SEPA Instant Payments - New requirements for payment processes and fraud prevention
The EU Regulation on SEPA instant payments will further accelerate and standardise European payment transactions. In future, euro credit transfers will have to generally be processed in real time – within ten seconds and round the clock. At the same time, this means that there will be an increase in the requirements for payment service providers, companies and internal payment processes.
An overview of the material changes
The Instant Payments Regulation entered into force on 8.4.2024 and will be gradually phased in. Since 9.1.2025, financial institutions in the euro area have been obliged to be able to receive real-time credit transfers. With effect from 9.10.2025, the service of sending real-time credit transfers must likewise be offered without additional charges. At the same time, verification of payees for SEPA euro credit transfers and SEPA real-time euro credit transfers will become mandatory.
The key points are:
- SEPA real-time credit transfers - Should be offered wherever banks already enable SEPA credit transfers, such as in online banking, at the counter, or at self-service kiosks. The previous limit for real-time credit transfers of €100,000 no longer applies.
- Status information - Payers receive real-time confirmation as to whether or not the transfer has been successfully completed.
- Individual limits - To minimise fraud and data input errors, it is possible to set individual limits for real-time credit transfers. If a limit is exceeded, then the payment would be immediately declined.
- Verification of payee - Before the payment is authorised, banks in the EEA have to check whether the name of the payee that has been provided matches the account holder of the IBAN that has been provided. For EEA countries using the euro this has applied since 9.10.2025, while for EEA countries using a different national currency this will be applicable from 9.7.2027.
Verification of payee prior to payment authorisation
Verification of a payee happens prior to the authorisation of a SEPA credit transfer or a SEPA real-time credit transfer. Here, the name of the payee that has been provided by the payer is checked against the actual account holder of the payee account. The aim is to reduce erroneous credit transfers as well as cases of fraud. The bank provides an immediate response on this. In particular, this may state that the name provided matches, almost matches or does not match. In cases where the name almost matches, the account name that has been stored for the payee account is normally reported back. Furthermore, it may be reported that no verification of the payee could be carried out because, for example, the account is not a payment account, has been closed, there is a technical issue or the recipient bank does not yet support the service.
Exemptions from a verification of payee
A verification of the payee is not mandatory in the following cases:
- credit transfers outside of the EEA;
- credit transfers in currencies other than the euro;
- SEPA direct debits and SEPA express credit transfers;
- credit transfers to accounts that are not payment accounts, such as, savings accounts or credit accounts;
- credit transfers where the bank pre-fills the payee details, for example, transfers between own accounts, or specific payments to the tax office;
- batch credit transfers, provided that the verification of the payee is waived.
Practical information for payment processes
In future, it will be even more important to carefully check the payee details prior to payment authorisation. Already when recording the credit transfer, the correct payee name should be taken from the invoice. If there is a QR code on the invoice, then this can be used because the payment information is usually stored there. Nevertheless, a plausibility check of the payee data will still be necessary.
In cases where the name almost matches, the account name as reported back by the bank can be taken for the specific credit transfer and an adjustment can be made in the master data for future payments. If the suggested name does not seem plausible, then a double-check should be carried out of the invoice, the spelling and the payee details and the payee should be contacted prior to the authorisation. The same would apply if the check returns a negative result, or if it is not possible to carry out a verification of the payee.
For business customers, it would moreover be advisable to check the existing payment processes and systems. In particular, it is crucial that the e-banking programs that are used are adapted to the new requirements. Furthermore, payees should ensure that the correct account holder is clearly shown on invoices. The use of QR codes can likewise help prevent errors when recording payment details. In addition, for recurring payments, it is likewise possible to check whether SEPA direct debits would be an appropriate alternative.
It also remains the case that basic security rules have to be strictly complied with; links to login pages found in instant messages, or suspicious e-mails should not be used. Payment details (in particular, the amount, payee name and IBAN) need to be carefully checked prior to the authorisation. Authorisation using PushTAN or mTAN should only be used for self-initiated payments. Activation codes and confidential access data may not be passed on to third parties.
