Implementing VOP for bulks: ‘The nightmare before Halloween’?

As stipulated by the Instant Payments Regulation (IPR), payment service providers (PSPs) in the Eurozone will be required to perform verification of payee (VOP) on every credit transfer in the Single Euro Payments Area (SEPA), with a 9 October deadline to begin offering the service.

While VOP is expected to further boost the security of European payments, the requirements were primarily designed with payment initiation by consumers in mind. Despite this initial focus on consumer payments, the regulation will apply broadly across both consumer and business transactions – including bulk payments initiated by corporates. This could inadvertently introduce pain points to the process for corporates, namely in the following areas:

• Readiness – The systems and processes of PSPs and their corporate customers, particularly the underlying enterprise resource planning (ERP) systems, are unlikely to be ready to fully support VOP checks by 9 October.
• Handling of check responses – While executing the VOP checks themselves may not pose a major technical hurdle for PSPs, managing the outcomes of these checks will present significant operational challenges for them and their customers.
• Management of single-transaction bulk files – The high percentage of bulk files containing a single transaction may cause additional challenges. Even corporates looking to opt out of the VOP requirements for their bulk transactions are required to opt in for these to remain compliant.
• Standardisation of processes – The lack of standardisation around how PSPs can implement VOP for their corporate customers and address these challenges is adding to the complexity.

So, how can the pan-European payments community move forward? The implementation of VOP will first involve a sprint to the 9 October deadline, followed by a period of iterative fine-tuning and industry-wide collaboration to address the remaining pain points.

While most PSPs in the Eurozone are now fully awake to these issues, there is a need to rally the rest of the ecosystem – from large corporates to ERP providers – and encourage total engagement.

VOP for bulk payments: Understanding the challenges

A large corporate can today bundle its payments into bulks through an ERP system – then send the files to its PSP via a third-party channel or a front-end channel offered by the PSP. In many cases, these bulks reach the PSP with a corporate seal to confirm that the files have been pre-authorised and are ready to be processed by the PSP.

From October, however, the mandatory VOP checks have the potential to significantly disrupt this process. The three biggest challenges will be around readiness, single-transaction bulk payments, and the need for opt-in/opt-out standardisation:

1. The question of readiness

Pre-authorised files were only ever meant to be unpacked for the purpose of processing the payments they contain. It was never intended that the PSP would unpack this bundle with the intention of performing further checks or potentially having to request additional confirmations from corporates in the case of a partial or close match.

Consequently, the highly automated systems that generate and submit these bulk files are currently not equipped to engage in two-way interactions with PSPs or to process responses from corporates.

Given the tight implementation timeline and the big-bang approach for VOP, there is no realistic prospect that PSPs or their customers will be able to adapt their systems or processes by 9 October – particularly since the underlying, third-party ERP systems that orchestrate the majority of these payments for large corporates can take up to 18 months to update.

Indeed, if a corporate were to opt in to the VOP check, it is as yet still unclear for a number of channels how the corporate would manage this dialogue with the PSP. One viable avenue, which was confirmed by the European Commission in its updated Q&A  document of 28 July 2025 (see Q&A 120a), would be to replace this dialogue with a contractual agreement: in line with this agreement, the payment orders in a bulk file could be automatically rejected or executed by the PSP, depending on the VOP result, without requiring a second authorisation by the payer.

2. A skeleton in the closet

Another proposed workaround would be to opt out of VOP for bulk transactions, with any additional checks carried out prior to file authorisation, i.e. as separate advance checks.

Such a pre-validation approach can also help to minimise mismatches by enabling corporates to update their creditor and payroll databases outside and ahead of the payment initiation process. Going forward, this can enhance the accuracy of any name matches against the legal names under which the accounts of their suppliers or other counterparties have been opened.

“There are compelling reasons to explore VOP pre-validation, which can be completed by corporates in advance of making payments,” explains Sai Sathuluri, Senior Vice President, UK & Europe Regulatory Programme, Payments Services at Citibank. He elaborates:

“Decoupling verification of payee and payment processing enables corporates to complete validation services at the right time, without creating additional friction at the time of processing a payment, where time is of the essence to ensure payments get to beneficiaries on time.

Let’s take the example of a use case like payroll transaction processing, where a corporate that has not opted out of VOP is sending their payroll file for processing same day or the day before the payments need to reach the beneficiary. If, at that point, VOP is performed and a payment is stopped due to a VOP ‘no match’, it may be difficult for a corporate to resolve the mismatch in time for that payment to be processed prior to cut-off. This would put the timely processing of such a critical payment at risk.

However, if that same corporate was able to validate the payee’s name and account number at the time that the employee is added to standing payroll instructions, the corporate would be able to deal with any potential mismatches in advance of payroll processing. The experience then becomes very different, as it would allow clients reasonable time to investigate any discrepancies and take informed action.

There is a lot to be gained from this pre-validation, which can help reduce the fear of sending money to the wrong account and really helps build customer trust in digital transactions.”

While advance VOP checks offer a potential way forward for PSPs and their customers, there are still some open questions to address. For example, there is currently no way to directly link a payment order to a separately conducted VOP check, and the duration for which a VOP check result remains valid has yet to be clearly defined.

Even if a workaround could be identified here, an added complication remains: opting out is not possible for single transactions within a package (as outlined by the EU Commission; Q&A 138 on IPR Implementation). Indeed, when sending a single transaction through a bulk channel, customers that had opted out of VOP may be forced to opt in for a VOP check; alternatively, they may risk non-compliance with the regulation or the rejection of their single transaction by the PSP.

Though rejecting such files is technically an option for PSPs, it is not a practical solution. The volume of single-transaction files submitted via bulk channels is significant enough that the approach would result in substantial disruption for innumerable customers.

According to data collected by 18 individual members of the EBA’s Practitioners Group on Instant Payments, from 11 SEPA countries, the percentage of bulk files containing single transactions ranges from 2% to 80%. Half of the PSPs found that single-transaction files accounted for more than 40% of their bulk traffic.

The requirement to opt in for single transactions not only reopens the challenge of legacy system readiness, but also creates a need for corporate customers to be able to seamlessly switch between opt-in and opt-out from day one.

“Companies have automated payment processes and typically issue many credit transfers only on a few days a month. Most of the time, only few credit transfers are issued, and the likelihood of automatically producing a single-transaction payment file is high,” explains Alban Lecuir, Payment Expert, BPCE Payment Services.

 “To be impacted by the single-transaction file issue, a corporate client must have opted out from VOP,” he adds. “The level of inconvenience experienced by the corporate depends on whether the payment files are pre-authorised or not.

For non-pre-authorised single-transaction files, the bank validates the payment order and submits it for the VOP check. The result is then presented to the client for validation. Since the person authorising the payment (often the treasurer) may not be best placed to assess the VOP result, either the payment submission is approved without regard to the VOP feedback – making the VOP process ineffective – or delayed due to consultation with the payment team.

In the case of pre-authorised single-transaction files, no client interaction is possible after submission, as pre-authorised processes are designed to proceed automatically. If the client and the bank have prepared for this, the client may instruct the bank to proceed regardless of the VOP outcome – again making the VOP process ineffective. However, if no such arrangement exists and the VOP result is not a ‘match’, the payment is rejected, causing maximum inconvenience for the client.”

Thanks to recent developments, this ‘maximum inconvenience’ can at least be avoided for some customers:  to prevent the single-transaction file issue from impacting corporates and other non-consumers, the German supervisory authority BaFin will, until further notice, tolerate that these end users are offered the possibility to opt out from VOP for single-transaction files as well. Whether supervisory authorities in other jurisdictions will follow suit remains to be seen.

3. How to opt in or opt out? The need for standardisation

The absence of a uniform approach for corporates to opt in or out represents a further layer of complexity because the interaction between PSPs and their bulk-sending corporate customers has not yet been standardised. This space falls – to some extent – within the realm of competition and as such the EPC VOP Scheme Rulebook offers limited guidance, focusing primarily on PSP-to-PSP interactions.

In most regulatory implementations, such changes usually unfold over many years and are not introduced in such a ‘big-bang’ manner. Take for instance a different component of the IPR: the requirement for all PSPs in the Eurozone to be able to send instant payments by October. This builds on a previous mandate requiring them to receive such payments from January 2025. And though a significant development, it is an evolution, not a revolution. Instant payment systems have been live since 2017 and are now becoming mandatory eight years later. This extended timeframe has allowed PSPs and their customers – as well as ERP providers – to gradually develop and adapt their respective offerings, and to align on certain practices. Indeed, it may take a similar length of time to fully resolve today’s opt-in/opt-out issue.

Having this kind of runway makes the process far easier – particularly from the corporate perspective. Most corporates work with multiple PSPs, often using different channels across various countries. Without harmonisation, if each PSP develops their own specifications and formats for these interactions, they quickly become extremely complex and burdensome for corporates to implement and maintain.

In the run-up to the 9 October deadline, several options have been emerging as to how PSPs might implement VOP opt-in/opt-out for their customers, including:

• Customers may indicate within a self-service tool or application that they want to opt in or out
• Customers may include a different indicator during the sending of the file (i.e. the file format remains the same) to opt in and out
• Customers may move to a different file format to opt in and out
• PSPs may contractually agree with their customers on whether these opt in or opt out

“While we appreciate that VOP may add significant value to our clients in terms of fraud risk reduction, we are also aware that most of our corporate clients would not be ready to implement any internal changes to support the new VOP process for bulk files before 9 October,” explains Chema Buey, Director Global Client Account Services
Cash Management Products – Client Connectivity at Deutsche Bank Corporate Bank.

He adds: “Also the lack of standardisation across PSPs in the customer-to-bank space for the different VOP solutions will make it very challenging for clients to use bulk VOP in a multibank space in the short term. Therefore, our focus has been to ensure that our clients can continue running their payment business after 9 October by offering a flexible solution for opt-in and opt-out at file level while ensuring minimal impact for those clients who decide to opt out on day one.”

First a sprint – then a marathon

While work is underway at the PSP level to address concerns around technological continuity and opt-in/opt-out standardisation, solving all in time for the 9 October deadline is unlikely. This is why deeper collaboration is needed between PSPs, ERP system providers, and other stakeholders, to identify uniform approaches to VOP processing.

In order to guarantee success, players should focus on defining pan-European approaches to VOP opt-in/opt-out processes (as well as PSP-to-customer VOP responses) – ensuring they are sufficiently standardised to support the multinational and multi-PSP operations of bulk-sending customers. The broader payments ecosystem should also aim to establish more certainty on the possibility, across SEPA, for payers to extend their VOP opt-out to bulk files including only one payment order and the possibility to conduct separate VOP checks in advance of the payment order submission process.

All such moves will serve to meet the high streamlining and automation standards expected by customers.

Yes, a sprint to the VOP deadline is needed now, but after 9 October the momentum must then be to fine-tune solutions and roll out harmonised approaches. That leg of the race will be a collaborative marathon – likely continuing for many months to come.