What are IDES Alert Codes and ICMM Notices?
The IRS International Data Exchange Service (IDES) is the secure gateway FFIs use to transmit FATCA reports, Form 8966 filings, and certain 1099 submissions directly to the IRS. When a package is uploaded, IDES runs a series of automated checks and returns one of two response types:
- IDES Alerts (RC codes) — Validation results returned at upload time. RC001 is a success; RC002 through RC029 indicate specific structural, cryptographic, or metadata failures.
- ICMM Notices (NKS, NSC, NDW, NSF, NTP) — Deeper cryptographic and semantic notifications returned after the package has been received and processed.
Both types of errors block your filing. Most are caused by the same handful of root problems: incorrect filename formatting, wrong encryption mode, missing metadata tags, or a mismatch between Sender GIIN across the three packaging layers.
IDES Alert Codes (RC001–RC029)
IDES Alerts are returned at the moment of upload. The code tells you exactly which layer of the IDES package failed — filename, encryption, metadata, or payload structure.
| Error Code | Category | Official IRS Error Description | Root Technical Cause | How Novus packages it |
|---|---|---|---|---|
| RC001 | IDES Alert (SA) | Successful upload (passes IDES validation) | Transmission archive structure is valid and accepted by the IDES gateway. | Builds the archive to the IDES structure rules that RC001 confirms. |
| RC002 | IDES Alert (DL) | Duplicate archive filename | A .zip file with the exact same UTC timestamp and GIIN was already uploaded. |
Generates a fresh, millisecond-accurate UTC timestamp filename on every export. |
| RC003 | IDES Alert (DL) | Failed encryption check in IDES | Encrypted with the wrong cipher mode (e.g., AES-ECB instead of AES-256-CBC) or an expired IRS .cer key. |
Natively encrypts using AES-256-CBC with the official IRS public .cer certificate. |
| RC004 | IDES Alert (DL) | Failed FATCA Metadata schema check | Invalid XML structure or missing mandatory tags inside [Sender_GIIN]_Metadata.xml. |
Auto-generates schema-validated IDES metadata headers matching IRS specs. |
| RC005 | IDES Alert (DL) | Invalid Metadata Namespace | Wrong XML namespace URI declared at the root of the Metadata XML file. | Hardcodes the exact IRS IDES metadata namespace URIs. |
| RC006 | IDES Alert (DL) | Sender GIIN not registered / inactive | The GIIN used is not active on the current IRS FFI list or not enrolled in IDES. | Checks the Sender GIIN’s format before packaging. Confirm registration and IDES enrolment on the IRS FFI List. |
| RC007 | IDES Alert (DL) | Receiver GIIN invalid | Receiver GIIN in metadata or key filename is not 000000.00000.TA.840 (IRS) or a valid HCTA GIIN. |
Sets the IRS Receiver GIIN (000000.00000.TA.840) for packages addressed to the IRS. |
| RC012 | IDES Alert (DL) | Sender GIIN mismatch | Mismatch between the ZIP filename GIIN, Metadata <SenderFileId>, and XML <SendingCompanyIN>. |
Locks and synchronizes the Reporting GIIN across all three layers simultaneously. |
| RC014 / RC015 / RC016 | IDES Alert (DL) | Payload, Key, or Metadata file missing | Archive is missing _Payload, _Key, or _Metadata.xml. |
Bundles the complete three-file IDES archive. |
| RC018 | IDES Alert (DL) | Package filename format error | Archive name violates the strict YYYYMMDDTHHMMSSmsZ_[GIIN].zip naming convention. |
Names the output .zip file to exact IRS ISO-8601 UTC specifications. |
| RC021 | IDES Alert (DL) | Unauthorized file inside archive | Extra files (such as .DS_Store, thumbs.db, or raw .xml) were included inside the ZIP. |
Builds a clean, isolated archive containing strictly the authorized IDES files. |
| RC027 | IDES Alert (DL) | ZIP package contains a folder | Files were zipped inside a subfolder instead of the flat root level of the .zip. |
Compresses all IDES component files directly at the flat root level of the ZIP archive. |
ICMM Notification Errors (NKS, NSC, NDW, NSF, NTP)
ICMM Notices are returned after IDES has received and processed your package. They indicate deeper cryptographic or semantic validation failures — the kind that only surface once the encrypted payload has been decrypted by the IRS systems.
| Notice Code | Category | Official IRS Error Description | Root Technical Cause | How Novus packages it |
|---|---|---|---|---|
| NKS | ICMM Notice | Incorrect AES Key Size | Decrypted AES key file is not exactly 48 bytes (32-byte AES-256 key + 16-byte IV). | Cryptographic engine generates an exact 48-byte (256-bit key + 128-bit IV) buffer. |
| NSC | ICMM Notice | Failed Signature Check | Signed with a detached/enveloped signature instead of an enveloping RSA-2048 SHA-256 XML signature. | Applies a compliant enveloping XML digital signature using your .p12 certificate. |
| NDP | ICMM Notice | Failed Decompression | Payload was encrypted before compression, or used ZIP64 / Deflate64 instead of standard Deflate. | Executes the exact IRS sequence: Enveloping Sign → Standard Deflate → AES-256-CBC Encrypt. |
| NDW | ICMM Notice | Failed Decryption / Unreadable | AES-256-CBC padding (PKCS#7) is invalid, or the IV was not properly formatted in the key file. | Enforces strict PKCS#7 padding and exact IRS cipher block chaining parameters. |
| NSF | ICMM Notice | Failed Schema Validation | Decrypted FATCA/1099 XML payload failed validation against IRS XSD schema. | Validates the XML against the IRS XSD and business rules before packaging. |
| NTP / NPT | ICMM Notice | Test Data in Prod / Prod Data in Test | DocTypeIndic (FATCA1–4 vs. FATCA11–14) does not match the IDES environment. |
Sets DocTypeIndic to match the Test or Production mode you choose. |
How to Resolve an IDES Error — Step by Step
- Decrypt the ICMM notification package. If you received an error notification, decrypt it using your private key to read the exact error code.
- Identify the code category. RC codes are structural — fix the packaging. ICMM notices are cryptographic or semantic — fix the encryption or the XML.
- Check the three-layer GIIN consistency. The most common error (RC012) is a GIIN mismatch across the ZIP filename, Metadata, and XML payload.
- Verify the encryption sequence. The correct order is: Enveloping Sign → Standard Deflate → AES-256-CBC Encrypt. Any deviation triggers NDP, NSC, or NDW.
- Re-validate the XML payload. Use our free XML validation tool to confirm the payload passes IRS XSD validation before re-packaging.
- Re-submit with a fresh filename. Never resubmit with the same ZIP filename — RC002 will trigger immediately.
Common causes across all IDES errors
- Manual packaging errors — ZIP created in Windows Explorer or Finder adds hidden folders or uses the wrong compression method.
- Expired IRS certificates — Using an old
.cerfile that has been rotated or revoked. - Wrong IV handling — The 16-byte initialization vector must be correctly prepended to the 32-byte AES key.
- Namespace typos — A single character off in the Metadata XML namespace URI causes RC005.
Frequently asked questions
What is the difference between an IDES Alert and an ICMM Notice?
IDES Alerts (RC codes) are returned immediately at upload time and indicate packaging, filename, or metadata structure issues. ICMM Notices (NKS, NSC, NDW) are returned after the IRS decrypts and processes your package, and indicate cryptographic or semantic failures.
Can I resubmit a package with the same filename after fixing an error?
No. IDES stores every filename ever uploaded. Resubmitting with the same name triggers RC002 (Duplicate archive filename). Always generate a fresh UTC timestamp for the ZIP filename.
Why do I keep getting NKS errors even though my XML passes validation?
NKS indicates the AES key file is the wrong size. It must be exactly 48 bytes — 32 bytes for the AES-256 key plus 16 bytes for the initialization vector. If your tool generates a key of any other size, NKS will trigger.
What is the correct encryption sequence for IDES?
The IRS requires this exact order: (1) apply an enveloping XML digital signature, (2) compress the signed XML using standard Deflate, (3) encrypt the compressed payload using AES-256-CBC, (4) encrypt the AES key using the IRS public key (RSA), (5) package the payload, key, and metadata into a correctly named ZIP.
Can Novus Compliance fix an IDES package I already built manually?
Often, yes. First decrypt the ICMM notification with your own private key (Novus cannot do this for you), then share the error code with our support team. We can identify the cause, and Novus can regenerate a compliant package for you to upload.