Verification of Payee has been live for one year. It was designed to make instant payments safer. The first year suggests it works, but not evenly.
Since 9 October 2025, banks in the euro area have had to offer the service before authorising a euro credit transfer, whether standard or instant, and offer it free of charge to the payer. At the same time, banks became required to send instant euro credit transfers, as set out in the Instant Payments Regulation.
The European Banking Authority used the Payments Tomorrow conference in Paris on 15 October 2026 to describe the rollout as broadly successful, while noting that remaining teething problems are still being resolved. The broader picture is less settled: total payment fraud in the EU rose from €3.5 billion in 2023 to €4.2 billion in 2024, and the EBA expects its next report to show higher levels for 2025.
For instant payments specifically, fraud volumes rose 175% over the three years covered by the joint EBA and ECB report on payment fraud, against 98% growth in transaction volumes. That gap helps explain why Verification of Payee matters. It is also why the regulation is better understood as a redesign of payment operations than as a simple speed upgrade.
Speed changed the operating model
Instant payments make funds available within ten seconds. That requirement removes the buffers that conventional payment operations relied on: overnight batch processing, delayed reconciliation and next-day exception handling.
Readiness therefore means more than sending a payment quickly. Providers need 24/7/365 operations without downtime, fraud and compliance checks inside the ten-second window, Verification of Payee and real-time fraud monitoring.
The Instant Payments Regulation also changed sanctions screening. Instead of screening each transaction, payment service providers must screen their customer base at least daily. That is a structural change: compliance work moves from a per-payment event to a continuous operational process.
VoP works, but not evenly
Verification of Payee checks whether the beneficiary name matches the account identifier held by the receiving institution. The possible outcomes are “match”, “close match”, “no match” or “other”.
A “no match” does not block the payment. If the payer proceeds after receiving the warning, liability shifts. That makes VoP a decision-support mechanism rather than an automatic fraud filter.
For consumers, the check is straightforward. For corporates, it is more complicated. The European Central Bank said in its March 2026 payments strategy that VoP implementation in companies’ ERP systems is lagging and that banks advise firms to opt out because of potential disruption to high-volume, automated batch processes.
A single “no match” or “close match” can hold up an entire batch and require manual intervention. Opt-out is available only to non-consumers submitting more than one payment in a batch.
Deutsche Bank’s own client data illustrates the scale of the issue. In January 2026, 80% of SEPA credit transfer files and 67% of SEPA Instant files submitted through its EBICS channel were opt-outs. That is Deutsche Bank client data, not a market-wide measure, but it shows why corporates remain cautious. For background on the corporate channel, see our explainer EBICS vs. PSD2.
The cost is unevenly distributed
The compliance burden is also uneven. In a Celent survey commissioned by ClearBank, covering more than 100 institutions across 10 European markets, 61% of banks expected to spend more than €20 million on compliance, combining capital and annualised operating costs. 23% of banks expected spending of €50 million to €100 million.
Most payment institutions and e-money institutions expected to spend less than €10 million. Many of them can rely on a partner bank or third-party provider instead of building direct scheme access themselves.
That difference reflects different starting points. Banks often carry legacy core systems, broad customer bases and direct scheme participation. Smaller fintechs can buy infrastructure instead of building it. Outsourcing can reduce build complexity, but it does not remove the customer’s expectation of reliability.
The fintech deadline is still ahead
Most coverage treats October 2025 as the finish line. For much of the fintech sector, it was not. Payment institutions and e-money institutions in the euro area only have to send and receive instant euro transfers from 9 April 2027. Non-euro-area providers follow from 9 July 2027, when Verification of Payee also becomes mandatory for them.
The readiness gap is already visible. In the same Celent survey, one in five EMIs and PIs expected to miss the July 2027 deadline by three to six months.
Outsourcing is a sensible build decision, but responsibility stays with the fintech. If a VoP check times out at 3 a.m., the customer blames the app, not the partner bank. Founders should be asking providers about uptime commitments, VoP response times and incident runbooks before 2027, not after.
What this means for builders
- Treat VoP as a workflow problem. Consumer journeys need clear match and no-match handling. Corporate products need batch-level controls, exception queues and ERP integration.
- Design for the ten-second window. Fraud checks, sanctions screening and account verification must operate inside the payment flow, not after it.
- Make operational resilience contractual. Fintechs relying on partner banks should require measurable uptime, incident-response commitments and transparent escalation paths.
- Prepare for broader VoP coverage. The EBA expects PSD3 and PSR to extend VoP to credit transfers in all EU currencies, with publication in the Official Journal expected in December 2026 or January 2027.
What to watch
Adoption is moving. SCT Inst accounted for close to 35.6% of total euro credit-transfer volume in Q1 2026, according to the European Payments Council’s June 2026 status update for the Euro Retail Payments Board.
The scheme layer is also changing. The EPC’s VoP rulebook version 1.1 has been effective since 20 September 2026. Version 2.0 is envisaged for the end of November 2026 and includes a proposal for a definitive inquiry and compensation process.
From 15 November 2026, unstructured addresses will no longer be allowed in EPC payment messages and will be rejected. That is a small technical change with a practical consequence: payment-data quality is becoming part of payment reliability.
Europe has solved the first part of the instant-payments problem: banks must offer the service, and consumers receive a fraud warning before they pay. The harder part is operational: keeping verification, fraud controls and batch payments reliable at scale. The 2027 fintech deadline will show which providers can do that.
This article was researched and written with AI assistance for FinTech Weekly. All facts are linked to their sources in the text.
