Verification of Payee (VoP) is the check that every payment service provider in the euro area must now run before a payer authorises a SEPA credit transfer: the bank compares the name of the payee with the account holder linked to the IBAN and returns the result before the money leaves. For a business that pays hundreds of suppliers each month, VoP is a useful new safeguard, but it is not a supplier verification process in itself.

Since 9 October 2025, the rule has changed how finance teams create payments, approve bulk files and handle alerts. It has also raised practical questions: what happens with a close match, whether a business should opt out for bulk payments, and who carries the loss when a payment goes to the wrong recipient. This guide explains how VoP works, what it changes for businesses, where its limits lie and how to build a verification process that holds up beyond the bank check.

Verification of Payee is a European obligation created by the Instant Payments Regulation, Regulation (EU) 2024/886, adopted on 13 March 2024. According to the European Central Bank, its Article 5c requires providers to offer the payer a service that verifies the payee before a credit transfer is sent, for both standard and instant transfers in euro.

Verification of payee is a name check performed by the payer’s bank, or payment service provider (PSP), before the payment is authorised. The payer’s PSP sends a request to the payee’s PSP, which compares the name entered by the payer with the name of the person or company holding the account. The response comes back in one of four forms: match, close match, no match, or verification not possible.

In the case of a close match, the bank must also show the payer the actual name of the account holder, so the payer can correct a typo or spot an inconsistency. The service is free for the payer. It is operated through the Verification Of Payee scheme of the European Payments Council (EPC), whose rulebook came into force on 5 October 2025, a few days before the legal deadline.

The obligation applies in stages. Payment service providers based in the euro area have had to offer VoP since 9 October 2025. Providers in EU countries outside the euro area have until 9 July 2027. Outside the EU, the United Kingdom runs its own equivalent, Confirmation of Payee, under separate rules.

For businesses, VoP matters because it changes both the risk and the responsibility attached to each transfer. Before October 2025, a bank executed a SEPA transfer on the basis of the IBAN alone. The name on the payment order was not checked, so a fraudster could replace a supplier’s account number with the number of a bank account they control and the payment would still go through.

VoP closes part of that gap. It is designed to catch misdirected payments and some forms of invoice fraud, such as bank detail change scams where a fraudster asks to be paid on a new IBAN in their own name. It also shifts liability. If the payer’s bank fails to carry out the verification and the payment is misdirected as a result, the bank must refund the payer. But if the payer is warned of a no match and decides to make a payment to that account anyway, the loss generally stays with the payer. For a finance team, every alert now carries a decision, and that decision needs a documented owner.

VoP takes place between the moment the payee details are entered and the moment the payer authorises the transfer. The whole exchange runs between banks, through a common scheme, and is built to fit inside the payment flow without slowing it down.

For a single payment, the process follows five steps:

1. The payer enters or imports the payee’s name and IBAN in online banking, a banking API or a payment file.
2. The payer’s PSP sends a VoP request to the payee’s PSP, identified through the EPC directory.
3. The payee’s PSP compares the name provided with the name of the account holder and decides on the result.
4. The response travels back to the payer’s PSP, which must pass it on to the payer straight away.
5. The payer decides whether to authorise, correct or cancel the transfer.

Each payee’s PSP applies its own matching rules, guided by EPC recommendations, to decide what counts as a match or a close match. Two banks may therefore treat the same abbreviation or trading name differently. For bulk payment files, banks can run the check on each line, but the EPC scheme itself only covers one IBAN per request, so the way results are presented for a whole file varies from one bank to another.

Behind the scenes, VoP relies on an inter-bank API published by the EPC. Every participating PSP must support these API specifications, which guarantees that a bank in Spain can query a bank in Finland. Many banks use a routing and verification mechanism, a technical service provider that handles the requests on their behalf. Banks are identified through the EPC Directory Service, which tells the requesting PSP where to send each query.

The scheme also allows a check on an identifier other than the name, such as a VAT number, as long as the payee’s bank supports it. On the customer side, the EPC has not published a standard message format between businesses and their banks, so each bank exposes VoP through its own channels: online banking, host-to-host files, EBICS or a dedicated API. When choosing how to integrate VoP into an ERP or treasury system, businesses should therefore contact each of their banks to confirm its technical requirements, what data comes back and in which format.

Businesses do not have to “implement” VoP in the legal sense: the obligation falls on payment service providers. In practice, though, VoP changes the way payment files are prepared and approved, and the companies that benefit most are those that have made it work within their own processes.

The aim is to treat VoP as a final control on clean data, not as a way to discover bad data at the last minute. A few habits help:

That fourth point is where a dedicated control layer comes in. Sis ID, an Eftsure Company, provides a solution that verifies that an IBAN belongs to the company it is supposed to belong to when the supplier record is created or modified and before payment, either in the My Sis ID platform or through integrations with ERPs, treasury systems and P2P tools. For banks, Sis ID also offers VoP Suite to provide the service required by the regulation.

The first challenge is the bulk opt-out. Article 5c(6) of the regulation allows businesses, but not consumers, to opt out of VoP when they submit several payment orders as a package. Many companies have used it to avoid blocked payment runs. Deutsche Bank’s own published figures show opt-out shares of between 76% and 84% for SEPA credit transfers from October 2025 to January 2026. An opt-out without another control means that most supplier payments still leave without any name check, so the verification needs to happen earlier in the process.

The second challenge is coverage. VoP only works between PSPs that take part in the scheme. Payments in other currencies, international transfers outside the EU and transfers to non-euro EU countries before July 2027 fall outside it. The third is timing: VoP checks the account at the moment of payment, but it does not tell you whether the supplier in your master data is genuine, whether the company is still trading, or who first entered those bank details. The EPC itself has declined to give guidance on running VoP checks during supplier onboarding in an ERP. Verifying third parties upstream, through a know-your-supplier process, is the answer to all three gaps.

Used well, VoP brings measurable gains. They depend less on the regulation itself than on how a business connects the bank response to its own data and approval workflows.

The most direct benefit is fewer payments sent to the wrong recipient. A no match on a new IBAN is a strong signal that something has changed, whether it is a genuine error or an attempt at fraud. Catching it before the transfer avoids the cost of recovering money from another bank, which is often slow and uncertain, and avoids paying the same invoice twice.

VoP also clarifies liability. When the bank fails to run the check, the loss is no longer the business’s alone. When the business ignores a warning, the record of that decision exists. In both cases, finance and audit teams have a clearer basis for handling incidents, which is part of what auditors now expect from payment controls.

For teams still relying on manual call-backs to confirm the payee, VoP removes part of the workload on single payments. A match on a known supplier is a quick confirmation that the account details in the system are consistent, and the response arrives in a few seconds at most.

The efficiency gain is larger when the data is clean upstream. A supplier base where names and IBANs have already been verified produces fewer close matches, fewer blocked files and fewer exceptions to review across thousands of transactions. That is why the businesses that benefit most from VoP are often those that already had a supplier verification process before October 2025, and that now use the bank check as a second line of defence. The same logic applies to instant payments, where there is no time to recall a transfer once it has left.