SEPA and instant payments: Sanctions compliance between a rock and a hard place?

The Instant Payments Regulation 2024¹ came into force on 8 April 2024, offering secure instant payments in Euros across the Single Euro Payments Area (SEPA). However, in order to provide for this service, fundamental changes are required to payment service providers’ sanctions compliance processes.

What has happened?

The Single Euro Payments Area (SEPA) consists of 36 European countries, including the whole of the European Union (EU). SEPA was initially created in 2011 in order to allow electronic Euro payments to be made across Europe, with the same ease offered to customers making payment transfers between bank accounts located within the same country. However, there is frustration in the EU that, compared to other countries, there is limited capability for instant Euro payments. The Instant Payment Regulations 2024 will oblige payment service providers (PSPs), i.e. banks, to offer this service to mandated standards. To do so, however, PSPs will be obliged to restructure their sanctions screening processes.

What are instant payments?

An ‘instant credit transfer’ means a credit transfer which is executed immediately, 24 hours a day and on any calendar day.²

Historically, the speed of processing electronic transactions within the SEPA region has taken one business day. This contrasts with the UK where bank customers have been able to make payment transfers within 15 seconds following the introduction of the Faster Payments Service in 2008.³  The European Commission has estimated that only 11% of all money transfers in Euro are instant and that institutional delays in money transfers cause nearly EUR 200 billion in payments to be temporarily suspended each day.⁴ One in three EU PSPs are not currently able to offer instant payments. This is all about to change, however, with the introduction of the Instant Payments Regulation 2024, which will require PSPs to offer instant Euro payments within 10 seconds.

One potential source of delay to the processing of payments is the scrutinising of transactions for compliance with EU sanctions, and in particular whether the payer and payee are subject to asset freeze measures. In order to square the circle, the Instant Payment Regulations 2024 mandate that PSPs move from a model of screening transactions to a customer focused model.

Reconciling instant payments with sanctions obligations

There is currently no EU legislation which prescribes how PSPs should comply with EU sanctions, leading to a variety of methods having been adopted by different PSPs. These methods usually involve screening the payer and payee to each payment request against sanctions lists on an ad hoc basis. As a result, a large number of transactions end up being flagged in the PSP systems as false positives.⁵ The issue with this method is that on-demand screening per payment request does not permit the transaction to be instantaneous, certainly not within the allocated time frame of 10 seconds that the EU has allotted under the Instant Payment Regulations 2024.

In order to address this challenge, from 9 January 2025, PSPs will be prohibited from performing transaction-based due diligence as to whether the payer and / or payee involved in an instant credit transfer are subject to targeted EU financial sanctions.⁶

Rather, PSPs will be obliged to screen their customer lists as follows:⁷

• Immediately on the entry into force of any new targeted financial sanctions;
• Immediately on the amendment of any existing targeted financial sanctions; and
• At least once every calendar day.

In theory, these provisions should fully mitigate the lack of transaction-by-transaction screening.

In the event that a breach of the EU asset freeze did occur due to lack of transaction-based screening by a PSP, then it may be open to the PSP to argue that it did not know and did not have reasonable cause to suspect that it was acting in breach. Provided that the PSP complied with the screening requirements in the Instant Payment Regulations 2024, then it would arguably not be ‘reasonable’ for the PSP to have undertaken additional due diligence steps. Guidance on this point would be welcomed, particularly given that no express defence for PSPs in respect of instant payments is provided for in the various EU sanctions regulations.

The Instant Payment Regulations 2024 sanctions screening requirements only apply, however, in respect of targeted financial sanctions adopted by the EU in accordance with Article 215 of the Treaty on the Functioning of the European Union (the TFEU). As such, these requirements do not apply to transaction-based screening for the following:

• Trade sanctions;
• Non-EU sanctions such as those imposed by the US or the UK;
• EU sanctions made under different constitutional authorities, such as restrictive measures focused on combatting terrorism made pursuant to Article 75 TFEU;⁸
• EU counter terrorist financing, or money laundering requirements.

In these cases, the ‘reasonableness’ defence would be unlikely to apply because there is no prohibition on conducting transaction-based screening. It is also unclear how a PSP can be expected to assess trade sanctions risks other than by transaction based screening. Payment processing has generally been excluded from the ambit of EU prohibitions on the provision of ‘financial assistance’ (which is an ancillary prohibition to most EU trade sanctions).⁹ However, equivalent UK sanctions do apply to payment processing. EU PSPs that are required to comply with both EU and UK sanctions will need to ensure that they have processes in place to comply with their obligations under both the EU Instant Payment Regulations 2024 and UK sanctions.

It is also unclear what steps will need to be taken in the event that sanctions screening cannot be performed or resolved ‘immediately’. Automated sanctions screening can be performed rapidly. However, determining whether ‘hits’ constitute false positives, and whether issues of ‘ownership and control’ are relevant are likely to require a degree of time and human interaction. Performing this exercise on a daily basis in respect of all customers rather than on a transactional basis may add to the compliance burden depending on the volume of transactions by the customer.

Preparing for the new requirements

The approach to be followed under the Instant Payment Regulations 2024 is based upon the well-established approach taken by PSPs in the UK by using daily verification mechanisms to screen their customers. At the press conference on the European Commission’s proposal for the Regulation, Commissioner McGuiness remarked that the aim is to make sanctions screening more efficient by moving away from transaction-based screening.¹⁰ By frequently ensuring their customers are not listed on sanctions lists, subject to a targeted financial restrictive measure,¹¹ PSPs circumvent the requirement to check individual payment transfers. However, as discussed above, it is likely that EU PSPs will need to substantially re-configure their sanctions screening processes and structures.

The Council of the EU and the European Parliament have taken into account the difficulties in harmonising sanctions infrastructure across the SEPA region where the Euro is not the primary currency, and have given PSPs not in the Eurozone a longer implementation deadline than those in the Eurozone:

• Deadline for Eurozone-based PSPs to receive and send instant credit transfers: 9 January 2025 and 9 October 2025 respectively.
• Deadline for non-Eurozone-based PSPs to receive and send instant credit transfers: 9 January 2027 and 9 July 2027¹² respectively.
• However, all PSPs must comply with the new sanctions screening obligations by 9 January 2025.

What should you do now?

If you are a major PSP in the UK, the good news is ‘not much’. The infrastructure for this is already in place through Faster Payments, which is offered through Pay.uk who also run the Bacs Payment System. Pay.uk have an access programme which facilitates the onboarding of Faster Payments to new PSPs. However, this is not mandatory and smaller UK PSPs, or those not currently offering Faster Payments, will have to ensure they have signed up to the service or be able to offer something similar.

In the Eurozone, things will not be so easy. Some EU Member States will be able to offer instant payments without issue, i.e. Denmark uses MobilePay which was introduced by Danske Bank in 2013 and is well integrated in Danish society. However, other countries such as Montenegro, who are in the Eurozone but not an EU Member State, are much further behind and are turning to other European PSPs for advice.¹³

EU PSPs who are not already set up to provide instant payments will need to consider whether their sanctions screening processes are compliant with the mandatory standards required under the Instant Payments Regulations 2024. Where they are not, new processes will be required, which may need to be supported by additional resourcing and IT systems. Consideration will also need to be given to addressing sanctions risks other than those presented by persons listed as subject to EU asset freeze measures.

Footnotes

1. Regulation (EU) 2024/886, amending Regulations (EU) 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant credit transfers in Euro

2. Article 2(1a) of Regulation (EU) No 260/2012.

3. Types of Faster Payment transactions – Pay.UK (wearepay.uk)

4. EPRS | European Parliamentary Research Service, “At a Glance: Instant payments in euro”, Plenary – February | 2024. Link

5. Committee on Economic and Monetary Affairs, “REPORT on the proposal for a regulation of the European Parliament and of the Council amending Regulations (EU) No 260/2012 and (EU) 2021/1230 as regards instant credit transfers in euro”, 3 July 2023.

6. Article 5d(2) of Regulation (EU) No 260/2012.

7. Article 5d(1) of Regulation (EU) No 260/2012.

8. 62010CJ0130 (europa.eu)

9. Case C‑72/15, and see also by example Article 1(o) of EU Council Regulation 833/2014 as amended

10. Remarks by Commissioner McGuinness (europa.eu)

11. Article 2 of Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 2012 defines this as “an asset freeze imposed on a person, body or entity or a prohibition on making funds or economic resources available to a person, body or entity, or for its benefit, either directly or indirectly, pursuant to restrictive measures adopted in accordance with Article 215 TFEU”.

12. PSPs located in a Member State whose primary currency is not the Euro will have until 9 June 2028 to offer their customers the ability to send instant payments in Euro from non-Euro payment accounts held in the national currency of that Member State.

13. CBCG Continues Cooperation with the CNB in Payment Operations – CBCG