The European Union is building an automated system for controlling transfers and identifying the parties to a transaction. Two acts anchor it: Regulation (EU) 2024/886 (the Instant Payments Regulation), which made Verification of Payee mandatory in the euro area from 9 October 2025, and Regulation (EU) 2024/1624 (AMLR), which applies from 10 July 2027. The stated aim is to curb fraud and money laundering. The practical effect is different: it is legitimate, cross-border capital that will carry the heaviest documentation and verification burden.
| Legal act | Adopted | Key application date |
|---|---|---|
| Regulation (EU) 2024/886 — Instant Payments Regulation | 13 March 2024 | VoP: euro area 9 Oct 2025, non-euro area 9 Jul 2027 |
| EPC Verification of Payee Scheme Rulebook | v1.0 — in force from 5 Oct 2025 | v1.1 effective from 20 Sep 2026 |
| Regulation (EU) 2024/1624 — AMLR | 31 May 2024 | Applies from 10 Jul 2027 |
| Directive (EU) 2024/1640 — AMLD6 | 31 May 2024 | Transposition by 10 Jul 2027 |
| Regulation (EU) 2024/1620 — AMLA | 31 May 2024 | Authority operational since 1 Jul 2025 |
What already applies? The Instant Payments Regulation and Verification of Payee
The central act for transfers themselves is Regulation (EU) 2024/886 of 13 March 2024, the Instant Payments Regulation (IPR). It was published in the Official Journal of the EU on 19 March 2024 and entered into force on 8 April 2024. The IPR amends, among others, the SEPA Regulation (260/2012), the Cross-Border Payments Regulation (2021/1230), the Settlement Finality Directive (98/26/EC) and PSD2 (2015/2366).
Its key element is the obligation to offer a Verification of Payee (VoP) service. The provision introduced by the IPR requires a payment service provider to offer the payer a service that, before a transfer is authorised, checks whether the payee's name matches the account identifier. The service is free of charge to the payer.
Implementation runs on a staggered timeline:
| Provider group | Mandatory VoP deadline |
|---|---|
| Providers in the euro area | 9 October 2025 |
| Providers outside the euro area (EEA) | 9 July 2027 |
The payment system stops being "blind" to payee data. Where the name and account do not match, the user receives a result: match, close match, no match, or verification not possible. The transfer can still be authorised despite a warning — but liability for funds reaching the wrong recipient then shifts to the payer. In practice this raises the bar for formal correctness on every transfer.
What is being rolled out now? The EPC Rulebook and the AMLR
In parallel, the technical and operational standard is maturing. The European Payments Council (EPC) published the Verification of Payee Scheme Rulebook: version 1.0 entered into force on 5 October 2025, and version 1.1 (EPC218-23) becomes effective on 20 September 2026. This confirms that VoP is no longer a concept but a live piece of payment infrastructure with its own change cycle.
On the AML side, the foundation is Regulation (EU) 2024/1624 (AMLR) of 31 May 2024. Here it is worth separating two terms that are easy to conflate: the regulation entered into force on 9 July 2024 but will apply only from 10 July 2027. The market gets three years to adapt. Crucially, the AMLR shifts the weight from directives to directly applicable EU law — the same rules apply from Frankfurt to Warsaw to Lisbon.
The AMLR does not stand alone. It is accompanied by Directive (EU) 2024/1640 (AMLD6) — the institutional and supervisory layer transposed at national level — and by Regulation (EU) 2024/1620, which establishes the EU Anti-Money Laundering Authority (AMLA), headquartered in Frankfurt and operational since 1 July 2025.
How do the due diligence thresholds and cash rules change?
The AMLR tightens practical CDD/KYC thresholds and obligations. The main changes:
| Area | Previous position | Under AMLR (from 10 Jul 2027) |
|---|---|---|
| CDD threshold for occasional transactions | EUR 15,000 | EUR 10,000 (including linked transactions) |
| Cash payment limit | National thresholds, divergent | Uniform EU limit of EUR 10,000 |
| Beneficial owner (UBO) threshold | More than 25% | 25% or more |
| Scope of obliged entities | No crypto | + crypto-asset service providers, crowdfunding, high-value goods dealers |
Add to this expanded identification of beneficial owners and PEPs, plus an obligation of ongoing, risk-based monitoring of business relationships. Lowering the UBO threshold from "more than 25%" to "25% or more" is not cosmetic — a person holding exactly 25% of the shares, previously off the radar, must now be identified and verified.
What is the target model?
The target model is simple: every payment should be more identifiable, more comparable and easier to check automatically. In practice this means three layers combined — verification of the payee at the transfer itself, broader AML/KYC obligations on institutions, and greater standardisation of data across the whole payment chain.
So this is not merely about "checking an IBAN." It is a system in which banks, fintechs, bureaux de change and payment platforms have ever less tolerance for unclear data, weak documentary consistency and non-standard capital flows. It strengthens formal control over the flow of funds — while narrowing the room for entities that need to move legitimate capital quickly between jurisdictions.
Why does this hit legitimate capital hardest?
The paradox is that criminals usually look for workarounds outside the official system anyway, while legitimate capital moves precisely inside the system that is being loaded with control. It is honest businesses, investors, advisers, holding companies and firms with cross-border clients that will have to supply more data, explain more transactions and maintain better documentation.
For legitimate capital this means three things: a higher cost of compliance, longer operational timelines, and more situations where a payment can be delayed, held or challenged on formal grounds — even when the transaction itself is entirely lawful.
This does not mean the rules are pointless. It means their real cost is spread unevenly. Those who want to hide funds move to less transparent channels. Those who operate lawfully stay in the system and absorb the added bureaucracy. It matters directly when moving capital to accounts in the UAE, where consistency between the business model and the actual flows determines whether a bank lets a transfer through without questions.
What should cross-border firms do?
For firms receiving transfers from clients, this means putting several areas in order at once: name consistency on invoices and accounts, customer identification procedures, document retention, risk assessment, and readiness for bank queries. In cross-border activity, what matters is coherence between the real business model and the flows on the accounts — precisely what, in UAE structures, is examined as genuine economic substance.
It is worth remembering that payee verification does not replace KYC or AML. These are two different levels of control: one at the payment stage, the other at the level of the customer relationship. Firms should expect banks to ask not only "who is paying?" but also "for what, on what basis, and why in this way?". For entrepreneurs planning to move assets out of the EU, that is an argument for getting the documentation in order before the transfer starts, not during an audit.
In short: The Instant Payments Regulation (EU 2024/886) already forced payee verification in the euro area (from 9 Oct 2025), and the AMLR (EU 2024/1624), from 10 Jul 2027, will harmonise and tighten AML rules across the EU — lowering the CDD threshold to EUR 10,000 and introducing an EU-wide cash limit of EUR 10,000. The heaviest burden falls on legitimate, cross-border capital that stays in the official system. For firms weighing a UAE structure, documentary discipline is no longer optional.
Key legal acts — summary
- Regulation (EU) 2024/886 (Instant Payments Regulation, 13 Mar 2024) — introduces mandatory Verification of Payee (VoP).
- EPC Verification of Payee Scheme Rulebook — the operational VoP standard; v1.0 from 5 Oct 2025, v1.1 from 20 Sep 2026.
- Regulation (EU) 2024/1624 (AMLR, 31 May 2024) — directly applicable EU AML rules, applying from 10 Jul 2027.
- Directive (EU) 2024/1640 (AMLD6, 31 May 2024) — the institutional and supervisory pillar of the package.
- Regulation (EU) 2024/1620 (AMLA, 31 May 2024) — the EU AML authority, operational since 1 Jul 2025.
FAQ
What is the difference between Verification of Payee (VoP) and KYC/AML? Two different levels of control. VoP works at the payment stage and only checks whether the payee's name matches the account number. KYC and AML work at the level of the customer relationship and cover identification, risk assessment and monitoring. A positive VoP result does not discharge AML obligations.
When does Verification of Payee become mandatory? For euro-area providers, from 9 October 2025. For providers outside the euro area, from 9 July 2027. The legal basis is Regulation (EU) 2024/886.
Will a transfer be blocked if the name does not match the account number? Not automatically. The payer receives a verification result and can authorise the transfer despite a warning — but then takes on liability for funds reaching an unintended recipient.
When does the AMLR start to apply? It entered into force on 9 July 2024 and will apply from 10 July 2027. Certain provisions (football clubs and agents) apply from 10 July 2029.
What is the EU cash payment limit? A uniform EUR 10,000 limit for cash payments in commercial transactions, including linked transactions. Member States may introduce lower national limits.
Does the AMLR apply to non-EU firms? Yes, for activity carried out within the EU — branches, subsidiaries, or the provision of regulated services into the EU. It also widens the list of obliged entities to include crypto-asset service providers.