Deutsche Bank: SEPA credit transfer fails — 9210 with HKVPP (VoP), 9076 without

[Seifenteufel]

Deutsche Bank: SEPA credit transfer fails — 9210 with HKVPP (VoP), 9076 without

Library: phpFinTS 4.1.0 · PHP: 8.3
Bank: Deutsche Bank, BLZ 87070000, https://fints.deutsche-bank.de/
TAN method: BestSign-Push (decoupled, Sicherheitsfunktion 921)

Account-info retrieval (GetStatementOfAccount / camt) works perfectly with this access.
Only outgoing SEPA credit transfers fail.

Problem

SendSEPATransfer to Deutsche Bank is always rejected — and we end up in a catch-22:

(a) With the auto-added HKVPP (VoP) segment:

HIRMG:2:2+9050::Teilweise fehlerhaft.
HIRMS:3:2:3+9210::SEPA-Nachricht ungültig/fehlerhaft.   (refers to HKCCS, seg 3)
HITAN:4:7:4+4++noref+nochallenge                        (no TAN challenge issued)

(b) Without HKVPP (patched BPD::vopRequiredForRequest() to return null, for testing):

HIRMG ... 9076::Namensabgleich erforderlich
        9050::Teilweise fehlerhaft.
HIRMS (wrt HKTAN, seg 4) 9210::Keine Daten zur übermittelten Auftragsreferenz vorhanden.

So the bank requires VoP (9076 when HKVPP is omitted) but rejects the request the library
builds when HKVPP is present (9210 on the HKCCS). No transfer is possible either way.

Sent message (segment numbers)

HKCCS:3:1+...<pain XML>...      (seg 3 — the transfer)
HKTAN:4:7+4+HKCCS+...           (seg 4 — Prozessvariante 2, decoupled)
HKVPP:5:1+...pain.002.001.10    (seg 5 — VoP request)

Key observation: the bank reports no error on HKVPP (seg 5) itself — it flags HKCCS (seg 3)
as 9210 ungültig, but only when HKVPP is present. The same HKCCS without HKVPP yields 9076.

HKVPPv1 (via VopHelper::createHKVPPForInitialRequest) carries no reference to the order —
no HKCCS segment number, no order ID, no MsgId, no EndToEndId — only the supported pain.002
descriptors. The HKVPP↔HKCCS association is purely positional. This looks like a HKVPP↔HKCCS
linkage / VoP-content requirement specific to Deutsche Bank.

Already ruled out (all still 9210 when HKVPP is present)

• pain versions: pain.001.001.03, pain.001.003.03, pain.001.001.09
• with and without creditor/debtor BIC (IBAN-only: <Othr><Id>NOTPROVIDED</Id>)
• ReqdExctnDt = 1999-01-01 (immediate) and a real future date
• single immediate (HKCCS) and dated single (HKCSE)
• removing xsi:schemaLocation; pure-ASCII content (umlauts transliterated); name ≤ 70 chars

Bank parameters (from BPD)

• HISPAS supported formats: pain.001.003.03, pain.001.001.03, pain.001.001.09,
  pain.008.001.02, pain.008.001.08
• HIVPPS vopPflichtigerZahlungsverkehrsauftrag: HKCCS, HKCDE, HKCDN, HKCSE, HKIPZ, HKIPD, HKIDA, HKIPT, HKCCM, HKCME, HKIPM, HKIPE, HKZDF (i.e. VoP is mandatory for every transfer type)

Question

Is the HKVPP built by VopHelper::createHKVPPForInitialRequest (HKVPPv1, requesting
pain.002.001.10) compatible with Deutsche Bank? Since the bank flags HKCCS as invalid only
when HKVPP is present, could it be the HKVPP segment version, a missing explicit reference between
HKVPP and the order, the requested pain.002 descriptor, or a field-order / optional-field detail?

Happy to provide full sanitized raw request/response dumps.