#
Verification-of-payee obligations, currently limited to instant/SEPA credit transfers under the amended SEPA Regulation, will be extended to all credit transfers under the new PSR, with PSP fraud-liability and blocking-measure obligations.
The scheme-mandated security layer is PCI DSS, which is contractually required by Visa and Mastercard for all merchants. PCI DSS 4.0's future-dated requirements took effect from 31 March 2025, moving previously optional controls into mandatory status and raising the compliance baseline for merchants and their acquirers.
On competitive dynamics, combined Visa and Mastercard European payment volume rose 18% in Q2 2025 (12% in euro terms), with Mastercard marginally exceeding Visa in processed European volume for the first time. This Tier-2 public-data signal marks a notable shift in the relative competitive position of the two networks within Europe.
Outlook
The module is stable. The IFR caps and the now-live PCI DSS 4.0 requirements are settled standing positions; the watch item is the evolving Visa–Mastercard competitive balance in European processed volume, where Mastercard's marginal lead is a position to monitor rather than a structural break.
Scheme & Network Compliance
Three European Payments Council rulebooks covering payee-name verification across the Single Euro Payments Area became mandatory for all scheme participants on 20 September 2026: Verification of Payee, Request to Pay, and the SEPA Payment Account Access scheme. The rulebooks prohibit the submission of empty payee-name fields in covered payment flows and introduce a revised security framework governing how payee-name verification is performed and evidenced within the scheme. This is reported as a backfill-flavoured item within this cycle's lookback window rather than a live-breaking development, reflecting a date that had already passed by the time this cycle's research reached it.
The finding rests on a single tier-3 aggregator report. The European Payments Council's own scheme page, describing the Verification of Payee scheme as developed to support payment service providers in meeting their legal obligations, is carried in the source register as a tier-2 corroborating reference but was not directly cited for the specific mandatory-date claim itself. This leaves the precise mandatory-compliance date, and the exact scope of the empty-field prohibition, at an uncertain confidence tier pending direct retrieval of the European Payments Council's own rulebook text.
For payment service providers operating within the Single Euro Payments Area, the practical effect is that payee-name verification can no longer be treated as an optional or partially implemented control: the scheme-level rulebooks now mandate its application alongside the Instant Payments Regulation's existing verification requirements, converging scheme-level and regulatory-level expectations onto the same verification standard.
Outlook
The open question for the next monitoring window is whether implementation of the three mandatory rulebooks was uniform across the SEPA participant base as of the 20 September 2026 effective date, as scheduled, or whether there was variation in readiness among smaller payment service providers relative to larger scheme participants. Direct retrieval of the European Payments Council's own rulebook publication would allow this module's confidence to move beyond its current uncertain tier and would clarify whether any transitional or phased-compliance provisions apply to participants that were not fully ready by the mandatory date.
2 earlier distinct update(s)
Scheme & Network Compliance
The Payment Services Regulation extends the Verification of Payee mechanism from its current scope, euro-denominated instant credit transfers under the amended SEPA Regulation, to cover all credit transfers, including those outside SEPA's geographic and currency reach. This is the cycle's principal scheme-and-network-compliance development, and it carries direct fraud-liability consequences: payment service providers may need to absorb losses where the verification mechanism itself fails, and providers will be required to offer customers spending limits and transaction-blocking measures. A specific reimbursement requirement applies to employee-impersonation fraud scenarios, allocating loss exposure toward providers in a defined category of fraud that has proven difficult for verification-only controls to prevent.
Because the existing SEPA-only Verification of Payee obligation already covers the euro instant-credit-transfer population, providers that have already built verification infrastructure for SEPA instant transfers face a scaling exercise, extending existing logic to a wider transfer population, rather than a from-scratch build. The scope extension nonetheless represents a meaningful widening of scheme-level compliance obligations beyond the euro-area instant-payments core that has been the initial focus of Verification of Payee implementation to date.
Outlook
Watch for the PSR's formal publication, expected around Q3 2026, to fix the compliance timeline for the Verification of Payee scope extension. Providers should expect the transition period applicable to PSD3/PSR generally to also govern the phase-in of the wider Verification of Payee obligation, though this cycle's evidence does not confirm a separate, earlier-dated compliance deadline specific to the VoP extension itself.
Scheme & Network Compliance
The European Payments Council published a dedicated Verification-of-Payee Scheme Rulebook, entering into force 5 October 2025, just days ahead of the 9 October 2025 regulatory deadline under the Instant Payments Regulation. This is a Tier-2, high-confidence finding, and the timing detail, the scheme rulebook entering into force ahead of rather than concurrent with the regulatory deadline, is itself a useful data point on scheme-level readiness: the European Payments Council built and activated the network-level rulebook with a small margin ahead of the legal deadline it was designed to support, rather than the two dates coinciding exactly or the rulebook lagging behind the regulation.
Signal on scheme and network compliance this cycle is otherwise limited: no further scheme-rulebook development, card-scheme rule change, or network-level dispute-resolution update was located for the EEA this cycle beyond the Verification-of-Payee Rulebook itself. The module is flagged as thin-signal accordingly, reflecting an honest account of what was found rather than an attempt to extend a single finding into a broader network-compliance narrative.
Outlook
The practical scheme-compliance question going forward is whether the European Payments Council Rulebook approach, building and activating a dedicated scheme rulebook ahead of a regulatory deadline, is repeated for the non-euro-area Verification-of-Payee deadline of 9 July 2027, or whether that later deadline is met through a different scheme-governance mechanism. No further scheme-level signal was identified this cycle to assess that question directly.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and findings (4)
- T1EUR-Lex Regulation (EU) 2015/751 (Tier-1)
- T3DIMOCO (citing IFR)
- T3PCI SSC / vendor summaries
- T2Business of Payments (Visa/Mastercard public data)