Instant Payments Regulation (IPR)

Why did EMIs and payment institutions get until 9 April 2027?

Before the IPR, payment institutions and e-money institutions could not be direct participants in a system designated under the Settlement Finality Directive, and therefore could not join TIPS or RT1 directly. Article 4 of Regulation 2024/886 amended the definition of "institution" in Article 2(b) SFD to include them, and Article 3 amended PSD2 in parallel: safeguarding brought closer to credit-institution standards, non-discriminatory indirect access, and a new Article 35a requiring applicants for direct participation to demonstrate safeguarding, governance and a winding-up plan.

Member States only had to transpose that by 9 April 2025. So the co-legislators gave PIs and EMIs a two-year runway to build or procure reachability.

But the deferral is narrow. It is drafted as "Notwithstanding the first/second subparagraph" and displaces Article 5a only. It does not displace Article 5d, which says flatly that PSPs shall comply by 9 January 2025. Nor does it displace Articles 5b or 5c for a PI or EMI that already offers euro credit transfers. A Dutch payment institution has been under the Verification of Payee obligation since 9 October 2025, even though its instant-payments capability is not due until 9 April 2027.

Verification of Payee

The obligation

Article 5c(1) requires the payer's PSP to perform the verification "immediately after the payer provides relevant information about the payee and before the payer is offered the possibility of authorising that credit transfer", and to offer it "regardless of the payment initiation channel".

Three structural points decide implementation. It applies to all credit transfers in euro, not only instant ones. Article 5c sits in the SEPA Regulation and is not conditioned on the transfer being instant, which is the single most commonly missed point in the whole file. It is free of charge to all payment service users (Art. 5b(2)). It must not block the payment: Article 5c(5) requires PSPs to ensure that performing the verification "does not prevent payers from authorising the credit transfer concerned."

The liability shift

Article 5c(8) is the commercial core, and it works in four steps.

• A PSP keeps the PSD2 Article 88 unique-identifier shield, the rule that a payment executed in accordance with the unique identifier is deemed correctly executed, only "provided that it has fulfilled the requirements of this Article." Fail the verification duty and you lose the shield.
• Where the payer's PSP fails to comply and that failure results in a defectively executed transaction, the payer's PSP "shall without delay refund the payer the amount transferred" and restore the debited account.
• Where the root cause was the payee's PSP or a payment initiation service provider, that party compensates the payer's PSP for the financial damage caused.
• Any further financial loss to the payer is left to the contract and applicable national law.

Two things follow. The remedy is restitutionary and immediate, not a damages claim, and it sits with the payer's PSP regardless of whose fault it was; inter-PSP recovery comes afterwards. And the IPR does not convert authorised push payment fraud into an unauthorised transaction. The PSD2 Articles 73 and 74 regime is a separate route. That fourth step, consequential loss such as interest, FX and business loss, is a real commercial exposure that most PSP terms do not yet address.

The bulk-file opt-out

Article 5c(6) requires PSPs to provide non-consumer users with the means to opt out when submitting multiple payment orders as a package, with a right to opt back in at any time. Three consequences most implementations miss: it is not available to consumers; it is not available for single orders from a corporate; and the PSP must actively provide the means, passively omitting verification is non-compliance on its own. Article 5c(7) requires the warning about liability and refund rights to be given at the point of opt-out.

Sanctions screening: the obligation that reverses a control

Article 5d is the most under-covered part of the file, because it is drafted as a prohibition, not a permission.

Article 5d(1): PSPs offering instant credit transfers must verify whether any of their users are subject to targeted financial restrictive measures, "immediately after the entry into force of any new" measure or amendment, and at least once every calendar day.

Article 5d(2): during execution of an instant credit transfer, the payer's and payee's PSPs "shall not verify" whether the payer or payee are subject to targeted financial restrictive measures in addition to the paragraph 1 checks.

Continuing per-transaction targeted-sanctions name screening on instant legs is therefore not conservative compliance. It is non-compliance with Article 5d(2), and Article 5d breaches carry the heaviest penalty tier in the Regulation: a maximum administrative fine of at least 10% of total annual net turnover.

What still must be screened transaction by transaction:

• Non-instant credit transfers. Article 5d does not touch them.
• Non-targeted restrictive measures, sectoral measures, asset-type, goods, services and geographic prohibitions, export-control-linked payment bans. Article 5d(2) is expressly limited to targeted financial measures against the payer or payee.
• AML and CFT transaction monitoring, expressly preserved by the final sentence of Article 5d(2).
• Third parties in the message, an ultimate debtor, an ultimate creditor, remittance references, intermediary agents. The disapplication covers only "the payer or the payee whose payment accounts are used."
• One-leg-out and non-euro legs, outside the SEPA Regulation's scope.

The supervisory instrument is the rejection-share report: PSPs report the share of instant credit transfers rejected because of targeted financial restrictive measures, split domestic and cross-border. A high rejection share is the flag. Article 15(2)(b) also requires the Commission, by 9 October 2028, to evaluate "the scope of Article 5d and its effectiveness in preventing unnecessary hindering of instant credit transfers." The article is explicitly under review.

Is there still a €100,000 limit?

No. The €100,000 cap was a scheme rule of the SCT Inst rulebook, not a legal one, and it was removed with the 2025 rulebook effective 5 October 2025: "There is no longer a maximum amount set at scheme-level for SCT Inst transactions." The Regulation never imposed the cap.

What it does impose: Article 5a(6), the user, not the PSP, may set limits on a per-day or per-transaction basis, at the user's sole discretion, modifiable at any time before placing an order. Article 5a(7), where a PSP offers package submission for regular transfers it must offer it for instant transfers, and the package limits cannot be lower for instant. Read with PSD2 Article 68, any PSP-set limits must be common to both regular and instant transfers.

The only monetary figure in the operative text is the €25,000 floor in the non-euro-area derogation under Article 5a(2).

Differences by country

The Netherlands is the unusual case: it was ready six years early. Instant payments have been broadly available in the Dutch market since 2019, and DNB's own payments strategy notes that instant payments are "geen apart betaalmiddel" in the Netherlands, because most online payments are already instant by default. Betaalvereniging Nederland reports no implementation problems since October 2025, and the IBAN-name check was already an established Dutch fraud-prevention measure before the Regulation required it.

The consequence is that the IPR's operational bite in the Netherlands is not the instant capability. It is Article 5d and the reporting.

Dutch reporting specifics. The first submission was due 9 April 2026 and covered four separate annual reports: 26 October to 31 December 2022, then 2023, 2024 and 2025. Format is xBRL-CSV through DNB's Digital Reporting Service, open since 2 March 2026. Two datasets: charges for credit transfers, instant credit transfers and payment accounts; and the share of transfers rejected because of EU targeted financial restrictive measures, split domestic and cross-border. Annually thereafter on 9 April.

Non-euro-area Member States get later dates but no deferral on Article 5d, and two extra derogations: a competent-authority permission to decline sending above a limit of not less than €25,000 from national-currency accounts during hours when the PSP neither sends nor receives non-instant euro transfers on those accounts, renewable annually; and a further window to 9 June 2028.

What recently changed

9 October 2025, go-live, and the scheme layer landed on time. The 2025 SCT Inst Rulebook went live on 5 October 2025 carrying the removal of the scheme maximum, and the EPC's Verification of Payee scheme went live in parallel.

The reporting forbearance has expired. The EBA postponed the first harmonised PSP reporting by twelve months, from April 2025 to April 2026, and told national authorities to deprioritise collection and avoid enforcement against non-reporting institutions in 2025. That was the only explicit supervisory forbearance anywhere in the IPR framework, it covered reporting only, and it is over.

The scheme is still moving. Twenty-seven change requests were analysed and put to public consultation for VOP Rulebook v2.0, which closed on 30 June 2026. That volume of change requests is the strongest public indicator that live operation produced material friction, though the EPC has not attributed them to specific defects, and no ECB, EPC, EBA or DNB publication reports live match, close-match or false-positive rates.

PSD3 and the PSR are close, but not law. The Commission proposed both on 28 June 2023. Parliament adopted its first-reading position on 23 April 2024, Council agreed a general approach on 18 June 2025, and a provisional political agreement was reached on 27 November 2025. ECON approved the agreed text on 5 May 2026. As at 17 August 2026 the Parliament's own Legislative Observatory records the PSR as awaiting the Council's first-reading position, with an indicative plenary date of 14 December 2026. Neither is published in the Official Journal. Several outlets have written as though they are final. They are not.

The agreed content matters here for one reason above all: IBAN-name verification is extended beyond euro credit transfers into the general PSR framework. The deal also adds a fraud liability framework with mandatory information sharing between PSPs, a spoofing refund right, potential online platform liability, ATM and card fee transparency, and cash withdrawal at retailers without a purchase.

FIDA was not withdrawn. Widely reported as a candidate for withdrawal in 2025, the Financial Data Access Regulation remains in trilogue, with a Council working document dated 6 April 2026. No adoption date, no application date.