The merchant must encrypt the transaction object with Blowfish.
Once encrypted, the XML will be added to the order submission form that is sent to VPG via an HTTPS Form Post.
Take note, this is a lengthy batch process and runs as scheduled tasks between VFS and the bank.
It should never be relied upon to be returned quickly or included in a synchronous user–journey with the customer.
See 4.2 Appendix B: Encryption Algorithms.