Execute VoP Checks

Overview

What is VoP?

VoP is a mandatory SEPA-wide pre-payment service that checks if the name and IBAN provided by a payer match the account holder data held by the payee’s PSP. It helps reduce:

• Fraud (APP fraud)

• Misdirected payments

• Payment disputes

The VoP endpoint

The Verification of Payee (VoP) endpoint verifies whether the payee details supplied by the payer match the actual Account holder held by the beneficiary bank for a given IBAN. It is called before initiating a SEPA Credit Transfer to help prevent misdirected payments and authorised-push-payment fraud.

This guide covers:

• POST /v2/vop — request, response, result codes, and error codes.

• How the returned vop_token is used when creating a transfer via POST /v2/transfer.

• Operational notes (latency, name handling, service availability) and an integration checklist.

• Full endpoint definition can be found here: Paynetics API documentation

Scope of VoP

VoP applies to all SEPA Credit Transfers initiated by a payer — both standard SCT and SCT Inst — under Regulation (EU) 2024/886 and the EPC VoP Scheme Rulebook. The Paynetics API requires a valid VoP Token on the transfer payload for these transactions.

Integration Flow

The integration is two sequential API calls. First obtain a VoP token, then present that token when creating the transfer. The API Gateway validates the token before booking the transaction.

Authentication and base URL

Both endpoints sit behind the same Paynetics public v2 API Gateway you already use for /v2/transfer and other v2 calls. Use the same base URL, bearer token, and TLS configuration — no new credential is required for VoP.

Authorization: Bearer <access_token>
Content-Type: application/json

Step-by-step

Step 1 — Verify the Payee: POST /v2/vop

Before initiating a transfer, call the VoP endpoint to obtain a verification token.

Endpoint

POST /v2/vop

Request body

Important: Exactly one of account_holder_name or organisation_id must be present. Sending both, or neither, returns error code 11001.

Example requests

Individual payee

POST /v2/vop
Content-Type: application/json
Authorization: Bearer <access_token>
{
  "iban": "DE89370400440532013000",
  "account_holder_name": "John Doe",
  "user_token": "3a8d0a0b-7d7e-4d10-b2a4-2b7a3d1b2c11",
  "merchant_token": "9bbf84f1-3e6a-4d01-9c8a-2a47b8c3dcd1"
}

Organisation payee

POST /v2/vop
Content-Type: application/json
Authorization: Bearer <access_token>
{
  "iban": "FI2112345600000785",
  "organisation_id": "549300DTUYXVMJXZNY75"
}

Successful response

HTTP 200 OK
{
  "code": 0,
  "data": {
    "vop_token": "0ba5e81d-c43b-4008-b2d6-0d390f6f8c08",
    "result": "MTCH",
    "matched_name": "John Doe",
    "timestamp": "2026-04-28T10:22:11.123Z"
  }
}

Response fields

Result code guidance

Error responses

Step 2 — Submit the Transfer: POST /v2/transfer

After a successful VoP verification, create the transfer and include the vop_token received in Step 1 as the vop field of the transfer payload.

Note: The /v2/transfer endpoint does not call the VoP service. It only validates the vop_token you supplied against the verification records created by your earlier /v2/vop call. You must obtain the token first.

Endpoint

POST /v2/transfer

Only the fields directly related to the VoP flow are documented here. Refer to the Transfer API documentation for the complete request schema.

VoP-related request fields

Example request

POST /v2/transfer
Content-Type: application/json
Authorization: Bearer <access_token>
{
  "amount": 1250.00,
  "currency": "EUR",
  "reference": "Invoice INV-2026-0411",
  "isInstant": true,
  "debtor": {
    "iban": "BG80BNBG96611020345678",
    "name": "Acme Trading EOOD"
  },
  "creditor": {
    "iban": "DE89370400440532013000",
    "name": "John Doe",
    "bic": "COBADEFFXXX"
  },
  "vop": "0ba5e81d-c43b-4008-b2d6-0d390f6f8c08"
}

Validation behaviour

The API Gateway validates the supplied vop value against the verification records, then creates the transfer and stores the vop value on the transaction record. The vop value is returned in subsequent transaction reads.

Successful response

HTTP 200 OK
{
  "code": 0,
  "data": {
    "transaction": "f3a6d9b2-1c1f-4b6e-9a2d-2f7b5d8a91cc"
  }
}

VoP-specific error

{
  "code": 16021,
  "message": "services.balances.vop_response_failed"
}

Operational Notes

Latency

/v2/vop is a synchronous call to the VoP scheme. Typical end-to-end response time is below two seconds, but is bounded by the response time of the beneficiary bank. We recommend a client-side timeout of five seconds and a single retry on an 11000 service error.

Name handling and transliteration

Names returned by responder banks may include non-Latin scripts (most commonly Cyrillic). Paynetics transliterates returned names to Latin using ISO 9 / BGN/PCGN standards before delivering them in matched_name.

When sending account_holder_name, prefer the name exactly as it appears on the payer's records. Avoid pre-processing such as removing diacritics, expanding business suffixes (Ltd / Limited / EOOD), or reordering name parts — these reduce match quality and are more likely to produce CMTC rather than MTCH.

Service availability

If the beneficiary bank or the VoP scheme cannot be reached, the /v2/vop response is returned with result NOAP. The payer may retry the check or proceed with the transfer — apply the NOAP action defined in the result code guidance above.

Integration Checklist

Use this checklist to verify your integration is complete before going live.

Frequently Asked Questions (FAQ)

Q: Can we skip VoP if the name is only slightly wrong?
A: No. CMTC (Close Match) requires user confirmation or correction.

Q: Can we cache VoP results?
A: No. VoP results must be fresh and real-time for every payment.

Q: What if the service is unavailable?
A: A NOAP (Unable to verify) result will be returned. Inform the payer that the recipient could not be verified. The payer may retry the check or proceed with the transfer.

Q: Can we use LEI or VAT instead of a name?
A: Yes, for legal entities only — check EPC Directory Service (EDS) if supported.

Q: What happens if name doesn't match?
A: You must give the user the option to “Edit” or “Cancel” the operation.

Q: Do we show the verified name?
A: You are obliged to show it only in the CMTC case.

Q: Can users bypass VoP?
A: No, the check is mandatory for all SEPA Credit Transfers (SCT) and SEPA Instant Credit Transfers (SCT Inst)

Q: What is the deadline for the VoP availability?
A: Hard deadline is Jan 1st 2027 due to Bulgaria not being part of EU zone right now. It is not only a regulation, but a major safety improvement for our end clients.

Resources

• Regulation (EU) 2024/886 on instant payments

• EPC VoP Website

• EPC218-23 VoP Rulebook (v1.0)

• EPC VoP FAQ

• EPC Directory Service documentation

  
  Support

If you encounter issues during integration or in production, contact the Paynetics Support team through your usual support channel. Please include:

• The endpoint involved (/v2/vop or /v2/transfer).

• The request timestamp and the affected vop_token or transaction ID.

• The full error response (code and message), with any Partner-side correlation IDs.