PSD2 Payee Verification: What It Means for IBAN Validation

PSD2 payee verification — and its successor frameworks under PSD3 and the EU Instant Payments Regulation — requires payment service providers to confirm that the name a payer provides matches the name registered to the destination IBAN before the payment is executed. This is the most significant change to European payment fraud prevention since SEPA was introduced. This guide explains the regulatory framework, how Confirmation of Payee (CoP) and Verification of Payee (VoP) work technically, the difference between UK and EU implementations, and what IBAN validation has to do with all of it.

The Regulatory Foundation: PSD2 Article 5c and the Instant Payments Regulation

The original Payment Services Directive 2 (PSD2, Directive 2015/2366) did not mandate payee verification. Article 5c was a proposed amendment that was debated but not enacted in the original text. The payment industry moved faster than the regulation.

In the EU, the mandate ultimately came from a different instrument: Regulation (EU) 2024/886, the EU Instant Payments Regulation, which requires all payment service providers offering euro instant credit transfers to implement Verification of Payee (VoP). The timeline:

• January 9, 2025: PSPs in eurozone countries that already offer instant payments must have VoP in production.
• October 9, 2025: All EU PSPs offering euro instant payments must implement VoP, including those in non-eurozone EU member states.
• PSD3 (expected 2026–2027): Will extend payee verification requirements to standard (non-instant) credit transfers and potentially to additional payment types.

In the UK, Confirmation of Payee (CoP) has been live since June 2020, mandated by the Payment Systems Regulator (PSR) under the APP Fraud Strategy.

How Verification of Payee (VoP) Works

VoP is a before-payment check. Before the payer's bank sends the payment instruction, it queries the beneficiary bank with the IBAN and the name the payer provided. The beneficiary bank responds with one of three results:

• Match: The name matches the name registered to the IBAN. The payment proceeds normally.
• Close match: The name is similar but not identical — different abbreviation, reversed name order, or minor spelling variation. The payer is shown the discrepancy and asked to confirm.
• No match: The name does not match. The payer receives a warning. They may still proceed, but liability may shift to them if fraud results.

The technical protocol for VoP in the EU is specified by the European Payments Council (EPC) in the VoP Scheme Rulebook, which uses a REST-based API over the EPC directory infrastructure. PSPs must both respond to VoP queries (as the beneficiary PSP) and initiate them (as the payer PSP).

IBAN Validation Is the Prerequisite for VoP

VoP operates on the assumption that the IBAN is structurally valid. A malformed IBAN — one that fails the MOD-97 check or has the wrong length — cannot be routed to a beneficiary bank for a name lookup. The VoP query will fail before it reaches the bank's systems.

This means IBAN validation is step zero in any VoP-compliant workflow:

1. Validate the IBAN structurally (format, length, MOD-97). Reject if any check fails. Do not proceed to VoP with an invalid IBAN.
2. Look up the bank from the IBAN (BIC lookup). Confirm the beneficiary bank is reachable on the VoP network. Not all banks in all countries support VoP equally — some may not yet be enrolled.
3. Submit the VoP query with the validated IBAN and the payer-provided name.
4. Present the result to the payer and require explicit confirmation if the result is "close match" or "no match."
5. Log the VoP result with the payment record for audit and liability purposes.

The ibanchecker.cash API handles steps 1 and 2 — structural validation and BIC lookup — which you can perform before initiating the VoP query to avoid wasted API calls and to surface structural errors to the user at the earliest possible point.

Confirmation of Payee (CoP) in the UK

The UK's CoP scheme, operated by Pay.UK, predates the EU VoP mandate by five years. CoP covers Faster Payments and CHAPS transactions. The UK uses sort code and account number (not IBAN) as the primary account identifier, but CoP resolves the name-to-account relationship using the same match/close-match/no-match logic as EU VoP.

Key differences between UK CoP and EU VoP:

• Account identifier: CoP uses sort code + account number; VoP uses IBAN.
• Coverage: CoP applies to Faster Payments and CHAPS; VoP applies to euro instant credit transfers. Neither system covers SWIFT international wires by default.
• Mandate scope: CoP is mandatory for all UK PSPs above a transaction volume threshold; EU VoP is mandatory for all PSPs offering euro instant credit transfers, with a phased timeline.
• Liability: In the UK, if a PSP fails to implement CoP and a customer suffers APP fraud, the PSR can hold the PSP liable. In the EU, similar liability provisions are being developed under PSD3.

UK businesses sending international payments via IBAN to EU beneficiaries will encounter VoP at the EU end of the payment. The UK CoP infrastructure does not interoperate with the EU VoP network — they are separate systems with separate directories.

What Payee Verification Does Not Cover

Both CoP and VoP have meaningful coverage gaps that payment professionals must understand:

• SWIFT international wires: Standard MT103 and pacs.008 messages do not carry a mandatory payee verification step. Name-matching for cross-border SWIFT payments is not standardised and relies on correspondent bank discretion.
• Non-euro SEPA transfers: VoP under the Instant Payments Regulation covers euro instant credit transfers. SEPA transactions in non-euro currencies (CZK, HUF, PLN) are not directly mandated.
• Non-instant transfers: Standard SEPA Credit Transfers (not instant) are not yet covered by the VoP mandate. PSD3 is expected to extend coverage.
• Business account names: Company names and trading names are inconsistent across registries. A close-match response for a company with a slightly different registered name is expected — not a fraud signal by itself.

Compliance Obligations for PSPs

Payment service providers operating in the EU must:

• Implement VoP for euro instant credit transfers within the timelines specified by the Instant Payments Regulation (January 2025 for eurozone PSPs already offering instant payments; October 2025 for all others).
• Enroll in the EPC VoP directory so that beneficiary-side queries from other PSPs can resolve against their account register.
• Inform payers of close-match and no-match results before the payment is initiated. The payer must be able to make an informed decision to proceed or abort.
• Log VoP query results with transaction records. This log is required for audit and for liability determination in fraud cases.
• Update VoP enrollment for acquired customers and new account holders within the timeframe specified in the EPC VoP rulebook.

IBAN Validation and VoP in a Compliant Payment Workflow

The practical workflow for a PSP implementing VoP compliance:

1. Payer enters beneficiary IBAN and name in the payment initiation interface.
2. Call the ibanchecker.cash API at POST /api/v1/validate. Confirm the IBAN is valid and return the bank name to the UI so the payer can visually verify the beneficiary bank.
3. If validation passes, initiate the VoP query to the beneficiary bank using the EPC VoP protocol.
4. Display the match result to the payer. If "no match," display a fraud warning. If "close match," display the name discrepancy and ask the payer to confirm.
5. Record the VoP result, the IBAN validation result, and the payer's confirmation decision with the payment record.
6. If the payment proceeds, submit the payment instruction. If the payer aborts, log the abort with reason.

Last updated: June 2026