Source: Finance Derivative
Pratiksha Pathak, Head of Payments Services at RedCompass Labs, shares her insights on the Verification of Payee’s (VoP) impact and what it means for European payment service provers (PSPs).
Fraud is an ever-present threat in the payments landscape, and with the rise of instant payments, the risk has never been greater. While these rapid transactions offer unmatched convenience, they also pave the way for instant fraud, leaving financial institutions with minimal time to intercept suspicious activity.
In October, the European Payments Council (EPC) published the long-awaited Verification of Payee rulebook, which marked a major milestone in the SEPA Instant Payment Regulations (IPR) and a key effort to combat payments fraud.
In 2022 alone, fraudulent credit transfers, direct debits, card payments, cash withdrawals, and e-money transactions across the EEA reached a staggering €4.3 billion, with an additional €2.0 billion lost in just the first half of 2023.
The VoP rulebook aims to standardise how banks confirm payee account details, protecting consumers from fraudulent transactions. However, while the intentions are solid, the new regulations present several challenges that banks must address swiftly and efficiently.
- Tight deadlines leave no room for error
The deadlines are tight. Banks must have a VoP solution in place across all payment channels by 5th October 2025, which is just four days before the IPR comes into effect. Unfortunately, it doesn’t matter if a bank uses an existing domestic verification service since the rulebook standardises how account information is verified in payments across Europe.
This means that every bank will need to adapt or overhaul its systems to meet pan-European standards. Given the verification process will apply to both SEPA and SEPA Instant payments across all payment channels, it will be a big lift for banks.
The challenges are compounded by the rollout of the EPC Directory Service (EDS), which is the centralised database that underpins the scheme. The EDS won’t be ready for testing until late June 2025. This leaves only three months for banks to complete end-to-end testing and fully deploy their solutions.
Some aspects of VoP, such as APIs and channel infrastructure, can be built in advance, but banks won’t be able to conduct end-to-end testing until after the EDS is ready. For institutions grappling with legacy systems or more complex architectures, the timeline is daunting and leaves little to no room for error.
- The 5-second rule is a small change with a big impact
Another key change is the extended verification window. Banks now have five seconds, rather than three, to confirm payee account details across all channels.
Whilst this may seem generous, it is still a tight squeeze given the intricacies involved. This means that both the payment engine and all customer-facing channels—whether online, mobile, phone, or paper-based—must be highly available, fast, and scalable.
Ensuring a smooth customer experience, especially for non-digital transactions, will test banks’ technological limits. While mobile and online platforms might be better equipped, accommodating phone and bulk transactions introduces layers of complexity.
It may be more time than before, but the five-second verification window leaves little margin for error – never mind the one-second timeframe the EPC would prefer.
- Bulk payments are a logistical headache
One of the most complex aspects is VoP’s application to bulk-payment files, such as salary payouts. The rulebook demands that each individual payment in a file undergo verification, potentially creating a logistical nightmare.
Imagine a scenario where thousands of payments trigger a mix of ‘match’, ‘close match’, and ‘no match’ results. As a bank, how do you relay this information to your client within 5 seconds? Do you provide the notifications in a file? Through an app? A checklist?
Handling a flood of verification requests within seconds requires not only a robust infrastructure but also meticulous planning. Banks must devise sophisticated mechanisms to process and deliver results without disrupting the broader payment workflow to prevent operational chaos.
- Legacy systems will feel the pain
For many banks, the biggest challenge lies in integrating VoP into long-established SEPA payment systems because it requires modifications to processes that are already running smoothly.
Banks need to ensure that all their payment channels can incorporate VoP functionality without disrupting the current flow. Banks may need to upgrade or completely rework several parts, making the process complicated and costly.
Verifying payees at the beginning of a transaction requires changes to how these systems interact and handle data. Banks will also need to ensure that existing transactions continue without delays and errors, which will prove to be a big challenge for those with multiple existing payment channels.
- Navigating routing and verification is complex
The new EPC/European Directory Service (EDS) may bring operational challenges. Whilst the EDS serves as a directory, it doesn’t handle the actual routing or verification of VoP requests and responses. Most banks now need to develop their own routing and verification mechanisms (RVMs).
These RVMs will act as connection points for participants and banks must either integrate directly with the EDS or use an RVM to route VoP requests. However, using an RVM doesn’t absolve the responding PSP of its responsibilities under the scheme’s rules.
Banks face a significant challenge in setting up or partnering with an RVM to manage this new process, but finding an RVM supplier will be a good place to start.
The bottom line
The EPC’s VoP rulebook is a decisive step forward in improving payment security across Europe, but it also introduces significant challenges for banks.
As banks start to prepare for this overhaul, balancing compliance with operational efficiency will be key to protecting customers whilst maintaining a seamless payment experience.
European banks have their work cut out for them. The demands of implementing VoP are high, and the timeline is short. But with the right expertise and strategic planning, it can be done.