For decades, European credit transfers ran on a blunt rule: the money follows the IBAN, and the name you type next to it is essentially decoration. If you wrote “Anna Kovacs” but pasted a fraudster’s IBAN, the funds went to the fraudster; banks were generally not obliged to compare the two. Verification of Payee (VoP) closes that gap.
What VoP actually is
VoP is a real-time check performed before a payment is authorised. When you enter a recipient name and IBAN, your bank queries the recipient’s bank (or a scheme-level service acting for it) and gets back one of a small set of answers: match, close match (with the actual holder name or a hint returned, so you can spot “Anna Kovacs” vs “Anna Kovács Ltd.”), no match, or a technical “check not possible”. You then decide whether to proceed. The check is a warning system, not a hard block, but ignoring an explicit no-match typically moves liability for a misdirected payment toward the payer.
The regulatory context
The legal driver is the EU Instant Payments Regulation (Regulation (EU) 2024/886), adopted in 2024 as an amendment to the SEPA Regulation. Its headline purpose was to make euro instant transfers universal and no more expensive than ordinary ones, but it paired that speed with a safety mechanism: when money moves in seconds, there is no recall window, so the name-IBAN check has to happen up front. Since 9 October 2025, payment service providers in the euro area must offer VoP on euro credit transfers, instant and non-instant alike, at no extra charge; providers in non-euro member states follow on a later timeline. The European Payments Council operates the scheme rulebook under which banks exchange these checks.
Why this matters for how you think about IBANs
A structurally valid IBAN passes three tests: correct length for its country, correct character pattern, and correct mod-97 check digits. All three are properties of the string. None of them tells you that an account exists, that it is open, or who owns it. Roughly one in 97 well-formatted random strings validates by arithmetic alone. This is precisely why “the IBAN validated” was never a fraud defence, and why invoice fraud, where criminals swap the IBAN on a genuine-looking invoice, worked so well for so long.
VoP adds the missing layer: it checks the string against reality. For developers, the practical takeaway is to treat validation and verification as different stages. Validate format client-side to catch typos instantly; rely on the banking system’s payee verification for existence and ownership. And for anyone paying an invoice: if your bank shows a no-match warning, stop and phone the supplier on a number you already had.