Verification of PayeeEnhancing your payment security

Consider this scenario: your company transfers £50,000 to a vendor but the payment goes to another party because the bank details were fraudulent. These scenarios happen daily and cost individuals and businesses billions annually.

Global markets are changing quickly due to regulatory and technological advancements affecting international payments. As the landscape of international payments evolves, the need for robust verification mechanisms is greater than ever.

In the UK

In 2019, Pay.UK launched the Confirmation of Payee (CoP) scheme to combat Authorised Push Payment (APP) fraud and add an extra layer of protection to payments.

The UK has traditionally adopted an open stance on data sharing, and credit data such as Current Account Information Sharing (CAIS) and Current Account Turnover (CATO) have long been accessible and utilised in Experian’s Bank Wizard Absolute and Bank Account Verification services.

However, this openness is not mirrored in other countries, limiting the broader market’s capacity to offer comprehensive bank account verification globally.

Increasing cross-border payments and EU regulatory pressure

Due to the expansion of the global marketplace, there is noticeable growth in the number of cross-border payments being seen year on year.

The Bank of England projects that the number of cross-border payments will reach £850 billion by 2026. FXC Intelligence forecasts the non-wholesale cross-border payments market to reach $64.5 trillion by 2032, a 62% increase from 2024, with a compound annual growth rate (CAGR) of 6.2%.

Factors influencing this includes:

• Globalisation of Commerce due to the rise of cross-border trading
• Digital transformation including mobile banking apps and real-time payment systems
• COVID-19 accelerated the shift to digital payments, including cross-border remittances and business transactions. Post-COVID, remote work and digital nomadism have also increased the need for international payroll and contractor payments

With the volume of transactions growing rapidly – increasing the attack surface for fraud – a solution becomes essential not just for fraud prevention but for scaling trust and efficiency in global payments.

Due to this increasing need for digital cross-border payments across Europe, the European Payments Council have introduced the Instant Payment Regulation (IPR).

This new EU regulation aims to address the gap accessibility for instant payments. It also sets common standards so different payment systems stay compatible and secure.

IPR provides more clarity around some consumer protection measures, such as the right to a refund in case of an unauthorised or incorrect payment, and the obligation to inform the payer and the payee of the success or failure of the payment in real-time.

Europe Verification of Payee

The Verification of payee (VoP) scheme was introduced in October 2024 in response to the Instant Payment Regulation (IPR). The VoP scheme mirrors the CoP model by verifying that the payee’s name matches the IBAN before authorising a payment.

Approximately 3,000 European Payment Services Providers (PSPs) must implement VoP by 5 October 2025.

SWIFT, a secure network used to exchange payment instructions, has been selected to deliver the European Payments Council (EPC). EPC helps VoP scheme participants work together, including routing data and verification mechanisms.

How does VoP work?

With the help of SWIFT, European banks and other PSPs will need to act as an inquiring/requesting and responding party:

Key benefits of Verification of Payee (VoP)

Strategic importance

In 2024, global cross-border payment fraud and scams are estimated to cost consumers over $1 trillion, with almost half of global consumers experiencing scam attempts at least once a week. This staggering figure highlights the scale and urgency of fraud in international payments. It underscores the need for systemic fraud prevention mechanisms like VoP, especially as digital and cross-border transactions increase.

The introduction of VoP addresses the growing demand for secure cross-border payments and combats Authorised Push Payment (APP) fraud. VoP must be free for payers and integrated across all payment channels.

Global losses from APP scams could reach $331 billion by 2027. This is due to the increasing volume of digital payments. APP scams exploit the speed and irreversibility of these payments – once money has been sent, it’s often gone.

APP scams involve tricking individuals or businesses into sending money to fraudsters, highlighting the need to verify the recipient’s name before the payment is processed, which helps businesses to save hundreds of billions in losses.

Regulatory landscape and requirements

The VoP proposal was published in March 2024 and mandates that PSP’s operating in eurozone countries must comply with IBAN validation requirements by October 9th, 2025. PSPs in the Single Euro Payments Area (SEPA) are required to comply by July 2027.

The VoP service must be used for all credit transfers – both instant and standard – initiated in Euros, and not just for instant payments. This service must be offered free of charge to the payer.

The introduction of a VoP service for all Euro payments is mandated by Article 5c of the Instant Payments Regulation (IPR). Unlike the UK’s ‘Confirmation of Payee’ or the Netherlands’ ‘IBAN-Name Check’, the EU’s VoP framework aims to establish a unified and more robust standard for payment verification, enhancing fraud prevention and harmonising security measures across member states.

This provision requires PSPs to deploy mechanisms that cross-check the payee’s name with the account holder details held by the recipient’s bank. The goal is to minimise the risk of erroneous or fraudulent transfers and to enhance the trustworthiness of digital payment systems.

Furthermore, in cases of “defectively executed payments,” the regulation introduces a significant shift in liability from the payer to the payer’s PSP, if the PSP fails to provide a VoP service. This change reflects a broader global trend in which liability frameworks for credit transfers are evolving to mirror those long established in the card payments industry.

In circumstances involving “defectively executed credit transfers”, liability will shift from the payer to the payer’s PSP where the PSP has failed to implement the mandated VoP service. This reallocation of liability reflects a broader regulatory convergence toward the allocation principles long established in the card payments domain, thereby reinforcing consumer protection and accountability within the EU payments framework.

Key compliance requirements include:

• Name-matching algorithm: PSPs must implement algorithms to accurately match payee names with account details.
• API integration: Secure API endpoints must be exposed to allow other PSPs to query payee information.
• Liability shift: The regulation shifts liability from the payer to its PSP for defectively executed payments, incentivizing PSPs to adopt VoP.

Name-matching algorithm

Similar to CoP, VoP schemes are expected to provide four potential outcomes:

• Match
• No Match
• Close Match (with name suggestion)
• Other / unable to verify

For outcomes 2-4, the payer’s PSP must alert the account holder that executing the transaction may result in a payment to an incorrect payee. This warning fulfills regulatory obligations and absolves the PSP of liability if the payment is defectively executed.

Occurrences of outcome 4 should be minimised but may be unavoidable in scenarios such as

• The Payee PSP’s VoP endpoint is inaccessible.
• The service provider is unavailable.
• The PSP is not yet reachable.

Like CoP, the scoring will be determined by the responding PSP, so what constitutes a “Close Match” may vary across PSPs. The current understanding of the regulation and EPC Scheme indicates that “match” will predominantly relate to perfect matches, with minimal tolerance.

Implementation challenges

Varied journeys and scenarios

There are a variety of situations in which VoP may need to be integrated:

• Customer onboarding: Verify payee account details during onboarding to prevent fraud and ensure transaction accuracy.
• Subscriptions and loyalty schemes: Ensure subscription payments and loyalty redemptions are directed to the correct account, reducing the risk of misdirected funds.
• Salary payments: Confirm payee account details before processing salary payments to avoid errors and ensure timely payments.
• Refunds: Verify recipient account information before issuing refunds to ensure they reach the intended payee.
• Vendor payments: Validate vendor account details before making payments to prevent fraud and ensure accurate transactions.

Claims or trial periods

VoP checks must be directly linked to a new or amended payment, but this cannot occur in scenarios such as claims or trials where payment isn’t guaranteed. These cases fall outside the permitted use of CoP and VoP.

Alternative solutions, like Experian’s bank account verification solution, should be considered. These services offer comprehensive checks against bank account details, including name, date of birth, and address, confirming matches without requiring a direct payment link.

Interoperability and integration

Interoperability is essential for VoP’s success. The EPC is working on a Scheme Rulebook, API Specifications, and a Directory service to ensure all PSPs are reachable. This unified approach will enable seamless integration across various payment systems and schemes.

Local VoP infrastructures centralise functions like routing requests, enriching data, and supporting international interoperability. Collaboration among local PSPs and appointing infrastructure operators are key to building strong local frameworks.

Standalone PSPs, such as neobanks and fintechs, must adhere to EU regulations by aligning their response capabilities with the EPC scheme. They need to find their own aggregators to connect with other Payee PSPs, ensuring full coverage and compliance.

Liability and availability

The Instant Payment Regulation shifts liability for fraudulent transactions from the payer to their PSP in two instances: when the VoP service is unavailable or when incorrect matches occur.

Effective communication with payers regarding VoP outcomes is crucial for managing liability implications. PSPs must treat VoP as a high-availability service, leveraging technology solutions to ensure resiliency.

Customised messages can guide payers on the appropriate course of action during temporary downtime, ensuring compliance without bypassing regulatory obligations.

Risk and corporate solutions

A strict definition of a match as a perfect match significantly mitigates the risk of false matches. Payee PSPs should provide the payee’s name in instances of a match to further safeguard against incorrect matches.

Larger corporations require sophisticated VoP solutions integrated into their vendor onboarding portals, Enterprise Resource Planning (ERP) systems, or Treasury Management Systems. PSPs can capitalise on this trend by offering white-labeled corporate payment security solutions, enhancing fraud prevention and operational efficiency.