February 10 2025
by Payments Intelligence
What is this article about?
The compliance challenges of virtual IBANs, focusing on AML obligations and regulatory gaps.
Why is it important?
While vIBANs offer innovation in payment systems, they introduce risks like money laundering due to insufficient oversight.
What’s next?
Payment Service Providers must strengthen due diligence, monitoring, and collaboration with regulators to address these risks.
Virtual IBANs (vIBANs) have become a key component of modern payment systems, enhancing payment reconciliation and facilitating cross-border transactions. However, their rapid adoption has raised concerns about regulatory oversight, particularly concerning anti-money laundering (AML) compliance.
Regulatory reviews from the Bank of Italy, UIF, and the European Banking Authority (EBA) have identified key shortcomings in the management of vIBANs. Currently, large enterprises are the primary users, while small businesses and consumers have shown limited adoption—likely due to unclear policies on customer eligibility and risk exposure.
vIBANs extend traditional International Bank Account Numbers (IBANs), providing PSPs with a way to manage payments and streamline financial operations. Unlike standard IBANs, vIBANs are linked to a primary ‘master account’ and serve as individual identifiers, allowing businesses to segregate transactions for different purposes. This makes them particularly useful for firms operating and managing complex flows.
However, vIBANs remain indistinguishable from standard IBANs to third parties, which raises a separate set of challenges around transparency, transaction monitoring and, importantly, given the current landscape, AML compliance. As the adoption of vIBANs grows, they’re increasingly seen as both a valuable innovation in payment systems and a growing regulatory challenge requiring careful oversight and further due diligence practises.
Aspect | iBAN | vIBAN |
|---|---|---|
Nature | Direct bank account number | Identifier linked to a master account |
Account holder | Specific to an individual/entity | Linked to a master account |
Primary use | General banking transactions | Payment reconciliation, segregation |
Traceability | Tied directly to a customer | Linked indirectly via a master account |
Compliance | Built-in regulatory clarity | Requires additional AML measures for transparency |
Regulatory inspections have revealed significant insights into the current usage and oversight of vIBANs, highlighting both their operational strengths and critical compliance gaps.
Data shows that vIBANs are primarily used by large financial firms, with minimal adoption among small businesses and individual consumers. This may be due to unclear PSP policies regarding target customers, acceptable use cases, and associated risks.
When thinking in the context of customer verification, vIBANs are often treated as extensions to master accounts as opposed to independent relationships. This leads to inadequate due diligence. In addition, vIBAN activities are often excluded from customer profiling efforts, leading to gaps in identifying and addressing suspicious behaviours. Primarily, transaction monitoring efforts focus on the master accounts, which oftens means individual vIBAN activities are overlooked, limiting the ability to detect anomalies or risks effectively for firms.
Regarding high-risk scenarios such as On Behalf Of (OBO) transactions or third-party involvement, which are not accompanied by proportionate risk controls, these deficiencies underscore the need for PSPs to enhance their risk assessment frameworks and implement sturdy policies to address the gaps and challenges raised by vIBANs.
As regulators continue to refine their expectations for PSPSs, a strong compliance framework is essential to mitigate financial crime risks. One key area of focus is enhanced due diligence (EDD), particularly in the context of virtual IBANs (vIBANs), where additional scrutiny is required to manage associated risks effectively.
The idea of enhanced due diligence (EDD) for vIBANs revolves around addressing some of the unique compliance challenges posed by their structure and use. While there are plenty of operational advantages, the indirect relationship to master accounts requires a higher standard of KYC processes and verification. Failure to do so could exacerbate risks of money laundering (ML) and terrorist financing (TF). Here’s how PSPs can strengthen their approach:
It’s important to note that EDD should not be a one-time activity but more a continuous process for firms to adopt in order to maximise awareness of changing customer behaviours and emerging risks.
Unlike the EU, the UK has yet to establish clear regulatory guidance on vIBANs. While the EBA has identified regulatory gaps and issued recommendations, the Financial Conduct Authority (FCA) has not formally defined Virtual IBANs, nor has it issued specific compliance obligations for PSPs operating in the UK. This, therefore, means it is possibly the case that the FCA leaves it to the firm’s assessment or interpretation.
This lack of clarity presents a challenge: compliance with EU regulations does not guarantee compliance with UK financial laws. While EU member states, such as Italy, have referenced older regulations to cover vIBANs, UK PSPs cannot assume that similar principles apply without explicit FCA guidance.
Since no dedicated UK framework exists, PSPs must rely on broader financial regulations to ensure compliance:
Regulatory Area | EU Guidance (EBA, PSD2, SEPA, etc.) | UK Approach (FCA, AML Regs, etc.) |
|---|---|---|
Definition of vIBANs | No formal definition in PSD2, but EBA guidance discusses vIBAN risks | No FCA definition or standalone regulatory framework for vIBANs |
AML/CTF Requirements | EBA urges enhanced due diligence (EDD) and specific KYC for vIBANs | UK Money Laundering Regulations (MLRs 2017) apply; vIBANs must be treated as potential AML risks |
Regulatory Oversight | Supervised by National Competent Authorities (NCAs) under EU frameworks | FCA has no direct supervisory framework for vIBANs but oversees AML compliance |
Transparency Obligations | EBA stresses monitoring both master accounts and vIBANs separately | UK PSPs must ensure traceability under POCA (Proceeds of Crime Act 2002) and FCA’s Financial Crime Guide (FCG) |
Customer Due Diligence (CDD) | vIBAN users require separate risk assessments under EBA’s AML/CTF guidance | UK PSPs must extend CDD to vIBAN users (not just master account holders) under MLRs 2017 |
Regulatory Collaboration | EU encourages PSPs to engage proactively with regulators to shape future guidance | FCA is behind the curve—UK PSPs should still engage with industry bodies (e.g., The Payments Association, UK Finance) |
The European Banking Authority (EBA) has identified several key risks and challenges associated with the use of virtual IBANs (vIBANs) in its report, a large proportion of which stem from regulatory inconsistencies, operational complexity, and transparency issues.
A key issue is regulatory divergence, as there is no uniform definition of vIBANs across different jurisdictions. This inconsistency results in varied standards and practices, creating opportunities for regulatory arbitrage and making it harder for PSPs to develop cohesive compliance strategies. The lack of clarity in how vIBANs should be treated under existing frameworks such as the SEPA Regulation and PSD2 further exacerbates the challenge. Customer transparency is also a critical issue, with many vIBAN users lacking a clear understanding of the protections and operational risks associated with these services.
The EBA also highlighted unclear oversight as a significant problem. National competent authorities (NCAs) often struggle to track and assess the scale and nature of vIBAN usage within their jurisdictions. This lack of visibility hinders effective supervision and makes it tough to identify weaknesses in PSPs’ internal controls, particularly when considering AML and CTF.
Transaction traceability presents another concern with the very nature of vIBANs, which redirect payments to a master account and can obscure the actual flow of funds. This creates challenges for tracing transactions and identifying the originators and beneficiaries, complicating efforts by financial intelligence efforts.
Finally, there are substantial risks linked to vIBANs on the consumer side. Users may unknowingly enter into arrangements where they are not the master account holders, potentially and inadvertently depriving them of rights and protections associated with traditional payment accounts.
There is a range of functionalities that make vIBANs invaluable in specific financial scenarios, particularly for businesses that are managing complex payment flows. Common use cases include the following:
Until the FCA issues direct guidance, UK-based PSPs should take proactive measures to ensure compliance and mitigate risk:
PSPs play a pivotal role in safeguarding the financial ecosystem against money laundering (ML) and terrorist financing (TF) risks. As the adoption of vIBANs grows, PSPs must take proactive measures to ensure these tools are not exploited for illicit activities, especially in jurisdictions like the UK, where regulatory guidance remains unclear.
Since the FCA has yet to establish a formal regulatory framework, UK PSPs should not wait for prescriptive rules but instead align with existing AML/CTF obligations, such as MLRs 2017 and POCA 2002. Firms should describe its proposition and outline its reasoning relating it to both obligations and the FCA’s Financial Crime Guide. It should continually evidence that it is following this approach and reviewing this to make any amendments considered necessary in the event of new information coming to light or subsequent adverse findings.
Implementing robust compliance controls, enhanced due diligence (EDD), and advanced monitoring technologies will help mitigate the risks associated with vIBANs while ensuring transparency in financial operations.
Compliance is not just a regulatory checkbox—it is a safeguard for financial trust. While UK PSPs cannot yet “work with regulators” in the way EU firms can, they should still engage with industry groups such as The Payments Association and UK Finance to drive regulatory clarity. By proactively addressing challenges and ensuring financial integrity, PSPs can protect their operations while shaping the future of vIBAN oversight in the UK.
The EBA’s redefinition of e-money challenges traditional models, raising regulatory uncertainties and requiring compliance reassessment.
The Economic Crime and Corporate Transparency Act 2023 holds businesses accountable for fraud unless they prove strong prevention measures.
Virtual IBANs streamline payments but pose AML risks, demanding stricter oversight from PSPs.
The Payments Association
St Clement’s House
27 Clements Lane
London EC4N 7AE
© Copyright 2024 The Payments Association. All Rights Reserved. The Payments Association is the trading name of Emerging Payments Ventures Limited.
Emerging Ventures Limited t/a The Payments Association; Registered in England and Wales, Company Number 06672728; VAT no. 938829859; Registered office address St. Clement’s House, 27 Clements Lane, London, England, EC4N 7AE.
Log in to access complimentary passes or discounts and access exclusive content as part of your membership. An auto-login link will be sent directly to your email.
We use an auto-login link to ensure optimum security for your members hub. Simply enter your professional work e-mail address into the input area and you’ll receive a link to directly access your account.
Instead of using passwords, we e-mail you a link to log in to the site. This allows us to automatically verify you and apply member benefits based on your e-mail domain name.
Please click the button below which relates to the issue you’re having.
Sometimes our e-mails end up in spam. Make sure to check your spam folder for e-mails from The Payments Association
Most modern e-mail clients now separate e-mails into different tabs. For example, Outlook has an “Other” tab, and Gmail has tabs for different types of e-mails, such as promotional.
For security reasons the link will expire after 60 minutes. Try submitting the login form again and wait a few seconds for the e-mail to arrive.
The link will only work one time – once it’s been clicked, the link won’t log you in again. Instead, you’ll need to go back to the login screen and generate a new link.
Make sure you’re clicking the link on the most recent e-mail that’s been sent to you. We recommend deleting the e-mail once you’ve clicked the link.
Some security systems will automatically click on links in e-mails to check for phishing, malware, viruses and other malicious threats. If these have been clicked, it won’t work when you try to click on the link.
For security reasons, e-mail address changes can only be complete by your Member Engagement Manager. Please contact the team directly for further help.
