Verification Of Payee rulebook digest: what to pay attention to

On October 10, 2024, the European Payments Council published its highly anticipated Verification Of Payee (VOP) rulebook.

The European payment industry especially anticipated this rulebook because starting October 5, 2025, all European PSPs providing SEPA payments will have to provide the verification of payee service to their users—less than a year from now, and pretty much starting from scratch.

In this blog, based on the VOP rulebook, we explore how the scheme will work, who can participate in it, and what the main complexities will be for PSPs to adhere to it—or their solution providers to help them adhere.

A reminder on verification of payee regulatory requirements

Verification of payee is a concept introduced in the Instant Payments Regulation adopted by the European Parliament in March 2024.

Verification of payee is the process by which a payer can confirm the name of a payee before sending a payment to a specific account number, or IBAN.

It aims to reduce some forms of payment fraud, in which fraudsters trick payers into sending payments to the wrong account numbers.

Per the Instant Payments Regulation, starting October 5, 2025, all European PSPs providing SEPA payments must offer this service to their customers.

Failing to comply with this requirement will result in:

• Obligations to refund the payers for payments for which the payee's verification wasn’t properly provided. The liability can lie with the payer’s or the payee’s PSP, depending on who’s responsible for the failure to comply.

• Penalties to be defined by each Member State by April 9, 2025

To support PSPs comply on time with the regulation and to ensure interoperability between all potential solutions developed to provide verification of payee services, the EPC developed the VOP scheme and its associated rulebook.

“The EPC Verification Of Payee (VOP) Scheme (“Scheme”) is a set of rules, practices and standards to achieve interoperability for the provision and operation of verifying Payment Account Numbers and Names of the Payment Counterparties, between Participants of the Scheme prior to initiating a Payment Account-based Payment within SEPA”

Verification Of Payee scheme model

VOP will involve the following actors:

The Requester

The request is the payer. It can be a natural or a legal person.

The Payment Counterparty

The Payment Counterparty is the payee. It can be a natural or a legal person.

The Requesting PSP

The Requesting PSP is the PSP of the payer, or Requester, who will have to send a VOP request and provide the result to its Requester.

The Responding PSP

The Responding PSP is the PSP of the payee, or Payment Counterparty, that will have to respond to VOP requests.

The EPC Directory Service (EDS)

The EPC Directory Service is a central directory that will store all the required data for Requesting PSPs to send VOP requests to Responding PSPs. On a high level, the EDS will provide the right URL to call to send a VOP request for a given IBAN.

Routing and/or Verification Mechanisms (RVMs)

RVMs are solutions that Requesting PSPs can use to send VOP requests on their behalf or that Responding PSPs can use to receive and respond to VOP requests.

RVMs aren’t mandatory, and Requesting and Responding PSPs can choose to send, receive and respond to VOP requests by themselves.

RVMs can be provided by any type of entity, such as independent software vendors, existing providers of SEPA payment infrastructure, PSPs themselves, or any other entity.

Verification Of Payee scheme participation

Only Requesting PSPs and Responding PSPs are scheme participants.

Scheme participants can be credit institutions, central banks and payment and electronic money institutions.

Participation in the EPC Verification Of Payee scheme isn’t mandatory per the Instant Payments Regulation.

Theoretically, any PSP can choose another way to respond to the IPR requirements, and all other PSPs should connect with said PSP by other means than the VOP scheme to comply with the IPR requirements.

Realistically we don’t anticipate any PSP or group of PSPs doing so in a completely isolated way. We strongly believe any group of PSP choosing another way to comply with the verification of payee requirements would make it interoperable with the VOP scheme.

Verification Of Payee scheme technical details

The following diagram from the EPC rulebook shows the flows involved in VOP requests. 

In this section, we will highlight specific attention points from the rulebook.

Verification Of Payee messages attributes

In its “happy flow”, VOP will involve 4 main messages exchanged between the Requester, the Requesting PSP and the Responding PSP.

The table below presents the attributes that the rulebook requires for each message. 

The precise format and accepted values for each attribute will be defined in an upcoming “Verification Of Payee (VOP) Scheme Inter-PSP Application Programming Interface (API) Specifications” document.

Verification of Payee requests on names vs identifier codes

The VOP rulebook supports VOP requests on two types of account holders or Payment Counterparties per the rulebook:

• Natural persons

• Legal entities: companies, administrations, etc.

For natural persons, the Requester simply provides its Requesting PSP with a Payment Counterparty Name and IBAN.

For a legal entity, the Requester can provide a name or an Identifier code (VAT number, SIREN, SIRET, other LEI).

It leads to two types of possible VOP requests with different attributes:

Name-based request:

• Payment Counterparty Name

• Payment Counterparty IBAN

Identifier-based request:

• Payment Counterparty IBAN

• Payment Counterparty Identifier Code

In the case of Identifier-based request, the IBAN comes first in the dataset because the scheme enables checking what Identifier Code can be used for a given IBAN before sending the VOP request.

To do so, Responding PSPs can register in the EDS the type of Identifier Codes they support, and Requesting PSPs can check a local version of the EDS to inform their Requesters of the type of data they need to fill.

Verification of Payee responses

The scheme supports the following responses, depending on the type of request:

Calculating the Verification of Payee responses: the Matching Process

The VOP rulebook doesn't mandate any algorithm or methodology for the Responding PSPs to decide how to respond to a VOP request.

It is up to the Responding PSP to decide how to respond to ensure:

• They comply with the IPR requirements and aren’t subject to fines or penalties

• They prevent abusive use of VOP by Requesters to collect data such as Payment Counterparty Names, by having too lax Close Match responses, for instance

However, to support the industry in complying on time with the regulation, prevent too many false No Matches and harmonise VOP responses between PSPs, the EPC has published its Recommendations for the Matching Processes under the VOP Scheme Rulebook.

The document provides recommendations for the cleaning and formatting of Payment Counterparty Name data.

It also details what scenarios may be considered Close Matches, for instance:

• Two letters in the Payment Counterparty Name are inverted

• A letter is replaced by another with the same phonetics

• Typos do not exceed a certain level, as calculated by industry-standard algorithms such as the Levenshtein distance. However, it is up to the PSPs to choose the algorithm and set the level.

It provides useful precisions on what can be used as names for legal entities, such as:

• Legal names

• Commercial names

• Commonly accepted abbreviations (such as AWS for Amazon Web Services)

It will be up to each Responding PSP to define what are acceptable names for legal entities and collect and verify them.

Timing of a Verification Of Payee response

The rulebook defines a 5-second limit to answer a Verification Of Payee request and precises that a VOP request should preferably be executed in 1 second or less.

This timing starts when the Requesting PSP has verified that the information provided by the Requester is correct, especially that the IBAN structure is correct.

The timing stops when the Requesting PSP receives the VOP response from the Responding PSP.

If the Requesting PSP doesn’t receive a VOP response within 5 seconds, it should give the “Verification check not possible” responsible to the Requester.

Processing bulk Verification of Payee requests

The VOP scheme doesn’t support bulk VOP requests. Any VOP request exchanged between PSPs should be individual.

It means that PSPs that want to allow their users to submit bulk VOP requests must debatch them before sending them to each Responding PSP.

PSPs addressing corporate customers and offering them batch payment capabilities will most likely have to support this flow in order not to completely break their customers' batch payment flows.

Note that corporates can opt out of VOP, but PSPs are still required to be able to offer VOP for corporates.

Next steps: getting ready for Verification Of Payee

This rulebook was much anticipated by the industry, as it provides responses for or confirmations of critical elements required for the development of compliant and interoperable VOP solutions.

We are still waiting for key documents from the EPC, that will give the industry a comprehensive picture of the VOP technical implementation:

The VOP Scheme Inter-PSP API Specifications, expected in October 2024, will ensure all Responding PSPs APIs follow the same structure and behaviour, ensuring any Requesting PSP can send requests to any Responding PSP with the same solution.

The EDS specifications or requirements document, which is still to be announced, will describe how PSPs will have to populate and request the EDS to ensure proper routing of VOP requests.

In any case, at Numeral, we are finalising the development of our VOP solution in full compliance with the rulebook to ensure our customers are ready well ahead of time for the IPR requirements.

Numeral already enables customers to verify counterparty accounts, including account holder names, account status and legal entity identifiers, at any time.

Do not hesitate to contact us to get ready for Verification Of Payee or solve your account verifications needs today.