The European regulation (EU) 2024/886, applicable since October 9, 2025, has made it mandatory to verify the name of the beneficiary associated with an IBAN for euro transfers within the SEPA zone. This requirement fundamentally changes control practices, but it does not eliminate the structural limits related to banking secrecy and the geographical coverage of the system.
Verification of Payee SEPA: what the regulation changes concretely
The mechanism imposed by the regulation relies on an automated comparison between the name of the beneficiary entered by the sender and the one registered with the receiving bank. The payment service provider must offer this control free of charge, for both standard and instant transfers.
The result returned is limited to four possible responses: match, close match, no match, or verification impossible. No complete identity is transmitted to the sender. The system alerts but does not automatically block the transfer.
We regularly find information on Guide Banque detailing practical cases of this verification for individuals as well as for professionals.
A technical point that most mainstream articles do not address: the implementation timelines are staggered according to the country and type of provider. Not all institutions in the euro area are yet operational on this control, which creates temporary disparities depending on the beneficiary’s bank.
Actual scope of IBAN verification outside the SEPA zone
The obligation to verify name-IBAN concerns exclusively providers established in the European Union or the EEA, for transfers denominated in euros and falling under the SEPA framework. A transfer to an account held with an institution located outside this scope may not benefit from any automated comparison.
In practice, this means that a euro transfer to a Swiss IBAN, a post-Brexit British IBAN, or one issued by a non-EEA electronic money provider, potentially escapes any beneficiary verification. The risk of fraudulent transfers therefore remains significant in these scenarios.
For companies dealing with international flows, we recommend not to rely solely on the SEPA regulatory framework. Verification solutions through direct banking inquiry (SWIFT gpi, for example) or open banking cover a broader scope but are not standardized and depend on bilateral agreements between institutions.
Limits of IBAN control in the face of manipulation fraud
The 2025 report from the Payment Means Security Observatory highlights a marked increase in manipulation fraud. The classic scenario remains the scam involving fake suppliers or fake banking advisors, where the victim themselves transmits a fraudulent IBAN after being deceived by social engineering.
The verification of the beneficiary’s name does not protect against this type of fraud when the fraudster has opened an account in their own name (or in the name of a shell company). The name-IBAN pair is then technically consistent, and the control returns a positive match.
Three situations where automated verification is insufficient:
- The fraudster uses a virtual IBAN issued by an electronic money provider, linked to a verified identity but diverted from its original use.
- The legitimate beneficiary has recently changed banks, and the old IBAN is recycled or reassigned, generating a misleading close match.
- The transfer targets a country where the receiving provider has not yet deployed the verification mechanism, systematically returning “verification impossible”.
A “verification impossible” result does not mean that the IBAN is fraudulent, but it imposes heightened vigilance: direct call to the beneficiary on a known number, cross-referencing with a bank identity document (RIB) obtained through a separate channel.
Manual IBAN control: what the technical structure reveals
Before any beneficiary verification, the very structure of the IBAN allows for the elimination of clearly invalid coordinates. The first two letters identify the country (FR for France), followed by two control digits calculated according to the ISO 7064 standard (modulo 97). An IBAN whose control key does not correspond to the sequence of the account number is necessarily erroneous.
In France, the following characters allow for the identification of the banking institution (five-digit bank code) and the branch (five digits). This information is public and can be consulted in the directories of institutions from the Banque de France. Identifying the bank does not equate to identifying the holder, but it allows for the detection of an IBAN inconsistent with the information declared by a supplier or partner.
For foreign IBANs, the length varies by country. A German IBAN has a different number of characters than a Spanish IBAN. Checking the expected length against the country code detects gross input errors even before requesting a validation service.
IBAN verification strategy in business: combining layers
We observe that the best-protected companies overlay several levels of control rather than relying on a single mechanism:
- Automated syntax control (validity of the key, length, country code) at the entry in the ERP or treasury software.
- Verification of the beneficiary via the mandatory SEPA system for euro transfers within the EEA.
- Documentary cross-referencing: request for a signed or stamped RIB, comparison with the historical banking details of the third party.
- Systematic callback whenever there is a change in banking details, on a previously registered phone number.
The change of banking details is the most critical moment in the payment cycle. The majority of fake supplier frauds occur precisely at this stage, when vigilance relaxes in the face of a request that seems administrative.
The SEPA regulatory framework represents an additional safety net, not a substitute for internal control. Results such as “close match” or “verification impossible” must trigger an investigation process and should never be ignored to expedite a payment.
