Notifications
Clear all
Topic starter
11/07/2026 8:27 pm
TL;DR: Verification of payee rules, QWAC certificates, and PSD2 security requirements are converging to reduce misdirected and fraudulent payments while tightening authenticated communication between banks, PSPs, and API-based fintech services, according to GlobalSign. The practical issue is not just payment accuracy, but whether identity trust is strong enough to support secure machine-to-machine payment flows.
NHIMG editorial — based on content published by GlobalSign: payment verification, QWAC certificates, and PSD2 security requirements
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
Questions worth separating out
Q: How should security teams govern payment verification in open banking flows?
A: They should treat payment verification as part of the identity control plane, not a back-office fraud add-on.
Q: Why do payment platforms need certificate-backed mutual authentication?
A: Payment platforms need certificate-backed mutual authentication because API traffic between banks, PSPs, and fintech providers must prove both endpoint identity and transport integrity.
Q: What breaks when beneficiary verification is not linked to secure API communication?
A: The verification step becomes easy to trust on paper but weak in practice.
Practitioner guidance
- Map recipient verification into payment approval flows Insert CoP or VoP checks before authorisation, and ensure mismatches create a clear exception path for manual review.
- Treat QWAC lifecycle as a governed control Track issuance, renewal, revocation, and ownership for certificates used in bank and PSP communications so trust does not outlive the relationship.
- Align API authentication with transaction validation Do not separate mTLS, endpoint authentication, and beneficiary verification into independent reviews.
What's in the full article
GlobalSign's full blog covers the operational detail this post intentionally leaves for the source:
- Country-by-country implementation nuances for Verification of Payee and Confirmation of Payee
- How QWACs support mutual authentication and secure communication in PSD2-aligned flows
- The regulatory reading of RTS SCA and CSC requirements for payment providers
- Practical context on how payment verification is being adopted across regions
👉 Read GlobalSign's analysis of VoP, CoP, QWACs, and PSD2 payment security →
Payment verification and QWACs: what it means for identity teams?
Explore further
11/07/2026 8:56 pm
Payment verification is becoming an identity control, not just a fraud control. CoP and VoP exist because payment ecosystems need a reliable way to verify who the beneficiary really is before value moves. That shifts the problem from simple account validation to identity assurance across institutions, APIs, and legal entities. Practitioners should treat recipient verification as part of the broader identity trust model.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: Who is accountable for failed payment verification under PSD2 and related rules?
A: Accountability sits across the payment chain, including the PSPs, banks, and third-party providers that exchange and validate transaction data. PSD2 and the RTS for SCA and CSC require secure communication and authenticated endpoints, so failures are not just technical defects. They are governance failures in how the payment ecosystem is operated.
👉 Read our full editorial: Payment verification rules are reshaping identity trust in open banking
