title: France — Operational Resilience & Critical Infrastructure | World Payments Monitor canonical: https://payments.gi/jurisdictions/france/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infrastructure Confirmed confirmed 2026-06-23 SEPA Instant Verification-of-Payee (VoP) has been mandatory since 9 October 2025 under the Instant Payments Regulation (EU) 2024/886, directly affecting Wero/Paylib instant-transfer operators (BNP Paribas, BPCE, Crédit Agricole, Société Générale, Crédit Mutuel consortium). PSR is expected to extend VoP to all SEPA credit-transfer channels, not just Instant, ahead of a pre-2027 deadline. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/france/) Horizon · 2026-Q4 (± a year) PSR extension of VoP to all SEPA channels_Proposed · Tier 3 source_ Horizon · 2026-11-15 (± a quarter) Mandatory ISO 20022 structured addresses for all SEPA payments_Adopted · Tier 3 source_ Standing sub-brief · as of 26 June 2026 177 words · last cycle 2026-10-05 #### Operational Resilience & Critical Infrastructure DORA entered into application on 17 January 2025; the ACPR supervises banking, insurance and payment entities for ICT risk management, major-incident reporting, the Register of Information (with first registers expected by 15 April 2025), and ICT third-party oversight, with threat-led penetration testing conducted under TIBER-FR. DORA compliance — including incident-reporting timelines, the Register of Information, and third-party oversight — is now a live operational obligation for all French in-scope payment entities. On critical infrastructure, the Banque de France is the designated competent authority for oversight of the CORE(FR) systemically important payment system operated by STET, and participates in cooperative oversight of other Eurosystem SIPS including TARGET2 and TIPS, EURO1, STEP2, and Mastercard Europe. CORE(FR)/STET is the critical domestic retail clearing backbone, and its oversight regime is foundational infrastructure for all French payment flows. #### Outlook No separate French national critical-third-party payments resilience statute beyond DORA and ACPR internal-control orders was identified; resilience rests on directly-applicable EU DORA plus the ECB SIPS Regulation. Overseas-territory DORA carve-outs are noted but not separately tracked this cycle. Periodic update · new data 2026-09-28 #### Operational Resilience & Critical Infrastructure All SEPA payments in France must migrate to structured addresses in ISO 20022 format from 15 November 2026, with legacy, non-structured address formats rejected from that date onward. This is a mandatory infrastructure and message-format compliance deadline affecting every PSP processing SEPA payments in France, not a discretionary upgrade path. The deadline sits within France's broader operational-resilience framework, under which the Digital Operational Resilience Act (DORA) has applied directly since 17 January 2025, with the ACPR acting as primary supervisor for operational-resilience matters in the payments sector. The ISO 20022 structured-address mandate is a scheme-level infrastructure change rather than a conduct or licensing change, but its operational burden is significant: PSPs must ensure that both their own systems and any legacy correspondent or counterparty systems they interact with can produce and consume the structured-address format before the deadline, or risk payment rejection. Combined with the PSD3/PSR conduct-side reforms landing in a similar timeframe, French PSPs face a compressed period in which both message-format infrastructure and fraud-liability operational readiness must be achieved concurrently. #### Outlook The 15 November 2026 deadline is the fixed and immovable marker for this module. The practical question for the remainder of this cycle and into the next is the state of PSP readiness for that migration, and whether any transitional accommodation is offered for counterparties that have not completed the structured-address migration by the deadline. **1 earlier distinct update(s)** Periodic update · new data 2026-09-13 #### Operational Resilience & Critical Infrastructure Verification of Payee became mandatory for SEPA Instant credit transfers in France from 9 October 2025, under the amended SEPA Regulation and the Instant Payments Regulation (EU) 2024/886. This is a confirmed, EU-harmonised operational-resilience control directly affecting the technical infrastructure underlying instant-transfer operators, including the Wero and Paylib rails that carry a material share of French P2P and retail instant-payment volume. VoP works by verifying that the payee name supplied by the payer matches the actual account holder before a transfer completes, a structural control against the account-mismatch and impersonation vectors that underlie a large share of authorised-push-payment fraud. The operational significance of this mandate should be read against the fraud data reported for the same period: payment fraud in France reached €618.4 million across 3.7 million transactions in H1 2025, with authorised-push-payment fraud rising 37% year-on-year and now representing 40% of total fraud value. VoP's mandatory activation for SEPA Instant transfers from October 2025 sits within, rather than fully preceding, the reporting window in which APP fraud continued climbing sharply, an infrastructure-and-outcome juxtaposition that is itself the operationally relevant signal this cycle: either VoP's protective effect has a lag before manifesting at scale across the full instant-payment volume, or a share of the fraud growth reflects typologies VoP is not designed to fully counter. A further probable-confidence signal points to planned extension of VoP beyond SEPA Instant to classic (standard, non-Instant) SEPA rails, with French payment institutions and e-money institutions expected to need to deploy this ahead of a pre-2027 deadline. This would close a current gap in which VoP's operational-resilience benefit is currently confined to the instant-transfer channel while standard SEPA credit transfers remain outside its scope. #### Outlook The critical infrastructure question to track is whether VoP's extension to standard SEPA rails proceeds on the pre-2027 timeline currently indicated, and whether the fraud data for H2 2025 and into 2026 shows the lag in VoP's protective effect narrowing or whether APP fraud typologies continue to outpace the control's coverage. **Sources and findings (4)** 1. T1 [https://acpr.banque-france.fr/fr/reglementation/focus-sur-la-reglementation/transverse/digital-operational-resilience-act-dora](https://acpr.banque-france.fr/fr/reglementation/focus-sur-la-reglementation/transverse/digital-operational-resilience-act-dora) retrieved 2026-06-23 2. T3 [https://www.dlapiper.com/en/insights/publications/2025/02/application-of-the-digital-operational-resilience-act---dora](https://www.dlapiper.com/en/insights/publications/2025/02/application-of-the-digital-operational-resilience-act---dora) retrieved 2026-06-23 3. T1 [https://www.banque-france.fr/en/financial-stability/institutional-framework/payment-systems-market-infrastructures/conduct-oversight-activities](https://www.banque-france.fr/en/financial-stability/institutional-framework/payment-systems-market-infrastructures/conduct-oversight-activities) retrieved 2026-06-23 4. T1 [https://www.elibrary.imf.org/view/journals/002/2025/237/article-A001-en.xml](https://www.elibrary.imf.org/view/journals/002/2025/237/article-A001-en.xml) retrieved 2026-06-23