Athena — xas2027-srs-reconciliation.md

XAS 2027.1.0 ↔ Athena SRS Reconciliation

XAS version reviewed: AuditfileSalaris v2027.1.0 (consultation document, Belastingdienst)
Files examined: XSD schema + Toelichting DOCX + FunHie DOCX (from xas-2027-consultatie.zip)
SRS target: DA-098 (Fictitious-Bank-Account and Salary-Fraud Detection) and related Liquide Middelen requirements
Date: 2026-09-02


What XAS is

XAS (AuditfileSalaris) is the Belastingdienst's payroll/salary auditfile standard — the payroll-domain sibling of XAF (AuditfileVersie, the GL/accounting auditfile). Both are XML-based, both are published under the same odb.belastingdienst.nl namespace authority, and both follow the same annual-submission model. They are, however, produced by different software, cover different data domains, and are filed with the Belastingdienst for different purposes:

| | XAF | XAS | |---|---|---| | Domain | General ledger / accounting | Payroll / salary administration | | Produced by | Accounting packages (Exact, Twinfield, Unit4, AFAS Boekhouden) | HR/payroll packages (AFAS Salaris, Nmbrs, Visma, HR2day) | | Filed with | Tax authority for GL audit | Tax authority for payroll tax audit | | Schema namespace | AuditfileVersie3... | AuditfileSalaris-Versie2027_1.0 | | Core entity | Journal transaction / GL posting | Employee income relationship / salary period |


XAS schema summary (elements relevant to Athena fraud detection)

Top-level structure

auditfile
 ├── BrAlg            (Bericht Algemeen — file header)
 │    ├── AandatAud   (audit date)
 │    ├── Bljr        (boekjaar / fiscal year)
 │    └── TotLnLbPh   (total wage tax withheld)
 │
 ├── Inhpl            (Inhoudingsplichtige — the employing entity)
 │    ├── Nm          (employer name)
 │    ├── Lnadm       (salary administration record with software metadata)
 │    │    └── Lncmp[]  (salary component definitions — types 03–99, e.g. LnGld / LnBijBel / etc.)
 │    │
 │    └── Wrknmr[]    (one record per employee / recipient)
 │         ├── SofiNr     (BSN / SoFi tax ID)
 │         ├── Persnr     (employee number)
 │         ├── Gebdat     (date of birth)
 │         ├── SignNm     (significant part of surname)
 │         ├── Voorl      (initials)
 │         ├── Voorv      (surname prefix / tussenvoegsel)
 │         │
 │         └── InkVrhVst[]   (income relationship — one per employment)
 │              ├── NumIV         (income relationship number)
 │              ├── Ingdat/Enddat (start/end date of employment)
 │              ├── SrtInkCd      (income type code — see below)
 │              ├── JrlnTbBzBel   (annual salary for special remuneration base)
 │              ├── CAOCd         (collective labour agreement code)
 │              │
 │              └── Lntdvk[]      (salary period — one per payroll run / pay period)
 │                   ├── Prdnr         (period number)
 │                   ├── Ingdat/Enddat (period start/end)
 │                   ├── InkVrhVar     (variable period fields)
 │                   │    ├── LnLbPh   (wage for wage tax / loon voor loonheffing)
 │                   │    ├── LnSV     (wage for social insurance)
 │                   │    ├── LnInGld  (wage in cash — net/gross cash component)
 │                   │    ├── IngLbPh  (withheld wage tax)
 │                   │    └── AantVerlU (hours paid)
 │                   │
 │                   └── LnPrLncmp[]   (salary amount per salary component)
 │                        ├── IdLncmp   (salary component ID — references Lncmp above)
 │                        ├── IbanRknr  (IBAN of bank account receiving this payment)
 │                        └── Bdr       (amount paid)

Income type codes (SrtInkCd) — the director classification

The SrtInkCd field inside InkVrhVst classifies each employment relationship:

| Code | Dutch label | Relevance to Athena | |------|-------------|---------------------| | 13 | Loon/salaris directeuren van een nv/bv | Director of a BV/NV — directly relevant to DA-098 management-override check | | 17 | Loon/salaris directeur-grootaandeelhouder | DGA (director-major-shareholder) — highest-risk category for DA-098 | | 11 | Loon/salaris ambtenaren | Civil servants | | 15 | Overig loon/salaris | Regular employees | | 22–63 | Social security / pension / termination payments | Out of scope for DA-098 |

Codes 13 and 17 are the authoritative Belastingdienst classification for the director/DGA roles that DA-098 targets.


Reconciliation finding (1): XAS is a strong data source for DA-098's salary-comparison gap

The gap in the current DA-098 spec

DA-098 (management-override salary comparison) currently requires a user-uploaded director registry CSV (name, personal IBAN, registered annual gross salary) because the XAF file contains no structured payroll data. The SRS already notes this as a genuine data gap. The current V1 approach (user-supplied CSV + IBAN regex from GL description) is fragile.

What XAS provides that closes this gap

A XAS file for the same fiscal year as the XAF file contains, in structured form, exactly the data DA-098 needs:

| DA-098 data need | XAS field | Location in schema | |---|---|---| | Director identity (name) | SignNm + Voorl + Voorv | Wrknmr | | Director tax ID (BSN) | SofiNr | Wrknmr | | Employment type = director | SrtInkCd = 13 or 17 | InkVrhVst | | Registered annual salary | JrlnTbBzBel | InkVrhVst | | Period-level salary amount | LnInGld (per period) or LnLbPh | Lntdvk > InkVrhVar | | Bank account receiving salary | IbanRknr | Lntdvk > LnPrLncmp |

The IbanRknr field is critical: it is the IBAN to which each salary component is actually paid by the payroll system. This is the authoritative bank account of the employee/director — not a regex-inferred IBAN from a free-text GL description. Cross-referencing this against XAF Liquide Middelen transactions would be exact matching rather than heuristic matching.

Structural quality advantage over the manual CSV approach

The user-supplied director registry CSV that DA-098 currently requires is:

  • Manually compiled by the client (subject to omission or manipulation)
  • Not independently verifiable from the audit evidence
  • IBAN data is often missing or must be looked up separately

A XAS file submitted to the Belastingdienst is:

  • Independently filed (the client cannot alter it after submission for the period being audited)
  • Structured and machine-readable
  • Contains the exact IBANs used in the actual payroll system, per period
  • Already separates directors (SrtInkCd 13/17) from regular employees at the schema level

Implication for DA-098

The current DA-098 spec should document XAS as the preferred future data source for the director registry, replacing the manual CSV upload. The V1 implementation can retain the manual CSV approach (since XAS files are not universally available in all audit engagements), but the data-model-gap description should be updated to reflect:

  1. The gap is not inherent in the Dutch payroll domain — XAS defines exactly the structured data needed
  2. A future "XAS ingestion" feature would close the gap entirely without manual user data entry
  3. When both XAF and XAS are available for the same entity and fiscal year, XAS-derived director data is more reliable than a user-supplied CSV

Reconciliation finding (2): XAS structural patterns relevant to Athena's data model

Sibling-standard patterns that confirm XAF data model choices

XAS and XAF share several structural patterns that validate Athena's existing data model:

  • ISO currency code (ValCd / IsoValutacode) — same pattern as XAF HeaderDto.currency; confirms the single-currency-per-file model
  • Fiscal year as primary scope (Bljr) — same annual filing period as XAF HeaderDto.fiscalYear
  • Period-based decomposition (Prdnr, Ingdat/Enddat per period) — same pattern as XAF accounting periods
  • Employer/entity as root (Inhpl) — same as XAF Header > Company

Patterns unique to XAS that Athena does not need to replicate

The following XAS structures are payroll-domain-specific and have no counterpart in XAF or in Athena's fraud detection scope:

  • Social insurance indicators (IndZW, IndWW, IndZvw, IndWAO)
  • Insurance premium amounts (PrAofLg, PrAofHg, PrAwfLg, etc.)
  • Hour registration (Urnreg) and contracted hours
  • Car benefit taxation (Auto, Kenteken, CatprijsAuto, Bijtelperc)
  • Leave accrual (VakBsl, OpbAvwb, OpnAvwb)
  • Employee legitimation / identification documents (Legbew)
  • Salary component taxonomy (Lncmp with WzBlCd types: tijdvakloon / bijzondere beloningen / eindloonheffing)

These are all payroll administration concepts outside the scope of financial fraud detection on GL data.


Reconciliation finding (3): XAS is a separate format — new parser required

XAS is genuinely a separate format from XAF. Building XAS ingestion in Athena would require:

  1. A dedicated XasParser (new, separate from XafParser) — the XML structure is entirely different
  2. New DTOs for XAS data: XasHeaderDto, EmployeeDto (Wrknmr), IncomeRelationshipDto (InkVrhVst), SalaryPeriodDto (Lntdvk)
  3. A separate ingestion endpoint and upload flow in the Athena UI (XAS files are large HR files, often stored separately from accounting files)
  4. A new data store / database tables for XAS data (payroll data is PII-sensitive and should be stored separately from GL transaction data)
  5. GDPR/AVG compliance considerations for BSN (SofiNr) and salary data — XAS contains sensitive personal data at a finer grain than XAF

This is not a near-term task. The scope of building an XAS ingestion pipeline is comparable to building the original XAF ingestion pipeline. It should be tracked as a distinct future work item, not subsumed into DA-098.


Recommended update to DA-098

The DA-098 data model assessment section should be extended to state:

  • XAS as authoritative source: The Belastingdienst's XAS (AuditfileSalaris) standard defines, in structured form, exactly the director salary and bank account data that DA-098's salary-comparison check requires. SrtInkCd (codes 13 and 17) distinguishes directors and DGA from regular employees; JrlnTbBzBel carries the annual salary basis; IbanRknr within LnPrLncmp carries the exact bank account IBAN receiving each salary payment.

  • Near term (V1): Retain the current design — user-uploaded director registry CSV — as the practical approach, since XAS files are not universally available in audit engagements. Document in the UI that an XAS upload (when available) will be a superior substitute for the manual CSV in a future release.

  • Future work: A "XAS Ingestion" feature (separate from XAF ingestion, distinct work item) would parse the employer's XAS file alongside the XAF, automatically extract director/DGA salary data and IBANs, and populate the DA-098 comparison data without any manual user input. This would make the salary-override check reliable and auditor-independent.


Summary: what is in scope vs. out of scope

| Topic | In scope for Athena now | Out of scope / future | |-------|------------------------|----------------------| | XAS schema awareness for DA-098 gap documentation | Yes — this document | — | | DA-098 V1 with user-uploaded CSV director registry | Yes — existing design | — | | XAS as the preferred future data source for DA-098 | Documented here as intent | XAS parser = future work item | | XAS ingestion pipeline / XasParser | — | Future — distinct scope, not part of current sprint | | XAS fields for payroll administration (social insurance, hours, car, leave) | — | Out of scope — not relevant to GL fraud detection | | DA-098 surname-concentration and IBAN-regex checks | In scope per existing spec | — |

Reacties

Nog geen reacties