NEWVenvera speaks your language: the full platform, in English, German, Spanish, Bulgarian, Arabic and Chinese.See what’s new →
Instant Payments Regulation: EMI and PI Checklist
Learn

Instant Payments Regulation: EMI and PI Checklist

·Alexander Sverdlov

If you run compliance at a payment or e-money institution, most of the Instant Payments Regulation already applies to you. The 9 April 2027 date that summaries lead with covers one duty: offering instant credit transfers in euro. Verification of payee has applied to euro-area payment and e-money institutions since 9 October 2025, the rule on charges since 9 January 2025, and daily screening of users since 9 January 2025 for any provider that already offers instant transfers. This checklist shows which duties apply to you today, what falls due on 9 April 2027 and 9 July 2027, and the evidence each one leaves, so you can plan the build and prove compliance on the parts that are already live.

Regulation (EU) 2024/886 was published in the Official Journal on 19 March 2024. It works by amending other acts: it inserted Articles 5a to 5d and a new reporting duty in Article 15 into the SEPA Regulation, (EU) No 260/2012, rewrote the safeguarding article in PSD2 and added PSD2 Article 35a, which opens designated payment systems to payment and e-money institutions. The duties below therefore carry the SEPA Regulation's article numbers.

DutyArticleEuro-area PIs and EMIsPIs and EMIs outside the euro area
Offer instant credit transfers in euro, to receiveArt. 5a(8)9 April 20279 April 2027
Offer instant credit transfers in euro, to sendArt. 5a(8)9 April 20279 July 2027
Charge no more for instant than for other credit transfersArt. 5bSince 9 January 20259 January 2027
Verification of payee for every euro credit transfer, free of chargeArt. 5c, 5b(2)Since 9 October 20259 July 2027
Screen all users at least daily against EU targeted financial restrictive measuresArt. 5dSince 9 January 2025, if you offer instant transfersSince 9 January 2025, if you offer instant transfers
Report charges and sanctions-related rejectionsArt. 15(3)Every 12 monthsEvery 12 months
Safeguarding, now also at a central bank, and access to designated payment systemsPSD2 Art. 10, 35aMember States to apply by 9 April 2025Member States to apply by 9 April 2025
Instant Payments Regulation timetables for euro-area and non-euro-area banks and for payment and e-money institutions, showing receive and send dates, charges parity, verification of payee and screening of users, with the duties already in force marked

Which Instant Payments Regulation duties apply to payment and e-money institutions?

All of them. The Regulation applies to credit transfers in euro where the payer's and payee's providers are in the Union, and Article 5a(1) applies to every payment service provider that offers its users a service of sending and receiving credit transfers. Payment institutions and e-money institutions are payment service providers, and an e-money account that can send and receive transfers is a payment account. What differs for them is timing, and only for one article: Article 5a(8) gives them until 9 April 2027 to offer instant transfers. Articles 5b, 5c and 5d carry their own dates, and none of them has a separate date for payment or e-money institutions.

ArticleWhat it requiresEvidence to keep
5a(1)Offer sending and receiving instant credit transfers to all users, with every account reachable for credit transfers also reachable for instant ones, 24 hours a day on any calendar day.Product and channel inventory; availability records.
5a(3), (4), (5)Treat the order as received at any hour; act on it immediately; credit and confirm within 10 seconds as the payee's provider; tell the payer the outcome free of charge; restore the payer's account if no confirmation arrives in time.Processing logs with timestamps; restoration and reconciliation records.
5a(6)Let users set a maximum per day or per transaction, change it at any time, and refuse orders above it with an explanation.Limit settings and refusal notices.
5a(7)Offer packages of instant orders wherever packages are offered for other transfers, with no lower limits on their size.Channel configuration.
5bCharge no more for instant credit transfers than for other credit transfers of the corresponding type; provide verification of payee free of charge.Price list and the comparison behind it.
5cVerify the payee before the payer authorises any euro credit transfer, and answer verification requests as the payee's provider.Verification logs, notices shown, opt-outs.
5dScreen all users against EU targeted financial restrictive measures immediately after any new or amended measure and at least once every calendar day; no in-flight screening against the same measures.Screening run log, list update log, hits and outcomes.
15(3)Report the level of charges and the share of rejections caused by targeted financial restrictive measures to the competent authority every 12 months.Filed reports and their source data.

When must a payment or e-money institution offer instant credit transfers?

Article 5a(8) sets four timetables. Banks and other providers in the euro area had to receive instant credit transfers by 9 January 2025 and send them by 9 October 2025. Outside the euro area the dates are 9 January 2027 and 9 July 2027. Payment and e-money institutions located in the euro area must both send and receive by 9 April 2027. Those located outside the euro area must receive by 9 April 2027 and send by 9 July 2027.

Two refinements apply outside the euro area. Until 9 June 2028, a provider need not offer instant transfers in euro from accounts in the national currency during the hours when it neither sends nor receives other euro transfers on those accounts. Separately, Article 5a(2) lets an authority permit such a provider, for a year at a time and after assessing its access to euro liquidity, to cap instant transfers sent from national currency accounts outside those hours at a limit of no less than EUR 25,000. A Member State that adopts the euro before 9 April 2027 follows Article 16(9): its providers comply within a year of adoption, and never earlier than the euro-area dates.

Reachability has one safety valve. Article 11(1c) excludes planned maintenance with short, foreseeable downtime, and planned scheme-wide downtime, from the penalties for unreachable accounts, provided users were told in advance. Build that notice into your change process now.

Does verification of payee already apply to payment and e-money institutions?

Yes, in the euro area since 9 October 2025, and outside it from 9 July 2027 (Article 5c(9)). The duty covers every credit transfer in euro, instant or not, in every channel. As the payer's provider you must offer the check immediately after the payer gives the payee's details and before the payer can authorise the transfer:

  • Name and IBAN. Where the payer enters both, you ask the payee's provider to check them. On a mismatch you tell the payer that authorising might send the funds to an account not held by that payee; on an almost match you show the payer the name held on the account (Article 5c(1)(a)).
  • Legal persons. Where your channel lets a payer identify a company by an LEI, a fiscal number or a European unique identifier instead of its name, and the payee's provider holds that identifier, the identifier is checked (Article 5c(1)(b)).
  • Accounts held for several payees. The provider holding the account confirms whether the named payee is among them (Article 5c(1)(c)).
  • Other channels. Where your channel does not require the payer to enter both the identifier and the name, you must still make sure the payee is correctly identified and let the payer validate it before authorising, backed by robust internal procedures (Article 5c(1)(d), (3)).
  • Paper orders. Checked at the time of receipt, unless the payer is not present (Article 5c(4)).

As the payee's provider you must answer those requests for the accounts you hold. The check may never prevent the payer from authorising the transfer (Article 5c(5)). Users who are not consumers may opt out when sending packages of payment orders, and opt back in at any time (Article 5c(6)). Each notice must say that authorising might send the funds to the wrong account, and you must tell users what ignoring a notice means for liability and refunds (Article 5c(7)). The European Payments Council's verification of payee scheme, which providers can join to exchange the checks, returns one of five results: match, close match with the name held on the account, no match, identification code not supported or known, or verification check not possible.

The liability rules are what make the logs matter. A provider that met Article 5c is not liable for executing a transfer to an unintended payee on the basis of an incorrect unique identifier. A payer's provider that failed to run the check must refund the payer without delay where the failure led to a defectively executed transaction, and where the failure was the payee's provider's, or a payment initiation service provider's, that party compensates the payer's provider (Article 5c(8)). Without a timestamped record of each check and each notice, you cannot show which side of that line you are on.

Where you buy verification of payee or screening as a service, the provider supports a function your users depend on every second of the day. It belongs in your DORA register of information, and it needs the same due diligence as any other critical supplier, as set out in our guide to performing a third-party risk assessment.

Verification of payee step by step under Article 5c: the payer enters IBAN and name, the payer's provider asks the payee's provider, the result is a match, an almost match with the real name shown, or no match with a warning, followed by the rules on authorisation, opt-outs, warnings and liability

What does the sanctions screening rule require?

Article 5d(1) requires every provider offering instant credit transfers to check whether any of its users are persons or entities subject to targeted financial restrictive measures, meaning EU asset freezes and prohibitions on making funds available adopted under Article 215 TFEU. The check runs immediately after any new or amended measure enters into force, and in any case at least once every calendar day. Article 5d(2) then forbids the payer's and the payee's providers from screening payer or payee against those same measures while an instant credit transfer is executed. Other restrictive measures, measures not adopted under Article 215, and anti-money laundering duties are unaffected.

The date is 9 January 2025 for every provider that offers instant credit transfers (Article 5d(3)). For a payment or e-money institution, the April 2027 deadline sets when you must offer instant transfers; it does not postpone screening if you already offer them. And this is the one duty with an EU penalty floor: for infringements of Article 5d, Member States must provide maximum administrative fines of at least 10% of total annual net turnover for a legal person, measured on the consolidated accounts of the ultimate parent where there is one, and at least EUR 5,000,000 for a natural person (Article 11(1b)). Penalties for the other articles are set nationally (Article 11(1a)).

Screening under Article 5d: check every user against EU targeted financial restrictive measures at least daily and immediately after new listings, with no in-flight screening of instant payments against the same measures, and fines of at least 10% of turnover for breaches

What has to happen inside the ten seconds?

Article 5a(3) makes the time of receipt the moment the order reaches you, at any hour on any calendar day, with adjusted rules for paper orders, packages and orders from accounts not in euro. From that moment the payer's provider immediately checks that the conditions are met and the funds are available, reserves or debits the amount and sends the transaction on (Article 5a(4)(b)). The payee's provider has 10 seconds from the time of receipt to make the funds available on the payee's account and confirm completion (Article 5a(4)(c)), with the same value date (Article 5a(4)(d)). The payer, and any payment initiation service provider involved, is told the outcome free of charge (Article 5a(4)(e)). If no confirmation arrives within 10 seconds, the payer's provider restores the payer's account immediately (Article 5a(5)).

For a compliance team, the evidence is a processing log with timestamps at each step, a reconciliation of late confirmations so that a restored account is never credited twice, and records of the user-set limits under Article 5a(6). Round the clock availability also changes incident handling: an outage of the instant service at night or at the weekend is an operational or security payment-related incident, and if it is major, the DORA reporting clock runs regardless of the hour, as our guide to DORA major incident classification explains.

Inside the ten seconds of an instant credit transfer: time of receipt at any hour, the payer's provider acting immediately, the payee's provider crediting and confirming within 10 seconds, and the payer's account restored if no confirmation arrives

What does charges parity mean for a payment or e-money institution?

Article 5b(1) prevents any charge on payers or payees for sending or receiving instant credit transfers from exceeding the charge for other credit transfers of the corresponding type, and Article 5b(2) makes verification of payee free for all users. Article 5b(3) dates the article from 9 January 2025 in the euro area and 9 January 2027 elsewhere, with no separate date for payment or e-money institutions. In practice the rule bites the moment you offer instant transfers, so the price list you publish for April 2027 has to comply on day one, and any instant transfers you already offer must comply now.

What do you have to report?

Article 15(3) requires every provider to report to its competent authority, every 12 months, the level of charges for credit transfers, instant credit transfers and payment accounts, and the share of rejections caused by targeted financial restrictive measures, separately for national and cross-border transactions. The Regulation set the first report for 9 April 2025, covering the period from 26 October 2022 to the end of the preceding calendar year. The EBA's implementing technical standards set the templates and your national authority sets how the report is filed, so check its arrangements for the next submission, put the date on your compliance calendar with an owner, and keep the source data that supports it.

Can payment and e-money institutions now join payment systems directly?

They can apply. The Instant Payments Regulation amended PSD2 so that payment and e-money institutions may participate in payment systems designated under the Settlement Finality Directive, which before then were closed to them. Article 35a of PSD2, which Member States had to apply by 9 April 2025, sets the price of entry. You must hold a description of your safeguarding measures, including the investment policy, the people with access to the safeguarding account and the reconciliation that keeps users' funds insulated in insolvency; a description of your governance, internal control and ICT arrangements, linked to Articles 6 and 7 of DORA; and a winding-up plan in case of failure. The ECB states that since October 2025 non-bank providers meeting the TARGET Guideline requirements can access TARGET services, including TIPS, its instant payment settlement service.

Those three documents are worth preparing even if you stay with a sponsor bank, because they are the clearest statement of how your safeguarding actually works. The full safeguarding rules are in our guide to PSD2 compliance requirements, alongside strong customer authentication, complaints and the rest of the Directive.

What the other results get wrong

We checked the pages that rank for the instant payments queries a payment or e-money institution types, and the errors are almost all about dates.

A treasury software vendor's compliance guide says that "from 9 January 2025, however, all EU banks must be able to receive instant payments". Only banks in the euro area had that date; banks in Member States outside the euro area have until 9 January 2027 (Article 5a(8)). The same guide's table gives payment and e-money institutions a charges parity date of 9 April 2027 and credits the table to the ECB. The ECB's own table shows charges parity on 9 January 2025 for the euro area and 9 January 2027 elsewhere, with no separate line for payment or e-money institutions, which matches Article 5b(3).

A law firm's briefing on the start of verification of payee says the Regulation "has introduced as of 9 January 2025 an obligation on all payment service providers (PSPs) operating in the EU to put in place systems enabling them to receive instant credit transfers". That obligation fell on providers in the euro area, excluding payment and e-money institutions, which have until 9 April 2027.

Several guides compress the timetable for payment and e-money institutions into "9 April 2027 in the euro area, 9 July 2027 outside it". Outside the euro area those firms must already receive instant transfers by 9 April 2027; 9 July 2027 is the date for sending. And most of the ranking pages we checked never mention PSD2 Article 35a or the 10% penalty floor for screening failures, the two provisions that change the economics for a non-bank provider.

Where does your firm stand?

Fill this in for each legal entity. A blank answer is a gap, and the right-hand column tells you which article it sits under.

QuestionYour answerRequirement
Is your firm located in a euro-area Member State, and which date applies to you for receiving and for sending instant transfers?Art. 5a(8)
Do you run verification of payee on every euro credit transfer, in every channel, and log each result and notice?Art. 5c(1), (7)
Do you answer verification requests for the accounts you hold as the payee's provider?Art. 5c(1)
Do you offer instant transfers today, and if so, do you screen all users at least daily and after every new listing?Art. 5d(1)
Has in-flight screening against EU targeted financial restrictive measures been removed from the instant flow?Art. 5d(2)
Does your price list charge the same for instant and other credit transfers of the same type?Art. 5b(1)
Can users set and change a maximum per day or per transaction?Art. 5a(6)
Who files the 12-monthly report on charges and rejections, and when is it next due?Art. 15(3)
Do you hold the safeguarding description, governance and ICT description and winding-up plan?PSD2 Art. 35a

How do you keep instant payments compliance in one place?

The Instant Payments Regulation adds duties that run every day, such as screening and verification of payee, a 12-monthly report and a hard deadline in 2027, on top of everything PSD2 already asks. The EU Payments framework in Venvera keeps them with the rest of your payments programme: each requirement with an owner, a status and its evidence, the 12-monthly report and a quarterly review of the daily screening on the compliance calendar, and policy templates for an instant credit transfers operating procedure, a verification of payee procedure and a user sanctions screening procedure. The framework covers 172 requirements in all, with an 81-question gap assessment, so the April 2027 build sits in the same dashboard as safeguarding, strong customer authentication and complaints, instead of a separate spreadsheet. Venvera manages the programme and its evidence; it does not process payments, run verification of payee or screen your customers.

Venvera policy library listing policies with their framework tags, approval status and version
The policy library, shown with EU AI Act, SOC 2 and ISO 27001 policies. The EU Payments framework adds 20 templates, including a verification of payee procedure and a user sanctions screening procedure.
Venvera EU Payments requirements list ordered by what moves the most, each row with its article reference, a readiness score, the documents on file against those expected and a request evidence button
The EU Payments requirements list in a demo workspace, here with PSD2 rows at the top. Each row shows its article, a readiness score and the documents on file against those expected, with a button to request them.

Run the free compliance check for a baseline, book a demo to see the EU Payments framework, or start a 14-day Professional trial with no credit card. How DORA applies to the same firms is covered in DORA for payment institutions.

Frequently asked questions

Does the Instant Payments Regulation apply to e-money institutions?

Yes. E-money institutions and payment institutions are payment service providers, so every article applies to them. The only difference is timing for Article 5a: they must offer instant credit transfers by 9 April 2027, or, outside the euro area, receive by 9 April 2027 and send by 9 July 2027.

When do payment institutions have to offer instant payments?

In the euro area, sending and receiving by 9 April 2027. Outside the euro area, receiving by 9 April 2027 and sending by 9 July 2027 (Article 5a(8) of Regulation (EU) No 260/2012).

Does verification of payee apply to payment institutions before 2027?

Yes. Article 5c has no separate date for payment or e-money institutions. Euro-area providers have had to verify the payee since 9 October 2025; providers outside the euro area must do so by 9 July 2027.

Is verification of payee only for instant payments?

No. It applies to every credit transfer in euro, instant or not, and in every channel the payer uses to place the order, including paper orders when the payer is present.

Can a payer still send the money after a no-match result?

Yes. Article 5c(5) forbids the check from preventing authorisation. The payer must be told that authorising might send the funds to an account not held by that payee, and what ignoring the notice means for liability and refunds.

Can business customers opt out of verification of payee?

Only users that are not consumers, and only when they submit multiple payment orders as a package. They must be able to opt back in at any time, and must be told the same warning about where the funds might go (Article 5c(6), (7)).

Do payment institutions have to screen users daily before they offer instant transfers?

Article 5d applies to providers offering instant credit transfers, from 9 January 2025. A payment or e-money institution that already offers them must screen all users at least daily and after every new or amended listing; the April 2027 date sets when you must offer instant transfers and does not postpone screening.

How fast must an instant credit transfer be completed?

The payee's provider must make the funds available and confirm within 10 seconds of the time the payer's provider received the order. Without that confirmation, the payer's provider restores the payer's account immediately.

Can we charge more for instant transfers than for normal transfers?

No. Article 5b(1) caps charges for instant credit transfers at the level of other credit transfers of the corresponding type, and verification of payee must be free for all users.

What are the penalties under the Instant Payments Regulation?

Member States set them. For the screening duty in Article 5d, they must provide maximum fines of at least 10% of total annual net turnover for a legal person and at least EUR 5,000,000 for a natural person (Article 11(1b)).

Primary sources

Duties and dates are taken from Articles 5a to 5d, 11, 15 and 16(9) of Regulation (EU) No 260/2012 as amended by Regulation (EU) 2024/886, and from Articles 10, 35 and 35a of Directive (EU) 2015/2366 as amended by the same Regulation. The implementation table and the access of non-bank providers to TARGET services are from the European Central Bank's Instant Payments Regulation page, and the scheme result codes from the European Payments Council's Verification Of Payee Scheme Rulebook. Check your national authority's reporting arrangements before relying on a specific date.

Alexander Sverdlov

Alexander Sverdlov

CEO & Founder

Alexander is the founder of Venvera and a 20+ year veteran of European cybersecurity and compliance. He has led security and risk programmes for regulated financial institutions, fintechs and SaaS companies operating under DORA, NIS2, GDPR, ISO 27001 and the EU AI Act. Before Venvera, he founded Atlant Security, an offensive security consultancy that ran penetration tests, red-team exercises and ISO 27001 readiness programmes for clients across the EU and the Middle East. He writes on the cross-framework realities of running modern compliance: how to map one control to many obligations, where the spreadsheets fall apart, and what regulators are actually asking for once the auditor sits down.

More articles by Alexander →

CONTINUE READING