.svg)
The European Payments Council (EPC) has officially published the first version of the Verification of Payee (VoP) scheme rulebook following a public consultation.
Corresponding to the EU’s incoming Instant Payments Regulation (IPR), the scheme is set to help payment service providers (PSPs) in the Single Euro Payments Area (SEPA) meet their new regulatory obligations.
For now, the VoP rulebook focuses on IPR compliance, but the EPC has confirmed that future updates to the rulebook may extend to other payment instruments, depending on market demand.
The scheme provides a set of inter-PSP rules, practices and standards for participants, with minimum conditions required in the payment service user (PSU)-to-PSP space.
It also provides a common basis on which participants can offer new and innovative services, and it is hoped it will move participants and PSUs towards open standards.
The EPC says it wants open standards to “improve financial integration and act as a catalyst for a richer set of products and services”.
The objectives are to automate VoP requests and responses using open standards and so-called straight-through processing (STP), eliminating manual intervention.
It is hoped that this will harmonise standards, enhance security, reduce risks and improve cost efficiency for payment services, ultimately improving services for PSUs in the SEPA space.
As reported by Vixio, preparing for compliance with the VoP requirements has been one of the biggest challenges for PSPs in adapting to the IPR. In particular, pan-Eurozone interoperability, friction and liability are proving tricky.
It is thought that firms have been waiting for the EPC to bring out a set of standards, although these will not be able to help with other topics, such as VoP for corporate payments.
Steps to verification
According to the EPC VoP scheme, the process begins when the payer's PSP, referred to as the "requesting PSP", receives the payee’s payment account number and name from the payer.
If these details are provided by a payment initiation service provider (PISP), the PISP is required to ensure the accuracy of the information. In cases where the payee is a legal entity, the requesting PSP may verify the payee’s identity using an identifier such as a VAT number or legal entity identifier (LEI), instead of the payee’s name.
Next, the requesting PSP transmits a VoP request, containing the payee’s details, to the PSP holding the payee’s account, known as the "responding PSP”.
The requesting PSP can use the EPC directory service (EDS) to verify whether the responding PSP participates in the VoP scheme and to gather routing data. If the requesting PSP also holds the payee’s account, it acts as both the requesting and responding PSP.
The responding PSP then processes the VoP request by checking the payee’s details against its internal records; if there is a "close match", such as the details closely resembling those in the records, the responding PSP provides the name associated with the payee's account to the requesting PSP.
The responding PSP will also need to send a VoP response back to the requesting PSP, which may indicate a match, no match, or close match.
If there is a close match, the requesting PSP is required to inform the payer and provide the payee’s name. If the response is a "no match" or the check is not possible, the requesting PSP warns the payer that the payment may be directed to an incorrect account.
Finally, based on the VoP response, the payer decides whether to proceed with the payment. However, the actual initiation and processing of the payment itself are beyond the scope of the EPC VOP scheme.
The EPC has also set out its recommendations on matching in this process, suggesting guidance for matching the name of a payment counterparty — a natural or legal person — with the corresponding payment account number.
For natural persons, matching involves an exact match of the first and last name. For legal persons, it involves matching the legal or commercial name.
PSPs are also advised to ensure payees use the correct name to reduce unnecessary mismatches, and have cautioned that any data clean-up processes, including adjustments for diacritics, special characters and honorifics, should be carried out before matching.
Reaction to the scheme
Reacting to the new rulebook, Kjeld Herreman, founder of PayLume, said that it is a “clear starting point”.
Herreman did, however, highlight that some parts may not sit well with the PSP industry.
"The rulebook sets a timeout limit of five seconds for responses, with a preference for a completed response of one second within this window,” he said.
However, he cautioned that some believe this shorter timeout would fail to improve user experience. “Delays of this length may lead to frustration, especially given the speed expectations associated with online banking."
He also said that the introduction of "additional optional services" (AOS), which PSPs or PSP communities can offer to enhance the service, is an interesting component of the rulebook.
In the document, it is stipulated that these AOS must not interfere with the scheme's interoperability or competitiveness and are governed by the scheme’s rules for transparency and compliance, and that the EPC may integrate widely adopted AOS into the main scheme based on market needs.
“Such AOS exist for other SEPA instruments such as credit transfers. For example, in Belgium, we have structured remittance information unique to the country but adhering to the EPC's SCT [SEPA Credit Transfer] rulebook,” explained Herreman.
The VoP scheme will also allow for such user group services, and some already exist in the market today.
For instance, SurePay and Euro Banking Association allow for additional data elements to be shared in the VoP response to allow the requester and their PSP to better assess whether a transaction may be fraudulent.
“It will be interesting to see how AOS will be managed, potentially formalising these services and providing insights to competitors,” Herreman said.
“The EPC also reserves the right to transform AOS into part of the standard scheme as it progresses, so it will be interesting to see how vendors navigate this."
Scope and next steps
The scheme is applicable in the SEPA countries, supports the verification of a single account at a time, and ensures that (in the case of multiple account holders) only the relevant account holder's name is disclosed.
The scheme also focuses solely on verifying account details related to payments and is not used for other identification purposes.
The EPC has confirmed that the VoP application programming interface (API) specifications and the updated API Security Framework document will be released before the end of October 2024.
In addition, the EPC plans to communicate additional information about how to achieve reachability and interoperability for VoP scheme at EEA level, including mandatory registration in the EPC EDS and use of it, and about VoP adherence process.
There will also be a new taskforce established, composed of up to 14 members, representing EPC members along with other qualified nominees.
Its formation is initiated by the Nominating and Governance Committee (NGC), with final approval by the EPC’s Payment Scheme Management Board (PSMB).
