Payee verification (VoP): securing instant payments

Contents

A major advance in payment security
VoP creates value...
... but a technical and organizational challenge
Solutions to capitalize on VoP regulations

While instant payments have revolutionized financial transactions, they have also become a prime target for fraud, particularly that targeting credit transfers, such as Authorised Push Payment Fraud(APP Fraud). Faced with the growing sophistication of scams, identity theft and other forged RIBs, the European Union is imposing a new line of defense: Verification of Payee(VoP). Some European countries have already implemented similar systems, such as the UK's Confirmation of Payee in 2020, which has considerably reduced losses from APP fraud. In the Netherlands, the IBAN-Naam Check initiative has improved the reliability of domestic payments by detecting inconsistencies between the IBAN and the beneficiary's name. These experiences demonstrate the effectiveness of the system and serve as a benchmark for European deployment. 

A major step forward in payment security 

Since October 9, 2025, under the new European regulations, payment service providers, including banks, have been obliged to verify the beneficiary. According to the European Payments Council (EPC), more than 4,000 institutions are affected. For SEPA payments, VoP makes it possible to check in real time that the first and last names (or the company name in the case of a legal entity) correspond to the actual holder of the account to which a payment is issued.  

Prior to any transaction, this verification, via a standardized API, must enable : 

- Fight fraud: unmask fraud attempts where a bank account number is provided under a false identity (social engineering, president fraud, fake suppliers). 

- Reduce human error: a simple typing error in the beneficiary's name, in an IBAN for example, can send funds to a third party. VoP alerts the issuer before the transaction is finalized. 

- Reinforcing confidence: by making transactions more secure, verification encourages the adoption of instant transfers as the standard means of payment in Europe. 

4 possible scenarios 

Following this real-time verification, either the match is confirmed and the transaction can proceed. Or the match is partial and minor (for example, with a letter difference or a spelling variation in a name), and the transfer issuer receives an alert, but can still validate the transaction (and, if necessary, correct the wording). If no match is found, the transaction is blocked. And if the check is impossible (for example, if the service is unavailable), the transaction cannot be completed. 

VoP, creating value... 

For payment service providers, this new obligation creates value. Internally, by reducing fraud and automating the process, and externally, by boosting customer confidence in banking services, as well as the quality of service that builds customer loyalty in an increasingly digitized environment. 

... but a technical and organizational challenge 

VoP is a step forward in making payment services more reliable and reducing fraud, but it remains a challenge for payment service providers and banks. Four areas in particular need to be notified:  

- Real-time interoperability: the main challenge is to ensure fluid, ultra-fast communication between the systems of the thousands of PSPs in the SEPA zone, 24 hours a day, 7 days a week. Verification response must be near-instantaneous (less than 5 seconds) to avoid hindering the payment experience and frustrating customers. Payment service providers must therefore implement secure APIs that comply with European standards (API VoP, EBICS, ISO 20022). 

- Close match management: what to do in the event of a partial match? PSPs need to implement sophisticated algorithms to interpret slight discrepancies (typos, abbreviations, compound names) without generating an excessive number of false alerts that would disrupt operations and alter the customer experience. It is therefore useful to know how to handle exceptions and discrepancies (proximity, aliases, complex corporate names). 

- Data harmonization: banks must ensure that the names and corporate names of their customers in their repositories are accurate and standardized. This involves a considerable amount of data cleansing, as well as communication (and education...) with customers to encourage them to take care with the quality of the wording of their transfer beneficiaries. This data qualification comes at a time when banking information systems are largely in need of modernization. A PAC survey reveals that only 29% of financial institutions consider that their information systems fully meet security and regulatory compliance requirements. Financial institutions also need to be able to manage huge volumes and flows of data to ensure compliance. 

- Customer experience: it's vital to integrate verification intuitively into customer journeys (mobile applications, banking websites) to guide the payer in the event of an alert, without complicating the payment process. Indeed, the new obligation is not only a change for payment institutions, but also for their customers, who are very sensitive to even the slightest deterioration in service quality. 

Solutions to capitalize on VoP regulations 

To address these complexities, specialized solutions like WeVoP, developed by Elcimai in partnership with AP Solution IO, are key. 

These platforms offer a complete Mandate Routing and Verification (MRV) solution that relieves payment service providers of a large part of the implementation burden, with several advantages: 

- Single connectivity: they act as a single access point, managing the complexity of routing to all other PSPs in the SEPA zone and beyond. 

- Managing massive volumes of data, especially for instant payments. 

- Reliability and speed: thanks to high-performance APIs and robust infrastructures, they ensure real-time responses, respecting the latency requirements imposed by the regulations. 

- Reporting and monitoring tools to ensure regulatory compliance. Compliance dashboards make it possible to audit, trace and document all verifications carried out, in response to regulators' controls. 

- Maintaining regulatory complianceIn a constantly evolving environment, we can adapt to future changes in the European framework without having to overhaul our systems. 

By relying on these solutions, PSPs can effectively ensure regulatory compliance without overloading their own internal IT systems.  

And transform VoP into a lever for performance and lasting confidence!