Topic starter
11/07/2026 8:27 pm
TL;DR: Verification of payee rules, QWAC certificates, and PSD2 security requirements are converging to reduce misdirected and fraudulent payments while tightening authenticated communication between banks, PSPs, and API-based fintech services, according to GlobalSign. The practical issue is not just payment accuracy, but whether identity trust is strong enough to support secure machine-to-machine payment flows.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “El futuro de los pagos seguros: Los QWAC y la normativa sobre VoP reconfiguran la verificación de la identidad de los PSP”.
By the numbers:
- The European Payments Council ordered all payment service providers offering instant payments or SEPA transfers to implement verification of payee before October 2025.
- Australia’s banking association completed the design phase of its CoP service in August 2024, with launch planned for 2025.
Key questions
Q: How should security teams govern payment verification in open banking flows?
A: They should treat payment verification as part of the identity control plane, not a back-office fraud add-on.
Q: Why do QWACs matter when banks exchange payment data with third parties?
A: Because QWACs support mutual authentication and protect the confidentiality and integrity of API traffic.
Q: What breaks when beneficiary verification is not linked to secure API communication?
A: The verification step becomes easy to trust on paper but weak in practice.
Practitioner guidance
- Map payment trust dependencies Inventory where VoP, CoP, QWAC and PSD2 controls intersect across bank, PSP and TPP payment paths so ownership is clear.
- Validate mutual authentication on API routes Confirm that each open-banking integration uses mutually authenticated channels and that certificate lifecycle management is assigned and reviewed.
- Align beneficiary checks to authorisation steps Ensure payment authorisation cannot complete until beneficiary verification has passed and exception handling is defined for mismatches.
Bottom line: Verification of payee and confirmation of payee shift beneficiary validation into the payment path itself, reducing the chance that a transfer is authorised to the wrong account.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:56 pm
Payment verification is becoming an identity control, not just a fraud control. The article shows that VoP and CoP are no longer optional reconciliation aids. They are now part of the trust fabric that decides whether a payment instruction should proceed at all. For identity teams, that shifts beneficiary data into the same governance conversation as authentication and authorisation.
A question worth separating out:
Q: What is the difference between VoP and QWACs in payment security?
A: VoP checks whether the beneficiary details match the intended recipient, while QWACs authenticate the organisations and channels exchanging payment data. One validates who should receive the money, the other validates who is allowed to talk in the payment workflow. Mature programmes need both because they protect different trust decisions.
👉 Read our full editorial: Payment verification rules are reshaping identity trust in open banking