Feedback container One XML feedback file per XBRL instance in the original submission container Feedback files will be generated systematically, even if no errors at validation time occurred (also positive acknowledge) The XML schema for the feedback files will contain a hash code for the original file guaranteeing non- repudiation of the submitted XBRL instances The feedback file will have the same name as the original instance it refers to (but with extension.xml instead of the original.xbrl) Folder name used here (Feedback) is given as an example Package & Compress (zip) Signature (XADES-EPES) Feedback instance1.xml instance2.xml … instancen.xml Encryption (XML Encryption) Page 9

10. Page 10CWA2 Standards & Algorithms TopicReferences & StructuresAlgorithmsRemark Compr ession http://www.pkware.com/docum ents/casestudies/APPNOTE.T XT zipV2.0 or higher Hashhttp://csrc.nist.gov/publications /fips/fips180-4/fips-180-4.pdf SHA256Identify files Digital Signat ure http://eur- lex.europa.eu/LexUriServ/Lex UriServ.do?uri=OJ:L:2011:053: 0066:0072:EN:PDF XADES-EPES http://www.ietf.org/rfc/rfc3 447.txt RSAwithSHA512 Encryp tion http://www.w3.org/TR/xmlenc- core1/ (Fallback: http://www.w3.org/TR/xmlenc- core/) http://www.w3.org/TR/xmlenc- core/ http://www.ietf.org/rfc/rfc3 447.txt RSA (OAEPWITHSHA- 512ANDMGF1PADDING)

11. Tools developement: Environment: Java TopicFrameworkPackages Manage zip filesStandard Javajava.util.zip Manage xml filesStandard Java XML EncryptionStandard Javajavax.crypto, java.security, javax.xml.crypto Digital Signature (XAdES) Eid-dss http://code.google.com/p/eid- dss/

12. CWA2 Header XML Direct import of the core business vocabulary into the draft header schema Support of initial & update submissions Full support of signed as well as signed & encrypted subcontainers

13. Header Orientations Types of header fields CWA2Page 13 Type of fieldWay of dealing with it Related to filing instance reportsIntegrated into the header XML schema Transport relatedNot in the scope of the header taxonomy, this should be part of the submission / transport system used Data relatedNot in the scope of the header taxonomy, this should be part of the data taxonomy

14. Core business vocabulary in XBRL Re-implementation of the EU Core business vocabulary Dimensional XBRL DPM (with Tables) being developed First taxonomy version available

15. Thanks for your attention Page 15 Comments or questions? emile.bartole@cssf.lu CWA2