.svg)
The ongoing revision of the EU’s Payment Services Directive (PSD2) is a prime opportunity to address the challenges and ambiguity surrounding virtual IBANs, Belgian officials chairing talks among EU governments have said in documents seen by Vixio.
Belgium, which holds the rotating presidency of the EU Council until the end of June, is angling for potential changes to the PSD2 to tackle the risks and challenges raised by virtual IBANs, while also preserving their benefits.
Building on research by the European Banking Authority (EBA), which found that virtual IBANs were poorly defined, Belgian officials circulated a discussion document to EU countries’ financial services attachés seeking comprehensive regulation of virtual IBANs across the EU.
It asks whether member states agree that virtual IBANs should be considered IBANs under the SEPA Regulation and, consequently, whether this should be specified in a provision.
Additionally, the Belgian officials seek agreement on whether ISO IBAN standards (ISO 13616) should be binding, requiring IBANs to comply with these standards to qualify under the EU’s SEPA Regulation.
It also questions whether these ISO IBAN standards are applicable to virtual IBANs. In each instance, if there is disagreement, financial services attachés are requested to provide explanations.
Belgium’s view is that the ISO IBAN standards, along with risk mitigation and the protection of local consumers, necessitate matching the country code of virtual IBANs with the country where the master account is held.
The ISO standards require the country code of an IBAN to reflect the issuer’s country, which is the entity maintaining the account, suggesting that there should be a match between the country code of the virtual IBAN and the master account's location.
This match, according to the Belgian officials, mitigates several risks, including money laundering and terrorist financing, incorrect reporting under PSD2 and deposit protection complexities.
Local rules and anti-money laundering (AML) monitoring would further apply if the master account is held locally, ensuring better consumer protection. To prevent legal ambiguities and ensure clarity, Belgium proposes specifying that the country code of the IBAN must match the country where the account is held.
“The presidency notes that this general requirement would allow PSPs [payment service providers] to continue tackling IBAN discrimination,” the document says. “This would also ensure a level playing field across the Union in interpretation by CAs [competent authorities] and provide regulatory clarity and protection against undesirable outcomes that might inadvertently help IBAN discrimination.”
The Belgian presidency has also asked whether member states agree that it is not appropriate to legally mandate all offers of virtual IBANs be considered as the offering of payment accounts, suggesting instead that national competent authorities are best placed to make this assessment on a case-by-case basis.
Additionally, the presidency inquired whether member states consider it important to improve the efficiency of seizing procedures linked to fraud using virtual IBANs and whether they are aware of measures that could be taken to seize funds held in locally maintained master accounts when the end user’s payment account is located in another country.
The Belgian officials also said that PSPs offering virtual IBANs should ensure that customers fully understand the differences between an IBAN and a virtual IBAN, particularly regarding applicable consumer protection laws, adding that national competent authorities are best positioned to enforce this obligation in individual cases.
The reception to the Belgian presidency’s work has been mixed. One source in the payments sector suggested that the proposal is “coming down hard” on virtual IBANs, and that it does not strike the right balance between risk and innovation.
“Essentially, what we are concerned about is this idea that virtual IBANs can only have a country code of where [they are] linked,” they said, warning that this could add additional friction to cross-border payments within the EU.
Fanny Rodriguez, secretary-general of Fintecture, welcomed the proposals.
"Many fintechs use virtual IBANs, including us, and it has been challenging to comply with different rules across the EU,” she said. “The regulations are not compatible. For instance, the French regulator says some reporting is not necessary, while the Spanish regulator says it is.”
Rodriguez pointed out that this discrepancy creates confusion and makes compliance difficult due to the lack of a unified definition, so clarification would be beneficial.
“Virtual IBANs will remain necessary for two main reasons; one, they are needed for reconciliation, and also because we face IBAN discrimination,” she said. “We recognise here that national authorities are not consistently applying the rules on non-IBAN discrimination, which is why we use virtual IBANs where national competent authorities have not implemented the regulations uniformly.”
A spokesperson for the Belgian presidency said the proposal “does not seek stricter regulation per se … It seeks to mitigate the manifold risks identified by the European Banking Authority in a recent report on virtual IBANs.”
“If the proposals put up for discussion were to carry majority support in the council, the effect would not be to render cross-border payments more challenging, as there would be many ways in which to continue to provide virtual IBANs while adhering to the simple rules the presidency has put forward,” the spokesperson said. “Its effect would rather be to mitigate several risks, notably in the field of AML/CTF [anti-money laundering/counter-terrorism financing] supervision.”
EBA report
The discussion paper reflects the EBA’s work on virtual IBANs, which acknowledged the lack of a formal definition for virtual IBANs and provides an outline of observed common characteristics by the EBA.
Here, it says that virtual IBANs share identical functionality and format with standard IBANs, which makes them indistinguishable from traditional IBANs to external parties.
However, virtual IBANs are also associated with a designated payment account, termed a master account, which possesses its distinct IBAN separate from the virtual IBAN.
The EBA has outlined various risks with virtual IBANs in the report. It found several issues contributing to an uneven regulatory landscape, and concerns of regulatory arbitrage stemming from differing interpretations of relevant legislation by the national competent authorities across the 27 EU member states.
For instance, competent authorities hold divergent opinions on whether the provision of a virtual IBAN with the country code of another member state necessitates the establishment of a branch in that member state, and whether an IBAN, as defined in the SEPA Regulation, always requires a direct match to a payment account.
The Paris-based regulator also has significant concerns regarding money laundering and terrorist financing risks associated with virtual IBANs.
This includes the anonymity of end users to PSPs, including counterpart PSPs, which poses challenges for transaction monitoring, potentially compromising the reliability of transactional information.
Moreover, the lack of visibility for local regulators regarding the extent of virtual IBAN usage within their jurisdictions hampers their ability to assess the effectiveness of PSPs' risk mitigation measures.
Virtual IBAN users may also be deprived of certain safeguards and rights afforded by PSD2 to payment account holders, according to the EBA, if they do not control the master account.
Further, the EBA has called out inadequate transparency surrounding information, such as applicable complaints procedures or coverage under deposit guarantee schemes.
This lack of transparency can leave consumers vulnerable and uninformed about their rights and protections when utilising virtual IBANs, according to the EBA.
