How Verification of Payee Prevents Payment Fraud & Supports EU Compliance

A finance team approves an invoice from a supplier it has paid every month for three years. Nothing on the invoice looks unusual. Then the payment details lead to an account controlled by a fraudster. Once an instant payment has been authorised and settled, recovering the funds can be difficult.

The scale of authorised payment fraud shows why payment controls need to act before a payment is authorised. UK Finance reported £576.4 million in authorised fraud losses in the UK in 2025, a 19% increase from 2024.

Verification of Payee (VoP) addresses one part of this problem. It checks whether the payee information entered by the payer corresponds with information held by the payee’s payment service provider before the payment is authorised. In the EU, this is now a regulatory requirement for relevant payment service providers under Article 5c of Regulation (EU) 2024/886.

What Is Verification of Payee?

In practical terms, the Verification of Payee is a pre-payment check in which the payer’s PSP sends relevant payee information to the payee’s PSP for verification. The responding PSP checks the information against the data associated with the payment account and returns a response such as match, close match, no match, or verification not possible.

VoP does not establish that a payee is trustworthy or that a transaction is legitimate. It verifies whether the payee information supplied for the intended transfer corresponds with information associated with the payment account. Therefore, it does not replace KYC, KYB, sanctions screening, transaction monitoring or other financial-crime controls.

The EPC VoP scheme primarily verifies the payee’s name against an IBAN. It can also accommodate an identification code that clearly identifies the payee, such as a VAT number or a Legal Entity Identifier (LEI). Supported identifier combinations vary by scheme and implementation.

How Does a Verification of Payee System Work?

A verification of payee system operates through a five-step process involving an exchange between the payer’s payment service provider (PSP) and the payee’s PSP:

1. Data entry: The payer enters the payee’s IBAN (or another valid identifier) and name.
2. Verification request: The payer’s payment service provider (PSP) sends these details to the payee’s PSP through standardized API infrastructure.
3. Record check: The responding PSP checks the provided payee information against what’s linked to the corresponding payment account.
4. Response returned: Within seconds, the payer receives a response indicating whether there’s a match, a close match, no match, or if “verification is not possible.”
5. Payer decision: The payer reviews the result and decides to proceed, correct the details, or cancel the transaction.

Speed is a crucial constraint in this context. The EPC VoP Rulebook specifies that the requesting PSP must receive the VoP response within a maximum execution time of five seconds, with a preferred response time of one second or even less. This timeframe is distinct from the EU’s ten-second execution window for instant euro transfers. Consequently, the response mechanism must be automated and quick enough to fit seamlessly into the payment process. To facilitate communication among participating PSPs, the EPC’s inter-PSP VoP specifications utilize APIs and ISO 20022 resource elements.

Verification of Payee EU: What Does the Regulation Require?

Verification of payee EU obligations come from Article 5c of the Instant Payments Regulation (IPR), Regulation (EU) 2024/886, which amends the SEPA Regulation. Article 5c requires the payer’s PSP to offer a service that verifies the payee immediately after the payer provides the relevant payee information and before the payer is offered the opportunity to authorise the credit transfer. The service must be offered regardless of the payment initiation channel used. The service must be free to payment service users and available regardless of which channel the payer uses to initiate the transfer.

The requirement is not limited to instant credit transfers. The EPC VoP scheme supports verification for both SEPA Credit Transfers (SCT) and SEPA Instant Credit Transfers (SCT Inst), while Article 5c establishes the underlying legal obligation for credit transfers.

The compliance deadline depends on whether the PSP is located in a euro-area or non-euro-area EU Member State. PSPs in euro-area Member States must comply with Article 5c by 9 October 2025, while PSPs in non-euro-area Member States have until 9 July 2027.

VoP also operates alongside other financial-crime and sanctions controls. Regulation (EU) 2024/886 separately requires PSPs offering instant credit transfers to conduct checks against targeted financial restrictive measures at specified intervals and when new or amended measures enter into force.

VoP Compliance: Key Verification of Payee Requirements for PSPs

Meeting the verification of payee requirements involves both regulatory compliance and technical implementation. PSPs need to consider the following areas:

• Pre-authorisation verification: VoP must be performed immediately after the relevant payee information is provided and before the payer is offered the opportunity to authorise the transfer.
• Payment-channel coverage: The service must be offered regardless of the payment initiation channel used.
• Clear payer notifications: Where the verification result indicates a mismatch or another applicable response, the payer must receive information about the potential consequences of proceeding.
• Liability and refund rights: PSPs need processes that reflect the liability and refund provisions in Article 5c, including the consequences if the verification service is not performed correctly.
• Data accuracy: Responding PSPs need accurate information to check submitted payee details.
• Technical interoperability: PSPs participating in the EPC scheme need to implement the applicable scheme rules, API specifications and security requirements.

The EPC’s VoP Scheme Rulebook v1.1, API specifications v1.1.1 and API Security Framework v2.1 became effective on 20 September 2026. The updates clarify implementation issues identified during the first phase of live deployment, including API field handling, character sets, timestamps, HTTP headers and certificate requirements.

How Verification of Payee Helps Prevent Payment Fraud

Verification of Payee is designed to identify cases where the account information does not correspond to the payee the payer intends to pay. This makes it particularly relevant to invoice redirection fraud, certain business email compromise scenarios and payment errors. In each case, a mismatch between the supplied payee details and the destination account can give the payer an opportunity to correct the payment or stop it before funds leave.

What Verification of Payee Cannot Prevent

VoP cannot flag every fraudulent payment. A scammer using an account correctly registered in their own name passes the check cleanly. So does a victim who is socially engineered into ignoring a mismatch warning, or a money mule account with legitimate-looking credentials.Romance scams and impersonation scams can also fall outside VoP’s primary protection because the account information may correspond with the name supplied by the fraudster. The US Federal Trade Commission reported more than $3.5 billion in reported consumer losses to imposter scams in 2025.

This illustrates why VoP should operate as one control within a broader fraud and financial-crime framework rather than as a standalone fraud-prevention measure.

Confirmation of Payee vs Verification of Payee

Confirmation of payee (CoP) and VoP return the same category of result and sit at the same point in the payment flow, but they run on different rails.

Confirmation of Payee (CoP) was introduced in the UK in 2020, when the six largest banking groups implemented the service following PSR direction. The PSR later directed around 400 additional financial firms to implement CoP, aiming to extend coverage across nearly all Faster Payments and CHAPS transactions by October 2024. CoP and VoP therefore address a similar payment-risk problem through different regulatory and implementation models. CoP operates within the UK payment system, while VoP forms part of the EU regulatory rules governing payee checks of payees in credit transfers.

How Verification of Payee Fits Into a Wider AML and Fraud Prevention Strategy

VoP does not assess whether the account holder presents sanctions, adverse media or transaction-monitoring risk. Firms therefore need complementary controls around payment activity.

AML Watcher’s transaction monitoring can surface unusual transaction activity that a payee-name check would not reveal on its own. The Sanctions screening as well as the adverse media screening, address different risk signals linked to individuals and entities. Together, these controls provide visibility into different parts of the payment and financial-crime risk.

Challenges of Implementing a Verification of Payee System

Rolling out real-time payee verification across dozens of different languages, as well as currencies, along with PSP systems has surfaced four recurring friction points:

• Data quality: Diacritics, transliterated names and businesses trading using a trading name rather than their registered legal entity all produce false “close match” or “no match” results on legitimate payments.
• Cross-border complexity: Naming conventions and infrastructure vary enough between member states that a match logic tuned for a single market may misfire in another.
• Real-time performance: Verification must be completed within a payment workflow without adding friction that pushes customers to abandon legitimate transfers.
• Interoperability: Smaller PSPs and electronic money institutions face real integration costs to connect to shared directories and adopt ISO 20022 messaging consistently.

Strengthening Payment Fraud Controls Beyond Verification of Payee

VoP adds an important pre-payment check, but it cannot determine whether a transaction is suspicious or whether the receiving account presents a wider financial-crime risk. Therefore, financial institutions need controls that connect payee verification with transaction monitoring alongside broader financial-crime screening.