Updated on February 20, 2026

Overview

J.P. Morgan Host-to-Host is a communications and security platform used for file transmission that supports internet connectivity for external clients to send bulk payments or receive reporting files using SFTP, HTTPS, and AS2 protocols.

As part of the Cross Border Payments and Reporting Plus (CBPR+) initiative, SWIFT and leading Payment Market Infrastructures (PMIs) will require town name and country code for any beneficiary postal address.  

What’s changing? 

Currently, you must use one of three formats for postal addresses in your payment messages: 

  • Fully unstructured: 
    This format will be phased out by November, 14, 2026. After that, all address fields must use either the structured or hybrid format. 
  • Fully structured: 
    Address details are separated into specific fields, such as street name, post code, town, and country. 
  • Hybrid: 
    Combines structured elements (town and country—both required) with up to two unstructured address lines (each up to 70 characters) for flexibility during the transition. 

Impacted clients and systems 

These requirements apply to cross-border payments sent over the SWIFT network and to payments processed through PMIs that require hybrid or fully structured addresses.  

Impacted PMIs clearing systems include U.S. Fedwire, U.S. CHIPS, Canada (Lynx), Single Euro Payments Area (SEPA), Swiss Interbank Clearing, UK (CHAPS), Target2-Euro, South Africa’s(SAMOS), Australia, Hong Kong (CHATS), Japan (FXYCS), Malaysia, New Zealand, Philippines and South Korea (FCY).  

If your payments do not meet the new requirements  

Payments that do not follow the new address requirements may be rejected or delayed, which could impact your processing timelines. 

SEPA Credit Transfers, Direct Debits, and SEPA-Instant 

For SEPA Credit Transfers (CT), Direct Debits (DD), and SEPA-Instant the same address rules apply as for cross border payments   

Effective November 14, 2026, sent addresses must be fully structured or hybrid with a minimum of town (<TwnNm>) and country (<Ctry>) supplied in the pain.001 or pain.008 file. 

When issuing a SEPA DD, where the debtor account is located outside the European Economic Area (EEA), a structured or hybrid address must be provided for the debtor. 

As of November 2026, Non-EEA SEPA Countries include Albania (AL), Andorra (AD), Moldova (MD), Monaco (MC), Montenegro (ME), North Macedonia (MK), San Marino (SM), Serbia (RS), Switzerland (CH), United Kingdom (GB), Vatican City State (VA). 

This guidance does not replace any legal or regulatory requirements 

This guidance does not replace any legal or regulatory requirements and is not legal, tax, or compliance advice. You are responsible for ensuring payment information is complete and accurate and that your payment practices comply with applicable requirements. Requirements and timelines may change based on market practice or network rules.  

Future-proofing recommendations 

To get the most benefit from this transition, we strongly recommend migrating to the ISO 20022 messaging standard, specifically using the pain.001 message format for payment initiation.  

This will help you: 

  • Improve straight-through processing (STP)
  • Reduce manual interventions and errors. 
  • Enhance data quality and integrity throughout the payment lifecycle. 
  • Support compliance with global regulatory and screening requirements. 

Upcoming updates for additional formats 

Information for other formats—including EBICS, EDIFACT, IDOC, MT10x, EPOS, Open Roads, and custom formats—will be available soon.  Check back for the latest updates. 

Client testing 

Our client testing environment will be available soon. Check back here for updates and more information. 

We are here to help

Start your internal assessments early to ensure a smooth transition. If you have questions or need support as you prepare for this change, contact our support team at hybrid.address.migration@jpmchase.com

ISO20022 Support

X12 Support

Global Flat File (GFF) Support

Upcoming events

Our SSL certificate used for AS2, HTTPS, and NDM protocols will be replaced on March 21, 2026. Additional details can be found on our H2H SSL Support page as the renewal date approaches.

Google Chrome’s updated root policy now prevents public Certificate Authorities from issuing X.509 certificates with the Client Authentication EKU, leading to the phase-out of these certificates and impacting mutual TLS (mTLS) client authentication. J.P. Morgan will continue to require Client Authentication EKU for mTLS connections. For further details, please refer to the H2H SSL Support and H2H Partner Key Management pages.

Our SSH key and SSL certificate used for SFTP and FTPS protocols will be replaced November 7, 2026. Additional details can be found on our H2H SSH Support and H2H SSL Support pages as the renewal date approaches.

View current security standards

  • Transport Layer Security version 1.2 (TLSv1.2) is the minimum standard for communication session encryption for the following applications and protocols:
    • Applicability Statement 2 (AS2)
    • Hypertext Transfer Protocol Secure (HTTPS)
    • File Transport Protocol Secure (FTPS) – No longer supported for new setups
    • NDM via IBM® Sterling Connect:Direct® with Secure+®
  • The Administrative Procedures for Certificates include the following standards:
    • All certificates and keys must have a finite validity period of two years or less.
      • Beginning in 2Q2025, all certificates and keys used for transport authentication must have a finite validity period of 1 year or less.
    • No certificate shall be accepted unless it adheres, at minimum, to the following cryptographic specification:
      • Message digest: SHA-256, AES256
      • Asymmetric algorithm: RSA, DSS (DSS is not supported for SSH protocols).
      • Asymmetric algorithm key length: 2048 bits or more.
      • Elliptical curve algorithms are not supported at this time.
    • Elliptical curve algorithms are not supported at this time.

       

Certificates, Keys and Ciphers

Find everything you need, from bank security credentials to supports cryptography settings, to ensure your systems are compatible with J.P. Morgan Host-to-Host.

H2H PGP Support

H2H SSH Support

H2H SSL Support

  • true

    Partner Key Management
    The PKM process is used by clients to submit their production security credentials for renewal.

    Learn more

  • true

    Best Practices
    Review best practices to help keep file transmissions reliable and secure and ensure the best experience.

    Learn more

  • true

    Client Acceptance Testing (CAT)
    Test and verify connectivity using our CAT, also known as UAT, environment.

    Learn more

  • true

    H2H Resiliency
    Configure your system to use DNS and short-lived IP caching.

    Learn more

Support

Questions? Contact our support team at 877-494-1567 or HosttoHost.helpdesk@jpmorgan.com. Representatives are available to assist you 24 hours a day, Monday through Friday. Government, municipal and public sector clients should call 844-718-0643

Please note the support team cannot advise clients on specific actions needed to make the required system changes. Clients should contact the application vendors for this information.

All trademarks, trade names and service marks appearing herein are the property of their respective owners.