In this article, Matthieu Perret, Head of Fraud Prevention Solutions for Cash Management at BNP Paribas, shares some practical information about Verification of Payee (VoP), which has assumed a central role in ensuring payment flows are secure.
What exactly is Verification of Payee, and how does it work?
Matthieu Perret, BNP: VoP is a new regulatory requirement imposed on banks and payment service providers (PSPs) / payment initiation service providers (PISPs) as part of the instant payments regulation. It’s an account-holder verification service that checks whether the IBAN and the name of the account holder are consistent. The response can take several forms: Match, Close match, No match or No result.
A bank must offer this verification service for all SEPA credit transfers – not just SEPA instant credit transfers – before a payment can be confirmed. SEPA direct debits and non-SEPA credit transfers don’t fall within the scope of the regulation.
In addition, the service can also verify a specific identifier (such as a corporate identification number). This identifier remains optional: the beneficiary bank must be able to verify it, but not all banks offer this type of check yet. At this stage, coverage for VoP schemes based on optional identifiers remains low.
The deadline for VoP to be implemented in euro area countries was 9 October 2025, while EU countries outside the euro area must comply by July 2027.
What has changed in practice since VoP went live?
For payment remittance via e-banking channels, there has been no major technical impact: the bank returns a match or a close match, which may require the client to update its customer or supplier master data. The question is what should treasurers do when the bank returns a no match response: should they proceed with the payment anyway?
On host-to-host channels, VoP can be used in batch payment files. French banks have opted for a default opt-out model: to benefit from the service, the company must activate it in its treasury management system or via a dedicated flag in the API code. The response to this VoP request is sent back via host-to-host channels in the form of a payment status report (PSR / CAMT / PAIN 002).
This means that corporates need to be able to receive, read and process these payment status reports correctly. They also need to check whether their treasury management system already supports these messages and knows how to use them.
How can companies ensure that VoP works properly for incoming payments?
One of the most important issues for incoming payments is how clearly the company can be identified by its partners. Counterparties need to know the beneficiary’s legal and trading names well enough to route and reconcile payment flows correctly.
Certain situations are currently causing problems. For example:
- if PSPs are collecting payments on behalf of merchants and the account belongs to the PSP, the information does not match, even though the transaction is legitimate
- factoring, when VoP works well when one of the company’s own accounts is pledged to the factor. But when the factor opens an account in its own name to collect funds on behalf of the client, VoP does not match and counterparties turn to the company to validate the account
- COBO-type (collections-on-behalf-of) structures, where the client does not know the centralizing account, which makes verification more complex
- virtual IBANs (VBANs), for which the reference remains the underlying physical account.
Connecting so many PSPs in such a short timeframe sounds like a major challenge: did everything work when VoP went live?
Connecting 3,000 PSPs across Europe in less than 18 months represented a major challenge, but the payment industry managed to get it done.
The first figures show a match rate of around 66%, and highly variable close match rates depending on banking communities and customer segments (large corporates vs. retail clients). A close match is, however, a transitional situation. Everyone involved needs time to update their databases.
Also, there may be various reasons that verification is not possible: accounts may be out of scope, banks may be temporarily unavailable due to incidents or outages, and some banks have not joined the VoP scheme.
In France, the rate of verifications that cannot be performed is below 1%. It is significantly higher in countries such as Austria and Slovenia, whose banking communities have made different implementation choices. The European Payments Council (EPC) is expected to provide further clarifications to support a gradual ramp-up and harmonization of practices.
Beyond the regulatory and technical aspects, what advice would you give treasurers to make the most of VoP?
There are several steps treasurers can take. These include making sure you correctly state the registered legal name and the account holder name on your invoices. The bank checks against the legal name – adding extra elements such as a trading name or brand name does not always make matching easier. For individuals, the first and last name should normally be enough.
You also need to look out for local subtleties: some banks do not accept the addition of the likes of “S.A.”, “Plc” or “GmbH” as a perfect match, while others may reject variants with or without dots (“SA” or “S.A.”).
E-banking channels are essentially now live for VoP. On host-to-host channels, banks are still assessing their capacity to absorb high volumes of transfers and the communication aspects that go with them.
VoP is not mandatory on digitally signed files, but most banks are considering offering the check even in that context. Some are also working on on-demand services that enable clients to verify files in advance so they can correct and amend them before submission.
What comes next, and what challenges remain?
Changes to the rulebook are expected in 2026 to improve the service from the banks’ point of view. A version 2, scheduled for 2027, should provide more detailed guidance on functional use cases.
Dealing with bulk payment files still involves some challenges: as it stands, a bank runs an initial consistency check, then “de-bulks” the file and sends VoP requests line by line to its counterpart, with an obligation to provide a response within five seconds per request. However, a bank generally cannot send more than ten requests per second to the same counterparty, and these need to be processed. You should therefore expect a processing time of a few minutes for a 10,000-line file. For a million-line file, sending it for verification two hours in advance would be wise. The bank will enrich the file with VoP information, and the structure of the original file is preserved.



