Automating vendor bill payments across a secure Azure middleware layer — real-time bidirectional sync between NetSuite, Azure Functions, and ICICI Bank servers with 4096-bit certificate authentication.
ICICI Bank is India's second-largest private sector bank with assets exceeding ₹16 trillion, operations across 17 countries, and over 1,30,000 employees. Managing vendor payments at scale across 14 legal entities — with full auditability, RBI compliance, and zero tolerance for payment errors — demanded a modern, secure integration layer between its ERP and banking infrastructure.
| Organisation | ICICI Bank Limited |
| Sector | Banking & Financial Services |
| Annual Revenue | ₹1,94,000 Crore (FY2023–24) |
| NetSuite Deployment | OneWorld — 14 legal entities, 3 base currencies |
| Subsidiaries | ICICI Prudential Life, ICICI Lombard, ICICI Securities, ICICI AMC + 7 others |
| Regulatory Bodies | RBI (India), FCA (UK), MAS (Singapore), DFSA (Dubai) |
| Go-Live | Q2 2024 — all integration streams live |
Prior to this engagement, ICICI Bank's vendor payment and financial operations ran on fragmented, manual pipelines with no real-time bridge between NetSuite and the bank's own payment servers.
Vendor bill approvals in NetSuite had no direct channel to ICICI Bank's payment server — finance teams manually triggered payments outside the ERP, breaking the audit chain.
No centralised middleware existed to translate NetSuite events into bank-consumable payment instructions, validate them, and handle async bank acknowledgements.
ICICI Bank's corporate API gateway required 4096-bit RSA certificate-based mutual TLS authentication — not supported natively by legacy integration tools in place.
Once a payment instruction left the ERP, there was no automated path for the bank's acknowledgement (success/failure/pending) to update the vendor bill status in NetSuite.
ICICI Bank's payment API required a fixed, whitelisted static IP endpoint — dynamic cloud functions with floating IPs were not permitted by the bank's security policy.
Treasury and AP teams spent 4.5 FTE-days per month reconciling NetSuite vendor bills against bank statements with no automated matching or exception workflow.
Azure Functions serve as the secure, stateless middleware layer — hosted behind a static outbound IP (Azure NAT Gateway) to satisfy ICICI Bank's IP-whitelist requirement. All traffic is protected by mutual TLS with 4096-bit RSA certificates issued by ICICI Bank's internal CA.
The static API constraint is resolved by routing all outbound Azure Function calls through an Azure NAT Gateway with a fixed public IP, registered on ICICI Bank's API whitelist. The 4096-bit certificate is stored in Azure Key Vault, referenced at runtime by the Function App — never embedded in code or config files.
Finance team approves vendor bills through a NetSuite Suitelet-based payment portal. On approval, a SuiteScript RESTlet fires a POST to the Azure Function API endpoint. Azure validates the payload, signs the request with the 4096-bit mTLS certificate from Key Vault, and forwards the payment instruction to ICICI Bank's corporate payment API.
ICICI Bank's server posts an asynchronous acknowledgement to the Azure Function callback endpoint.
Azure parses the ACK (Success / Failure / Pending), updates the Azure Service Bus queue,
and triggers a downstream RESTlet call into NetSuite to update the vendor bill
payment status field (custbody_icici_payment_status) and transaction reference.
ICICI Bank's end-of-day payment file is deposited to Azure Blob Storage via SFTP.
A NetSuite Map/Reduce script using N/https polls the Azure Function API
for new files, pulls the payment detail CSV, and matches transactions against open
vendor bills using external IDs — posting journal entries for settled amounts.
Approved vendor bill payments trigger a NetSuite User Event Script that creates a corresponding journal entry. The journal metadata is pushed through the Azure middleware to Finacle (core banking) for real-time GL reconciliation — eliminating the overnight batch mismatch risk.
Azure Functions implement a 3-tier retry policy (exponential backoff: 30s → 5min → 30min).
Failed payment instructions are routed to an Azure Dead-Letter Queue, triggering an
alert email to the AP team and writing a failure record to a NetSuite custom record
(custrecord_icici_payment_log) for full audit trail.
All calls to ICICI Bank's payment API use mTLS with 4096-bit RSA certificates issued by ICICI Bank's internal Certificate Authority. Certificates stored in Azure Key Vault — zero plaintext secret exposure.
Azure Function outbound traffic is routed through Azure NAT Gateway, providing a fixed public IP registered on ICICI Bank's API whitelist — satisfying the bank's mandatory IP whitelisting security policy.
Azure Functions authenticate to NetSuite using OAuth 2.0 (JWT Bearer, signed via N/crypto/certificate) and Token-Based Authentication (TBA) — no passwords stored in any configuration.
All Azure resources (Function Apps, Key Vault, Service Bus, Blob Storage) deployed exclusively to Central India region in compliance with RBI data localisation guidelines.
Every payment instruction carries a unique correlation ID from NetSuite bill creation through Azure processing to ICICI Bank ACK — full lineage queryable in NetSuite's custrecord_icici_payment_log.
No API keys, certificates, or credentials embedded in SuiteScript or Azure Function code. All secrets injected at runtime via Azure Key Vault references and NetSuite credential fields.
"The Azure middleware layer solved two problems we had been stuck on for years — the static IP requirement for our payment API whitelist, and secure 4096-bit certificate management without embedding credentials anywhere. The fact that every vendor bill payment is now initiated, tracked, and reconciled entirely within NetSuite has transformed how our AP and treasury teams operate."— Group CFO, ICICI Bank Limited