Topic starter
11/07/2026 8:27 pm
TL;DR: Verification of payee, QWAC certificates and PSD2 security requirements are converging to reduce misdirected and fraudulent payments, according to GlobalSign. Open banking payment flows now need both beneficiary checks and authenticated channels to keep trust intact.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “El futuro de los pagos seguros: Los QWAC y la normativa sobre VoP reconfiguran la verificación de la identidad de los PSP”.
By the numbers:
- The European Payments Council ordered all payment service providers offering instant payments or SEPA transfers to implement verification of payee before October 2025.
- Australia’s banking association completed the design phase of its CoP service in August 2024, with launch planned for 2025.
Key questions
Q: Why do QWACs matter when banks exchange payment data with third parties?
A: Because QWACs support mutual authentication and protect the confidentiality and integrity of API traffic.
Q: What breaks when beneficiary verification is not linked to secure API communication?
A: The verification step becomes easy to trust on paper but weak in practice.
Q: How should security teams govern payment verification in open banking flows?
A: They should treat payment verification as part of the identity control plane, not a back-office fraud add-on.
Practitioner guidance
- Map payment trust dependencies Inventory where VoP, CoP, QWAC and PSD2 controls intersect across bank, PSP and TPP payment paths so ownership is clear.
- Validate mutual authentication on API routes Confirm that each open-banking integration uses mutually authenticated channels and that certificate lifecycle management is assigned and reviewed.
- Align beneficiary checks to authorisation steps Ensure payment authorisation cannot complete until beneficiary verification has passed and exception handling is defined for mismatches.
Bottom line: Verification of payee and confirmation of payee shift beneficiary validation into the payment path itself, reducing the chance that a transfer is authorised to the wrong account.
Glossary terms: QWAC, Verification of Payee, Verification Of Payee, Mutual Authentication
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
11/07/2026 8:56 pm
Payment verification is becoming an identity control, not just a fraud control. The article shows that VoP and CoP are no longer optional reconciliation aids. They are now part of the trust fabric that decides whether a payment instruction should proceed at all. For identity teams, that shifts beneficiary data into the same governance conversation as authentication and authorisation.
A question worth separating out:
Q: What is the difference between VoP and QWACs in payment security?
A: VoP checks whether the beneficiary details match the intended recipient, while QWACs authenticate the organisations and channels exchanging payment data. One validates who should receive the money, the other validates who is allowed to talk in the payment workflow. Mature programmes need both because they protect different trust decisions.
👉 Read our full editorial: Payment verification rules are reshaping identity trust in open banking