If merchants you serve have ever reported that their customers are unable to complete bank transfers to an overseas account within the eurozone, they could be experiencing IBAN discrimination. This issue creates significant barriers to business growth across Europe and often leaves the Payment Service User (PSU) unaware of the underlying cause of payment failures.
IBAN discrimination was made illegal in 2014 by European regulators in the hope that it would prevent barriers to cross-border trade within the eurozone. However, it still occurs, but regulation is still being developed to finally bring it to an end.
In this article, we examine exactly what IBAN discrimination is, why it occurs, and what is being done to stop it.
What is IBAN discrimination?
An IBAN — or International Bank Account Number — is an identifying code that enables banks and other Financial Institutions (FIs) to process payments internationally. IBAN discrimination is when a bank or FI prevents a transaction from being completed due to the country code of one party’s IBAN, essentially discriminating because of the location of the sending or receiving bank. These two-letter codes at the beginning of an IBAN indicate the country of the issuing bank, for example, ES - Spain, FR - France, MT - Malta. Banks and FIs may establish rules that prevent payments to IBANs with particular country codes. Alternatively, they may prevent payments to, or from, any IBAN that was issued outside of the country they operate in.
An example of IBAN discrimination would be if a customer in Portugal creates an account on an investment platform. The customer then attempts to top-up their investment wallet, but cannot because the platform has issued IBANs from its own issuing bank, which is based somewhere that the bank deems to have less strict fraud prevention regulations, such as Lithuania. The customer’s bank signals that money is being transferred to an account with a Lithuanian IBAN, and marks it as suspicious which then triggers the suspension of the transaction.
Some bank transactions may be rejected automatically, while others may have manual intervention which marks activity as suspicious.
The main impact of IBAN discrimination on PSPs is customer frustration and a negative payment experience, discouraging PSUs from using a service. IBAN discrimination often disproportionately affects high-risk industries like crypto and iGaming. However, it’s important to note that it can also hinder payments in a wide range of sectors, including online marketplaces and e-commerce websites operating across European borders.
Why was IBAN discrimination made illegal?
A central aim of the EU is to promote cohesion between European states. A large part of this relates to trade, so legislators will always look for ways to facilitate the movement of goods and money across borders.
As explained in a 2020 communication from the European Commission: “The Commission’s vision for the EU’s retail payments is that all market participants are able to compete on fair and equal terms to offer innovative and state-of-the-art payment solutions in full respect of the EU’s international commitments.”
IBAN discrimination is therefore counter to what European legislators are trying to achieve. It not only acts as a trade barrier, but it does so in a way that disadvantages certain member states over others, not allowing for ‘fair and equal’ competition.
When passed, the legislation determined that individual EU countries would be able to determine the penalties and minimum fines for businesses that commit IBAN discrimination within their borders, leading to a widely varying range of €250 to €10,000 and maximum fines from €3,500 to €10 million across the bloc. In some countries, companies can be fined as much as 10% of annual turnover.
While the legal framework was established, the reality on the ground is more complex. Several factors contribute to the continued occurrence of IBAN discrimination.
Why does IBAN discrimination still occur?
Protecting customers’ money is a core principle of banking, and banks and other FIs have a responsibility to determine their own risk profiles and security protocols. Considering payments fraud across Europe amounted to €4.3bn in 2022, it’s understandable that banks want to exercise a substantial degree of caution when processing payments. They have a responsibility to do whatever they can to mitigate risk and do not want to lose the trust of their customers by authorising fraudulent payments. A bank’s duty of care to protect their customers’ money usually supersedes their willingness to take risks solely to meet regulations. Additionally, investigating fraudulent activity and potentially paying out compensation to customers is a cost they want to avoid.
A major root of the problem is that regulatory and security standards differ across European countries, and as such, certain countries have become associated with higher levels of fraudulent payments. At the very least, certain countries have a higher risk of fraud, due to varying standards of anti-fraud protections and security protocols across different jurisdictions. While all countries must meet certain EU-wide regulatory standards outlined by the European Payments Council to be a member of SEPA, banks may feel they require additional measures to protect themselves and their customers from heightened risk.
For many banks, old habits die hard, and IBAN discrimination has been a long-standing way to provide a cost-efficient and simple way to seemingly reduce the risks of fraud.
Additionally, regulators have yet to enforce significant penalties to prevent or dissuade banks from practising IBAN discrimination. There is no specific penalty for banks that practice IBAN discrimination and fines have not been issued to reflect the number of complaints. The European Court of Auditors states ‘regulatory loopholes’ as a key challenge, such as the increased use of virtual IBANs, which Anna Martin, Head of financial services at European consumer organisation BEUC says “makes fraud prevention and resolution more difficult and creates confusion for consumers about their legal protections”.
IBAN discrimination has therefore continued to frustrate consumers and businesses, while banks have not been given a reasonable substitute for this fraud prevention method.
That may now be changing.
What is now being done to stop IBAN Discrimination?
European regulators have realised that more needs to be done to support banks and FIs in maintaining financial security, while simultaneously improving payment experiences for end users and businesses. The Instant Payment Regulation (IPR) is new legislation that takes a substantial step in the right direction.
The IPR will ultimately make instant payments accessible (and effectively free) across all of Europe, requiring banks and FIs to offer and accept SEPA Instant payments. You can read more about the IPR and what it means for PSPs in our recent blog post.
But the IPR is not only about settlement speeds, it also has a strong focus on developing fraud protections. A key element of the legislation is that banks and FIs must offer Verification of Payee (VoP) for bank transfers. With VoP, a recipient’s details are automatically checked with the receiving bank before payment is processed. This reduces the risk of fraudulent activity — particularly authorised push payment fraud (APP fraud) and minimises the risk of payments being sent to the wrong account due to typos or incorrect details. As such, the requirement to include VoP should lead to banks and FIs reassessing their anti-fraud protocols, including preventing transactions due to a sending or receiving account’s IBAN country code.
How and when will VoP be introduced?
All PSPs operating in euros will need to implement VoP by October 2025. Open banking providers like Yapily enable you to enhance the VoP process by providing more secure and direct methods of payment verification. This includes using secure customer authentication (SCA) and encrypted API connections. Banks can therefore feel more confident that payments to IBANs in different countries have significantly stronger fraud prevention.
Steps you can take as a PSP to combat IBAN discrimination
If any of your customers’ PSUs report IBAN discrimination or unexpected payment failure, they should be encouraged to report it to their bank. Sometimes, banks don’t even know about the illegality of IBAN discrimination, and reporting it directly can be one of the best ways to raise this awareness and combat it.
Consumers and businesses, including PSPs, can also report their or their customers’ experiences to Accept My IBAN — a group of businesses and organisations within European fintech that is attempting to streamline the process of reporting IBAN discrimination to the relevant authorities.
Accept My IBAN has highlighted that this issue has persisted partly because regulators themselves are not receiving many complaints. The group claims that this is principally because most customers do not know where to report their complaints, especially as they may have to do so in a foreign language. Accept My IBAN is therefore attempting to highlight how common this problem is to regulators on their behalf.
Manual reporting is useful, but not an ideal way forward. It should not be consumers’ and businesses’ responsibility to enforce regulation that has been agreed on a multi-national level.
A collective approach to move financial services forward
Across financial services, we need an approach that accelerates the introduction of better payment services across Europe while respecting banks’ needs to uphold their security standards. Legislation such as the IPR and technological advancements like open banking show that there are innovative ways this can be done, it’s just about rolling them out at scale
However, banks must also play their part in ensuring they incorporate technology that can help them bolster their fraud prevention while reducing payment friction for their customers. The widespread availability of VoP should be a positive step forward, and with similar advances in technology, we can create a unified payment system across the EU that is both advanced and lower-risk for consumers, merchants, and banks.
