Introduction

The European Instant Payments Regulation (IPR) mandates that all banks and Payment Service Providers (PSPs) offering SEPA Credit Transfers (SCT) or SEPA Instant Credit Transfers (SCT Inst) implement Verification of Payee (VoP). To support this, the European Payments Council (EPC) has launched a standardised VoP Scheme, defining how PSPs must verify a beneficiary’s identity before processing payments.

With several key deadlines rapidly approaching, this guide outlines the critical dates, milestones and steps PSPs need to take to ensure timely compliance and avoid potential penalties.

i) May – June 2025: Adherence Waves Deadline(s)

Wave 1: PSPs intending to participate in the first wave must have submitted their adherence requests and associated fees by 15 May 2025, 18:00 CET. This is now closed – if they got in, they will be LIVE in August.

The challenge with this group is that the Simulator (aka API Reference Toolkit – ART) is only just becoming ready and the EPC Directory Service (EDS) is not yet available, so participants will experience a stop-start programme.

Wave 2: Adherence requests and associated fees paid between 16 May 2025 and 30 June 2025 will be granted access to the EDS by 10 September 2025 at the latest. The advantage for this group is that they should have a smoother Programme, as ART and EDS should be fully available in June. This should also mean that once they are certified for Production, EDS will open the Production environment – scheduled for August – for limited Friends & Family testing between Routing and/or Verification Mechanisms (RVMs) and PSPs.

Wave 3: Adherence requests and associated fees paid after 30 June 2025 will be granted access to the EDS by the Secretariat on a best-effort basis. NOTE that access by the 5 October 2025 deadline is not guaranteed. In such cases, participants may need to notify the European Central Bank (ECB) that they are unable to confirm compliance with the Instant Payments Regulation (IPR) – potentially exposing them to currently undefined recourse.

ii) June 2025: EPC Directory Service (EDS) Pilot Testing Begins

The EPC Directory Service (EDS), a centralised directory facilitating VoP request routing, is expected to be available for pilot testing starting in June 2025. PSPs should be prepared to integrate and test their systems with the EDS during this period. Please note, PSP direct customers will only have GUI access, whereas PSPs who delegate to a Routing and/or Verification Mechanism (RVM) will have the option of GUI and/or API access.

RVMs, such as Konsentus, will manage EDS connectivity on behalf of the PSP (unless the PSP wishes to manage this themselves). The EDS is the central directory where such RVMs and other VOP scheme details are registered and managed. In parallel to the Scheme testing, PSPs should do integration/performance testing between their RVM’s Request and Response API/Swagger.  This testing must be completed before the PSP’s “Go LIVE” date can be updated in the EDS Directory. Unlike Confirmation of Payee (COP) in the UK, the end-to-end testing is performed by the RVM not the PSP (unless the PSP does not delegate VoP compliance or goes direct).

iii) September 2025: EDS Fully Operational

After the RVM has registered the PSP with the EDS for VoP, the RVM will:

• Work with the PSP regarding the rotation of Keys/Certificates
• Provide industry management information to the EPC
• Maintain the PSP’s Compliance with the Scheme

By September 2025, the EDS is anticipated to be open for Production (although it will not be fully LIVE until 5 October). Konsentus will ensure the PSP’s systems are fully integrated with the EDS to enable seamless VoP request and response handling with other actors in Production.

iv) 5 October 2025: VoP Scheme Rulebook Effective Date

The VoP Scheme Rulebook becomes effective on 5 October 2025, marking the official start of the scheme’s operational guidelines. PSPs must have their VoP services compliant with the rulebook by this date. If a PSP is not ready to be LIVE by this date, it should have already advised the ECB that it will be non-compliant with the Instant Payments Regulation (IPR).

v) 9 October 2025: Final Compliance Deadline

Under the EU Instant Payments Regulation (IPR), all PSPs offering SEPA Credit Transfers (SCT) and SEPA Instant Credit Transfers (SCT Inst), including EBICS, SEPA OCT, SWIFT FileAct, etc. must implement VoP services by 9 October 2025. Non-compliance beyond this date may result in regulatory penalties.

Non-compliance means failing to meet the regulatory obligations around IBAN-name & IBAN-Identification Code checks as mandated for euro credit transfers.

Specific examples include:

• Not offering VoP checks to payers when initiating SEPA credit transfers
• Not responding to VoP requests from other PSPs/RVMs
• Not accurately matching the payee name+IBAN or IBAN+Identification Code
• Failing to implement VoP by the legal deadline
• Misusing or misrepresenting VoP results (e.g. misleading customers about match status)

These failures would be considered violations of the EU Instant Payments Regulation.

Non-compliance

• In the European Union, non-compliance with Verification of Payee (VoP) rules, particularly under the Instant Payments Regulation, can lead to:
• Regulatory penalties and fines
• Loss of customer trust and legal liability
• Reputational and commercial risks
• Potential exclusion from SEPA or instant payments participation

To avoid these outcomes, all PSPs in the EU must implement VoP checks properly, ensure cross-border interoperability and stay aligned with regulatory deadlines.

Summary

The VoP Scheme under the EU’s Instant Payments Regulation is fast becoming a reality, with phased deadlines between now and October 2025. Whether you’re in Wave 1, or targeting Wave 2, or 3, it’s crucial to understand your responsibilities and select an RVM, such as Konsentus, or integrate directly with the EPC Directory Service and ensure your systems are compliant and tested well ahead of the final deadline.

Don’t leave it too late – non-compliance could carry significant operational and reputational consequences. If you’re unsure about your readiness or need expert support, contact us today at info@konsentus.com.