Verification of Payee in Europe: An overview  

As a sure sign that summer is near, the European Banking Authority (EBA) has recently introduced new regulatory technical standards for fraud prevention and the verification of payee -  as part of the Payment Services Directive (both PSD2 and 3). These standards are ultimately aimed at enhancing the security of digital payments within the European Union, to combat more intensive and innovative attempts at fraud and to increase trust among consumers to accelerate payments digitalisation.  

In reality, this means that PSPs will be required to verify the identity of a payee during the initiation of a payment, including confirming payee details in real-time before executing a SEPA Instant or SCT transaction.  

Following the success in the UK for the similarly named COP (Confirmation of Payee), we were thrilled to discover during the recent EBA Day conference in Lisbon that VOP was the Belle of the Ball in terms of topic for discussions. This was closely followed by the latest publication of the Functional Description for EBA Clearing’s FPAD solution (Fraud Pattern and Anomaly Detection), adding fuel to the fire.  

The challenge we encountered through our engagement with key players across the European market was that the tone of discussions contained a pattern of scepticism and confusion. Holistically, it was obvious that market players struggled to understand the impact of the new regulation and which of the potential models would be optimal to address their individual requirements – something we hope to shed some light on in this article.  

In order to align with EPC’s (European Payment Council) regulation, EBA Clearing has created a plan for how FPAD could provide a solution, by creating a long-term plan for becoming the primary RVM (routing & verification mechanism) for the region.   

This in turn means that PSP’s will ultimately have to make a choice from a range of no less than seven options for how they choose to utilise FPAD; three for how they’re going to act as the Requesting PSP and four when acting as the Responding PSP.   

Finally, there will be an additional service available (estimated for October 2025) where FPAD will route requests based on the EPC EDS (Directory Service). This is likely to be the ‘key’ to true reachability across the region but we’ve yet to see any firm plans for what this service will entail.   

Across the industry, we can see consensus in the necessity to combat fraud, however given the diverse views on the new requirements (and how to meet them). There’s already a fatigue in yet another regulation and some low-level hesitation was detected from participants who considered not aligning with new regulation in the belief that it would be cheaper to absorb the risk of fraud versus paying for the additional services.   

Slightly more practical (yet fundamental), it appears there’s still confusion around how clients will be expected to connect into the new VOP service.    

Currently there’s an API consultation being undertaken to enable API’s directly into EBA Clearing, however our understanding is that there’s no certainty this service will be available before October 2025, when the first tranche of clients will be mandated to take up the VOP service. If these (or others) want to ensure connectivity and the necessary time ahead of launch to test the service, they would need to choose a different option to connect through.  

This is where it gets complex as other options for connectivity include utilising a small number of existing connectivity providers chosen by the EBA to provide access into the schemes. However, from discussion it seems that these are not yet ready to support this function, nor indicate a price for their future services.  

A further impact to the ultimate success of the service is the expected volumes and how often clients will actually make requests to the FPAD engine.  

As the regulation currently stands, it’s intended to be utilised ahead of each payment being executed – this presents the financial institutions with the challenge of adding significant cost into every transaction, as a result of this clients have indicated that one solution to address to the cost implications of scoring every payment by the EBA is that they will likely ‘save’ (i.e. risk accept) previous responses for a period of time (be it days, weeks, months or even permanently).  

The reasons for doing this is generally twofold: 

Firstly, it’s a time saver. The additional step of performing a FPAD request and analyse the returned response is going to add time in an already compressed payment process that is expected to complete within seconds.  

Secondly, it comes down to cost. In a competitive market, financial institutions have for a long time now been in a race to the bottom with pricing getting forever more compressed in order to remain competitive for their end customers, this even before they can focus on winning new ones.   

The VOP adds another cost factor to a pre-agreed pricing, especially as the regulation also stipulates that in many scenarios it cannot be charged for, and so forcing the institution to absorb the cost.   

By aligning with the new EBA regulations and implementing the FPAD/VOP service, PSPs can significantly enhance the security of electronic payments, combat fraud, and build greater trust among consumers. Despite the initial confusion and cost concerns, the long-term benefits of a robust VOP system are likely to outweigh the challenges, leading to a more secure and efficient payment landscape.   

But the road leading up to this will be rocky and and whilst we understand the ‘why’, a number of questions remains around ‘how’ and ‘when’.  

 Form3 will continue to lead the discussion in relation to this important topic and return with more insight as and when the industry develop further. Form3 will continue to strive for a fully integrated solution, working optimally for our customers and provide simplicity, resiliency and to protect the latency of the payment execution