Process SEPA payments securely - Verification of Payee (VoP)

Process SEPA payments securely - Verification of Payee (VoP) / EU Regulation 2024/886

Overview:

New legal requirement from 09.10.2025
Recipient verification for SEPA credit transfers
Adjustments to payment processes necessary.

From October 9, 2025, a new EU regulation will come into force that will fundamentally change SEPA payment transactions within Europe: Recipient verification for SEPA credit transfers - also known as Verification of Payee (VoP) - will become mandatory.

All banks in the euro payments area are then legally obliged to check whether the specified recipient name matches the account holder stored in the IBAN before releasing a payment. The aim of this measure is to reduce fraud in payment transactions and increase payment security.

Background

Verification of Payee (VoP) is part of a new EU Regulation 2024/886, which stipulates that all banks within the Euro Payments Area (SEPA) to check whether the recipient's name matches the IBAN entered (recipient verification) before releasing a transfer. For you, this means more protection against fraud and less risk when making transfers. The general technical infrastructure for the recipient verification (VoP) will be launched on October 5four days before the legal obligation (October 09).

From this cut-off date, recipient verification will be possible. The VoP obligation affects everyone who sends or receives SEPA credit transfers, regardless of the software used or the transmission channel. In practice, the recipient verification is automated immediately after the payment is submitted. Within a few seconds, the payer receives feedback and decides whether the payment should be approved or canceled.

When maintaining customer and supplier master data in the run-up to VoP, it should be noted that a discrepancy between the recipient name and IBAN can have consequences under liability law!

Explanation of terms

You may encounter the following technical terms in connection with VoP in software applications and, for example, in your online banking.

Overview of the relevant terms:

Verification results by the bank (matches):

The bank carries out VoP, or recipient verification, after a payment has been submitted. The result follows a traffic light system with the results:

Match: green traffic light
With deviations (close match): yellow traffic light (with return of the correct recipient name)
No match: red traffic light (without returning the correct recipient name)

After receiving the result, you can decide on the basis of this whether you want to approve or cancel the payment. The banks themselves decide how strict they are with close-match and no-match.

Note:

Some banks have already stated that they want to keep the number of no-matches as low as possible by going beyond these rules.

Such an additional rule could be, for example, that in the case of a joint account, the indication of one of the owner names is already considered a match, or in the case of a company, individual name components of the company name already lead to a close match. In the case of close matches, the correct account holder name is also returned to the payment trigger. The user can therefore quickly check whether the discrepancy is due to mistyping or an abbreviation, for example, and whether it is likely that it is still the desired payee. In the case of a no-match, on the other hand, the bank does not return a name. In this case, a check is ultimately only possible via contact with the payee.

Liability:

The bank is liable for the accuracy of the recipient verification and the resulting consequences in the event of fraud. If payments are released even though there is no match, the liability in the event of an incorrect transfer remains with the client as before. This means that the liability risk does not change in this case.

For collective transfers, the legislator has created the option of bypassing the check. The payments are then sent using the so-called opt-out procedure.

For you this means

The following adjustments to the payment processes are necessary

Master data maintenance is important! In order to use the correct name (account holder name) for SEPA transfers, you can do the following in preparation:

Checking and maintaining supplier master data:
The names of your payees must be identical to their account holder names.
Check your company name when invoicing:
Ideally, your account holder name should correspond to the company name (for all your accounts, even with different banks).

Tip:

Add a note to your invoice template indicating the exact recipient name your customers should use for bank transfers.
Clarify internal processes. What follow-up processes do you have in the event of a close match or no-match?
Use a "Commercial Name":
In accordance with EU regulations, a "commercial name" can also be used for recipient verification in addition to the official company name.
Recommendations for the choice of a "Commercial Name", a trade name or an alias:
- Use a name that is common for your business transactions and known to your customers or business partners.
- Make sure that the name clearly describes your company.
- Take into account a possible character limit (e.g. 27 characters for paper remittance slips).
- Please note that the specific use and verification of a "Commercial Name", trade name or alias depends on the regulations of the respective bank or banking group.

Regulations on collective transfers

Recipient verification is an additional step in the payment process. In addition, its introduction amounts to a cut-off date change, the effects of which can be anticipated but cannot be tested extensively in advance. The legislator has therefore created the option of bypassing the check, at least for collective transfers. The payments are then sent in what is known as an opt-out. This can help to keep certain processes stable and efficient, but means that a potential security feature is not used. Each user must weigh up and decide for themselves.

If recipient verification is required for larger collective payments (opt-in), waiting times should also be taken into account. Although the banks are obliged to provide the verification result within a few seconds, it may still take a little longer for an order with 100 payments. This time should be planned for from the outset. If the speed of the process is more important to you, the opt-out described above is an option.

Note:
A collective payment that contains matches, close matches and no-matches cannot be partially released.

Necessary process adjustments for booking and invoice-controlled payment processes

Regardless of the check result, adjustments to the process are made simply by carrying out the VoP check. For booking and invoice-controlled payment processes, it is recommended to pay a little more attention to ensuring that the name entered is correct when creating a payee. However, the correct IBAN is still more important. The process steps for carrying out credit-side postings and generating payment proposals remain the same.

However, some arrangements should be made in advance for payment transmissions using EBICS or PIN/TAN procedures: For example, it must always be clarified whether collective payments are to be transmitted via opt-in or opt-out. It must also be agreed how to deal with close matches or no-matches that occur during the VoP check. This is all the more important for collective payments that are submitted in opt-in and where individual items do not reach a match.

It becomes somewhat more complicated if a company has defined a four-eyes approval for certain payments and this then takes place (for example with an optional opt-in submission) with a VoP check. First, the payment is transmitted to the bank as an opt-in in the EBICS procedure. All authorized signatories can then call up the so-called VeU list (for distributed electronic signature) and sign the payment. As soon as the required signatures have been received, the bank executes the payment.

Prepare your own customers too

The considerations listed here in the payment process naturally also affect your own customers. If you want to prevent them from canceling their payments due to a no-match, you should do everything you can in advance to ensure that they are provided with the correct recipient name. By analyzing the payee details in your own incoming payments, potential problems can be discovered and eliminated preventively. Customers who notice deviations from the name stored at the bank should be actively reminded of the payee name to be used.

In general, it also makes sense to adapt the invoice template to include a concise note on the correct payee name. If many customers use the same different name, a corresponding alias can also be requested from the bank. This is then evaluated as a match in the same way as the actual name. However, not all banks will support the filing of such an alias, or they will link it to a case-by-case decision.

Additional information on Verification of Payee (VoP)

Foreign transfers, i.e. transfers in foreign currencies or outside the SEPA area, are not affected by VoP.
SEPA direct debits are also not affected by VoP.
Banks are obliged to offer oP free of charge.
The VoP check should be carried out within a few seconds. For collective payments with a high number of payment records, the VoP check can also take several minutes.

If you have any questions or require further information on this topic, please do not hesitate to contact us on 02204 9508- 100.

For reasons of readability, the generic masculine is generally used in this publication. The form of language used refers to all people, is used exclusively for editorial reasons and is value-neutral.

Sources:

Federal Ministry of Finance
Federal Financial Supervisory Authority (BaFIN)

Peter Lohmüller

Website | + posts

Process SEPA payments securely - Verification of Payee (VoP)