1
Infrastructure
Access Point
An Access Point (AP) is the technical gateway that connects a business to the Peppol network. Every document exchanged over Peppol — an invoice, an order, a credit note — passes through an Access Point on both ends.
Think of it as a managed post office. Your business hands a document to its AP (C2), which handles all the packaging, addressing, encryption, and delivery. On the other side, the receiver's AP (C3) unwraps and delivers it to the recipient's system (C4). Your business never speaks directly to the other business — APs mediate all exchange.
What an AP Does
Receives a document from your system, validates its format (BIS 3.0 / PINT SG), signs and encrypts it, looks up the receiver's AP via SMP/SML, and delivers it using the AS4 protocol. Handles acknowledgements and retries.
AP Certification
Access Points must be certified by a Peppol Authority — IMDA in Singapore, MDEC in Malaysia, OpenPeppol for international registrations. Certification requires demonstrating technical compliance with AS4, SMP, and document format standards.
Hosted vs. Self-Hosted
Most businesses connect to a hosted AP service — a third-party provider that manages the infrastructure. Large enterprises or technology vendors building their own Peppol integrations may operate a self-hosted (self-certified) AP.
4-Corner Model
C1 = Sender's ERP/system. C2 = Sender's Access Point. C3 = Receiver's Access Point. C4 = Receiver's ERP/system. The AP sits at corners 2 and 3 — the entire network topology is built around this model.
C1 — Sender
→
C2 — Sender's AP
→→
C3 — Receiver's AP
→
C4 — Receiver
From practice: Building an Access Point means dealing with AS4 message signing, SMP registration, BIS validation, and certificate management — before you even touch business logic. It is genuinely a specialised engineering task, which is why most businesses use a hosted AP service and a developer like me to wire it to their ERP.
2
Routing
SMP — Service Metadata Publisher
An SMP (Service Metadata Publisher) is a directory that stores each Peppol participant's capabilities: what Peppol ID they have, which document types they can receive, and which Access Point they are connected to.
Before sending a Peppol document, the sender's Access Point must confirm that the receiver is registered and capable of accepting that document type. It does this by querying the SMP. The SMP responds with the receiver's AP endpoint URL and the transport protocol details needed to deliver the document.
Peppol Participant ID
Every business on the Peppol network has a Peppol Participant Identifier — for example, 0195:SGUEN123456789A. The prefix (0195) is the scheme for Singapore UEN numbers. This ID is what gets registered in the SMP.
What the SMP Stores
For each participant: their Peppol ID, their Access Point's endpoint URL, the document types (process IDs) they accept, and the transport profile (AS4). An AP registers participants on the SMP when onboarding them to the network.
The Lookup Flow
Sending AP queries the SML to find the SMP that holds the receiver's record. Then queries the SMP directly to get the receiver's endpoint details. This two-step lookup happens every time a document is about to be sent.
Who Operates SMPs
Access Point providers operate their own SMP and register their connected participants on it. OpenPeppol operates the SML that points to all the SMPs. In Singapore, IMDA operates a national SMP for the InvoiceNow network.
Analogy: Think of the SMP as a detailed contact card in a business directory. It tells you exactly which post office (Access Point) to send a document to, and what document formats that business accepts. Without this record, you cannot send to them.
3
Routing
SML — Service Metadata Locator
The SML (Service Metadata Locator) is the top-level DNS-like directory for the entire Peppol network. It maps Peppol Participant IDs to the SMP that holds their registration record.
When a sending Access Point needs to route a document, it first asks the SML: "which SMP holds the record for this Peppol ID?" The SML responds with the hostname of the relevant SMP. The AP then queries that SMP directly to get the full delivery details.
The SML is operated by OpenPeppol and works via DNS — Peppol IDs are hashed and looked up as DNS subdomains under the edelivery.peppol.eu zone. This means the lookup is essentially a DNS resolution — fast, globally distributed, and stateless.
How the DNS Lookup Works
The sending AP hashes the receiver's Peppol ID using MD5, then queries a DNS name in the format [hash].iso6523-actorid-upis.edelivery.peppol.eu. The DNS CNAME response points to the SMP hostname.
Operated by OpenPeppol
The SML is a shared global infrastructure maintained by OpenPeppol. Every national Peppol authority (IMDA, MDEC, etc.) connects to this same SML. Participant registrations are propagated to it via the AP's SMP.
Why It Enables Dynamic Routing
Because of SML + SMP, no Peppol sender needs a list of receiver endpoints. The network resolves endpoints on the fly, for any registered business anywhere in the 50+ country Peppol network. There are no hardcoded partner connections.
SML vs. SMP
SML = "which SMP should I ask?" (one global DNS directory). SMP = "what are the delivery details for this participant?" (per-AP directory with full endpoint records). You always query SML first, then SMP.
Analogy: SML is the phone book index — it tells you which directory to look in. SMP is the actual directory entry — it gives you the full address and contact details. You need both, in that order, to route a document.
4
Protocol
AS4 — Secure Messaging Protocol
AS4 is the messaging protocol that Peppol Access Points use to transport documents between each other. It handles the envelope, the security wrapper, the delivery acknowledgement, and the error handling — independently of the document payload inside.
AS4 is based on the OASIS ebMS 3.0 standard. Peppol uses a specific AS4 conformance profile (the "Peppol AS4 profile") that mandates particular security settings, signing algorithms, and transport behaviours.
End-to-End Security
AS4 requires that messages be both digitally signed and optionally encrypted at the message level. Signing uses the sender AP's Peppol certificate. The receiver AP verifies the signature before accepting the message — ensuring the document has not been tampered with in transit.
Non-Repudiation
AS4 provides proof of receipt. When the receiver AP successfully receives and processes a message, it sends back a signed acknowledgement (Receipt NRR). The sender AP stores this as legal evidence that the document was delivered. Critical for audit trails.
Reliable Delivery
If a delivery fails, AS4 defines retry behaviour. The sending AP retries with exponential backoff, and the message ID ensures idempotency — even if the same message is delivered twice, the receiver only processes it once.
Why AS4 Replaced AS2
AS2 was the previous Peppol transport protocol. AS4 replaced it because it is web-service native (SOAP/HTTPS rather than MIME/SMTP), has stronger security algorithms, better suited to cloud-hosted APs, and aligns with EU eDelivery building blocks.
| Property |
AS4 (Peppol Profile) |
| Transport | HTTPS (TLS 1.2+) |
| Message format | SOAP with MIME attachments |
| Signing algorithm | RSA-SHA256 / RSA-SHA384 |
| Certificate type | Peppol PKI X.509 certificate (issued by OpenPeppol) |
| Acknowledgement | Signed Receipt (Non-Repudiation of Receipt) |
| Retry behaviour | AP-defined; typically 3–5 retries with backoff |
| Idempotency key | Message ID (UUID) — deduplication at receiver AP |
From practice: Implementing AS4 correctly means managing Peppol PKI certificates, building the SOAP envelope construction, handling signed acknowledgements, and implementing deduplication. The certificate lifecycle alone — rotation, revocation, test vs. production PKI — is a significant operational task for any Access Point operator.
5
Procurement Phase
Pre Award
Pre Award is the procurement phase that happens before a contract is signed — covering everything from tendering and bidding through to the award decision. In the Peppol context, Pre Award covers the standardised document types that support this phase: tender notices, call for tenders, tender responses, and award notices.
Peppol's Pre Award standards allow government procurement systems to publish tenders electronically and receive tender responses in a structured, machine-readable format. This enables suppliers to automatically process opportunities from any compliant procurement portal — without re-keying data.
Key Pre Award Documents
Tender Notice (announcing an opportunity), Call for Tenders (formal invitation to bid), Tender Response (supplier submission), Award Notice (notification of the contract award decision). All standardised as Peppol BIS documents.
Who Uses Pre Award
Primarily government procurement agencies and the suppliers who respond to public tenders. In the EU, Pre Award is driven by the Public Procurement Directives. In APAC, adoption is led by national e-procurement platforms (e.g., GeBIZ in Singapore, eProcurement in Malaysia).
Status of Mandates
Pre Award is less uniformly mandated than Post Award. The EU has the most mature Pre Award mandate (eTendering requirements under 2014/24/EU). Singapore's InvoiceNow focuses on Post Award — Pre Award is supported but not yet mandated for private sector.
Relationship to Post Award
Pre Award and Post Award are the two halves of the full Peppol procurement lifecycle. A Pre Award process ends when a contract is awarded; the Post Award process begins with the first Purchase Order issued under that contract.
Simple summary: Pre Award = everything before you win the contract (finding opportunities, submitting bids, receiving award decisions). Post Award = everything after you win (orders, delivery, invoicing, payment).
6
Procurement Phase
Post Award
Post Award is the procurement phase after a contract is awarded — covering the execution of that contract through to payment. This is where the majority of Peppol mandates apply, and where most businesses first encounter the network.
The core Post Award documents form a natural flow: a buyer sends a Purchase Order → the seller confirms with an Order Response → goods or services are delivered (Despatch Advice) → the seller issues an Invoice → payment is made. Peppol standardises all of these documents, enabling automated processing at each step.
Purchase Order (BIS Order 3.0)
Buyer's formal commitment to purchase goods or services. The Peppol PO carries structured line-item detail, delivery instructions, pricing, and tax information — all machine-readable by the seller's ERP system.
Order Response (BIS Order 3.0)
Seller's confirmation (or rejection, or substitution) of the received Purchase Order — at the line-item level. Enables a structured back-and-forth before the order is locked, without phone calls or email threads.
Invoice (BIS Billing 3.0 / PINT SG)
The most widely mandated Peppol document. In Singapore, this is a PINT SG invoice carrying GST treatment codes for C5 IRAS forwarding. In Malaysia, this is a MyInvois-validated UBL invoice. In the EU, it is a BIS 3.0 EN 16931 invoice.
Credit Note (BIS Billing 3.0)
Issued to reduce the value of an existing invoice. Must reference the original Peppol invoice by document ID. Treated identically to an invoice at the Access Point level — same transport, same format rules, same IRAS data forwarding (in SG).
Purchase Order
→
Order Response
→
Despatch Advice
→
Invoice
→
Payment
Singapore context: Singapore's InvoiceNow mandate focuses on the Invoice within Post Award. GST-registered businesses (and from Nov 2025, all businesses) must be able to send and receive Peppol invoices via a certified AP. The invoice is then forwarded to IRAS as the C5 data submission.
7
Infrastructure
eDelivery
eDelivery is the overarching infrastructure layer that makes Peppol work globally. It refers to the combination of the 4-corner model, Access Points, SMP/SML routing, and the AS4 protocol — the full technical stack for exchanging structured business documents between any two participants anywhere in the Peppol network.
eDelivery is also a formal EU building block (CEF eDelivery — Connecting Europe Facility). The EU and OpenPeppol collaborated closely: Peppol's AP network is technically compatible with the EU eDelivery specification, which is also used by European public administrations beyond Peppol (e.g., customs data exchange, judicial document transmission).
What eDelivery Standardises
How documents travel: the AS4 messaging protocol, the SMP/SML routing mechanism, the certificate infrastructure, and the 4-corner model. eDelivery is transport-agnostic to the document content — what travels is defined by BIS/PINT standards, not eDelivery.
eDelivery vs. Document Standards
eDelivery = the envelope and postal network. BIS 3.0 / PINT SG = the content inside the envelope. A document can only reach its destination if it conforms to both: the right document format (BIS) delivered via the right transport (eDelivery / AS4).
Global Reach via eDelivery
Because eDelivery is standardised, a Peppol document sent from Singapore can be routed to any registered participant in 50+ countries — Australia, Germany, Norway, Japan — without any point-to-point integration. The SML/SMP lookup handles the routing automatically.
EU eDelivery Building Block
The EU's CEF eDelivery programme extends the same AS4-based eDelivery concept to non-Peppol use cases across European public administrations. Peppol APs can interoperate with these systems because the protocols are aligned — reducing the fragmentation of B2G document exchange.
Key point: eDelivery is what makes Peppol a genuine network rather than a collection of point-to-point integrations. Any AP connected to eDelivery can reach any other AP connected to eDelivery — globally, dynamically, without bilateral agreements. That is the fundamental value of the Peppol network.
From practice: When building an Access Point, eDelivery compliance means passing OpenPeppol's conformance testing — demonstrating that your AS4 implementation, SMP registration, and certificate handling all meet the specification. This is a formal, assessed process before you are permitted to operate on the live Peppol network.