Verification of Payee (VoP) Requirements (Part 1): Implications of EU's Instant Payments Regulation in Norway
In March 2024, the EU adopted an Instant Payments Regulation (IPR) ((EU) 2024/886) that amends the SEPA Regulation (EU No. 260/2012). IPR introduced a new verification of payee (VoP) requirement for euro-denominated credit transfers.
Article 5c of the amended SEPA Regulation now mandates that payment service providers (PSPs), e.g., banks, offer the payer a service ensuring verification of the payee before executing a credit transfer in euro. In practice, this means a payer’s bank must check whether the account identifier (e.g. IBAN) and the payee’s name match, and the bank must alert the payer to any discrepancy before the payment is sent. This confirmation-of-payee service must be offered for both standard and instant euro credit transfers and provided free of charge to the payer. The goal is to reduce misdirected payments and fraud by ensuring the transfer is going to the intended recipient.
Notably, these VoP obligations apply only to credit transfers denominated in euros. The regulation is binding in EU Member States for euro payments, but it does not automatically extend to domestic transfers in other currencies. In fact, the IPR explicitly states that countries with non-euro currencies may choose whether to apply similar rules to their own currency. Recital 4 of the IPR states that “Member States whose currency is not the euro should be able to apply equivalent rules” as laid down in the IPR to instant credit transfers in their domestic currency – indicating this is optional, not mandatory. Thus, the IPR leaves room for national authorities to decide on VoP for other currencies.
The IPR has not yet been incorporated into the EEA Agreement and consequently has not been transposed into Norwegian law. The timeline for its incorporation remains uncertain. Bits AS—a financial infrastructure company owned by Finance Norway (the Norwegian Banking Association)—has indicated that this incorporation is likely to occur in 2026 or 2027. Although the IPR sets an implementation deadline for VoP obligations of July 9, 2027, for countries whose currency is not the euro (such as Norway), the actual process of integrating IPR into Norwegian law may extend beyond this date.
Norwegian Law on Payee Verification for NOK Transfers
Currently, Norwegian law does not impose any VoP-style obligation on PSPs for NOK-denominated payments. There is no domestic legal provision equivalent to Article 5c that requires Norwegian banks or payment institutions to verify the payee’s name against the account number for NOK payments.
On the contrary, the Norwegian implementation of EU payment services law has long followed the principle established by the Payment Services Directive that a payer’s unique account identifier - such as an account number or IBAN - is sufficient for PSPs to be authorised to execute a payment. Under Norwegian regulation, specifically through the Financial Contracts Act (Finansavtaleloven, section 4-26, which implements article 88 of PSD2) provides that if a bank executes a payment to the account number specified by the payer, the payment is considered correctly executed – even if the name of the payee given by the customer does not match the account holder. This means that banks are not legally required to cross-check the recipient’s name against the account number before completion of a transfer. In fact, the Financial Contracts Act explicitly states that a PSP has no duty to verify that the unique identifier corresponds to the intended payee’s name. The rationale is that the account number/IBAN is treated as the definitive identifier for the transaction; if the customer provides an incorrect account number, the PSP is generally not liable for the payment going to the wrong account, and any accompanying name is not binding on the execution of the payment. Essentially, this legal framework runs counter to a verification-of-payee requirement by effectively disclaiming any obligation on the PSP to ensure the name matches.
In practice, this means if a customer mistypes an account number but enters the correct payee name, the bank’s system will not catch that mistake – the payment will go to whatever account number was entered, as there is no automatic name confirmation. Likewise, if fraudsters trick someone into sending money to an account under a false name, the bank has no legal mandate to detect that mismatch before executing the NOK transfer.
Thus, no Norwegian law or regulation currently obliges PSPs to implement a VoP service for NOK transactions. Neither the Norwegian FSA (Finanstilsynet) nor the Norwegian Central Bank (Norges Bank) has issued any rule akin to Article 5c for domestic payments. The focus of Norwegian payment legislation thus far has been on execution speed, security (e.g. anti-money laundering checks), and consumer rights (e.g. refund mechanisms), rather than proactive name verification. For NOK transfers, the onus remains on the payer to ensure that the account number and beneficiary details they input are correct. The PSP’s responsibility is to execute the payment accurately per the provided account details; there is no statutory requirement to double-check that the name corresponds to the account.
Payments in NOK will likely only be subject to a VoP requirement once the proposal for the Payment Services Regulation (PSR) is implemented in the EU and transposed into Norwegian law. Currently, the PSR proposal is in trilogue negotiations and is expected to be enacted by the EU in 2025/2026. If this timeline holds, the regulation would likely be transposed into Norwegian law in 2027/2028.
Practical Implications for PSPs in Norway
Because there is no VoP requirement for NOK transactions, Norwegian payment service providers do not systematically perform payee-name matching as part of their payment processing for domestic credit transfers. When a customer initiates a bank giro or an online transfer in NOK, the bank will process it using the account number (or IBAN) supplied. As described above, in practice, payment systems in Norway are built to rely on account numbers as the unique key. The beneficiary’s name and address are typically recorded and passed along with the payment instruction for reference, but they are not used as criteria to authorize or validate the transfer. If all other details (account number, bank code, etc.) are in order, the payment will be executed even if, for example, a typo was made in the payee’s name.
The absence of a legal VoP requirement means that Norwegian banks (or more generally, PSPs) have no legal liability for failing to catch a mismatch between the payee name and account number prior to execution. Under Norwegian law, if a payment is sent to the wrong account because the payer provided an incorrect identifier, the bank is not automatically at fault as long as it sent the money to the account number indicated. The bank’s obligation in such cases is generally limited to making reasonable efforts to help recover the funds (e.g. contacting the receiving bank to facilitate a return of the money), rather than having prevented the error in the first place by name verification.
As a result, PSPs in Norway process NOK payments without any mandated name-confirmation step. Customers are typically advised to double-check account numbers themselves, since errors can lead to funds being misdirected. Although some banks may provide advisory warnings or perform minor checks—such as flagging an invalid account number format or alerting if the payee appears under a different name in the bank’s system—these measures are voluntary rather than regulatory mandates.
However, it is worth noting that to mitigate risks associated with relying solely on a payer’s unique account identifier (like an account number or IBAN) to execute payments, the Norwegian financial industry has voluntarily established the "Konto- og adresseringsregisteret (KAR)" (Account & Address Register). Notably, KAR does not impose a VoP-style obligation on PSPs for NOK-denominated credit transfers. Part 2 of this newsletter will describe this register in greater detail.
To illustrate, if a Norwegian customer attempts to transfer 10,000 NOK and mistakenly swaps two digits in the recipient’s account number, the bank’s system will likely accept the payment as long as the number passes basic validation (e.g. the MOD11 checksum on Norwegian account numbers). The payment will credit whatever account corresponds to that mistyped number. The fact that the name on the transfer order doesn’t match the actual account holder won’t automatically stop the payment – since no legal obligation compels the bank to compare them, the discrepancy might only be discovered after the fact (for instance, if the intended beneficiary reports not receiving the money). At that point, the sending bank can initiate a trace or recall procedure, but the sender has no legal entitlement to an automatic refund from the bank in the way they would if the bank itself had made an error. This scenario underscores how Norwegian PSPs currently operate under a “IBAN-only” verification regime for NOK transfers, in contrast to the forthcoming name-check requirements for credit transfers in euro.
For more detailed insights or tailored advice on how the IPR might impact your operations, please contact us. We are here to help you navigate the evolving landscape of payment services regulation.
