1. BACKGROUND
The International Bank Account Number (“IBAN”) was introduced in 1997 by the International Organisation for Standardization and used to facilitate the processing of data in data interchange internationally. Virtual IBANs (“vIBANs”) are an innovation which allow end users to exploit the existing IBAN technology by being indistinguishable to third parties from standard IBANs.
Table of Contents
The latest EBA report on vIBANs dated May 2024[1] (the “EBA Report”) provides a definition of vIBANs based of two criteria. Firstly, a vIBAN is an identifier that has the same format and functionality as a regular IBAN, and is linked to a payment account, referred to as the “Master Account”. Secondly, the Master Account to which the vIBAN is linked has its own IBAN (different from the vIBAN), and, depending on the use case, can be opened either: (i) In the name of the end user of the vIBAN or (ii) in the name of another entity which allocates the vIBANs to the end users. Beside credit institutions, the issuing entities can be Payment Institutions (“PI”) or Electronic Money Institutions (“EMI”).
Whilst the EBA Report was published to bring more substance to the limited European level rules and soft law on vIBANs, national competent authorities (“NCAs”) such as the German BaFin have already established their own rules regarding the supervision of vIBANs by their users. In a 2020 general administrative act, the BaFin decided to require any credit institute issuing a vIBAN for the benefit of a credit institution, PI or EMI (which can all be defined as payment service providers or “PSPs”) to register the relevant vIBAN in a filing system, with the PSP as account holder and the end-user as beneficial owner. Whilst not performed at a European level, national supervisory rules have thus already tried to alleviate some of the risks involved in the use of vIBANs and noted by the EBA. In the case of the BaFin the registration of vIBANs should help with assessing the amount of German vIBANs issued in Germany, therefore facilitating their supervision.
The issue of vIBANs and their regulation, whether at the national or European level, is of particular relevance to PSPs since the vIBAN is a popular tool which amongst other things allows PSPs to help their client bypass some regulatory hurdles. From a more commercial point of view, vIBANs can also be useful as they can help provide multi-currency payment functionalities to customer and avoid foreign exchange costs. Professionals thus need to be aware of the latest regulatory drive regarding vIBANs in order to provide this kind of services in a safer and more compliant manner.
2. POSSIBLE USES OF VIRTUAL IBANS
Some of the possibles uses of vIBANs noted by the EBA Report are:
- PSPs having a branch in a host Member State offer to their customers vIBANs with the country code of that host Member State, while the Master Account is held and serviced from the home Member State;
- PSPs partner with another PSP to offer to their customers vIBANs that have been issued by the partner PSP and that include the identifier of the partner PSP and the country code of a host Member State in which the partner PSP is authorised or has a branch; and
- PSPs (PIs or EMIs) partner with a credit institution to offer to their customers vIBANs that have been issued by the partner credit institution and that include the identifier of that credit institution and the country code of the Member State in which both the PI/EMI and the partner credit institution are authorised.
3. POTENTIAL BENEFITS OF VIRTUAL IBANS AS PERCEIVED BY MARKET PARTICIPANTS
After a request for information, the EBA has determined in the EBA Report that some of the main potential benefits of vIBANs, as perceived by market participants, include:
- Offering consumers and businesses an easier way to obtain an IBAN with the country code of a specific Member State, to overcome issues stemming from IBAN discrimination;
- Facilitating centralisation of payments within a group; and
- Reducing the complexity and costs associated with opening and managing separate bank accounts.
With regard to the benefit listed in point a) of the list hereabove, the concept of “IBAN discrimination” designates a phenomenon in which a person cannot make or receive a SEPA transfer because the payee does not accept SEPA payment originating from another Member State. The use of vIBANs thus allow SEPA users to not be hindered by the imperfect implementation of the SEPA Regulation[2].
4. RISKS AND CHALLENGES ASSOCIATED WITH VIRTUAL IBANS ACCORDING TO THE EBA
1. Unlevel playing field and regulatory arbitrage
One of the categories of risk identified in the EBA report is the risk of an unlevel playing field between various Member State with regard to their supervision of vIBANs, and the risk of regulatory arbitrage between the various approaches on regulatory framework applicable to vIBANs.
More specifically the EBA notes that the use of vIBANs can create the following supervisory risks:
- Unlevel playing field with regard to the application of the correct Anti-Money Laundering/Countering the Financing of Terrorism (“AML/CFT”) regulatory framework in case of cross-border provision of vIBANs and with regard to the implementation of the SEPA regulation;
- Risks of vIBANs being used by non-EU financial institutions or by EU non-PSPs to provide payment services without the required authorisation; and
- Divergence in the understanding of what vIBANs are.
The last risk is now mitigated by the presence of a definition for vIBANs in the 2024/1624 anti money-laundering regulation (”AMLR”).
2. Risks with regard to transparency and reporting obligations
Due to the opaque nature of the vIBANs schemes, the second main risk noted in the EBA report is that of a lack of transparency for both competent authorities and PSPs, with the consequence that the adequacy of the internal AML/CTF of PSPs will be harder for NCAs to assess.
Another risk noted by the EBA is the lack of visibility on the part of NCAs regarding the scale of vIBANs offering in their jurisdiction.
Risks to end users
With regard to risks associated with the use of vIBANs by end-users, the EBA remarks that end-users may be at risk because of inappropriate disclosure about which Deposit Guarantee Scheme (“DGS”) protects their deposit and a general lack of transparency with regard to vIBANs.
5. PROPOSED MEASURES BY THE EBA TO MITIGATE THE RISKS ASSOCIATED WITH VIRTUAL IBANS
Whilst beside the AMLR, there are no European legal texts regulating vIBANs at the moment, the EBA Report has provided a few recommendations in order to mitigate the risk associated with vIBANs.
These recommendations can be summed up to two main measures:
- Regulatory and directive amendments, such as the entry into force of the AMLR, and the amendment of PSD2 to clarify the definition of payment account and whether holders of vIBANs are considered to have payment accounts; and
- NCAs clarifying their supervisory approach with regard to vIBANs: As an example, NCAs should henceforth verify that PSPs provide sufficient information to users of vIBANs, both at the pre-contractual stage and in the contracts with their clients to ensure that depositors using a vIBAN are made aware of which DGS protects their deposit.
6. FUTURE OUTLOOK FOLLOWING THE APPLICATION OF THE AMLR
Article 22(3) of the AMLR establishes some basic rules with regard to identification of the end users of vIBANs. The entity issuing vIBANs must ensure that it can identify the legal or natural persons using the issued vIBANs. In conjunction with Article 22(3) of the AMLR, the risk indicators in Annex I of the EBA Report will provide a useful framework from which professionals providing vIBANs services can develop their KYC and AML/CTF processes.
The introduction of a definition of vIBANs and basic identification rules in the AMLR with regard to vIBANs, will certainly alleviate some of the transparency and regulatory arbitrage risks listed in the EBA Report. It is however certain that further guidelines and regulations on vIBANs will be needed to lower the risks associated with vIBANs, harmonise the supervisory approach of NCAs and create better legal certainty for professionals providing vIBANs services and end users alike.
[1] https://www.eba.europa.eu/sites/default/files/2024-05/612f03de-965a-4157-b638-1b4c5b081f87/EBA%20Report%20on%20virtual%20IBANs.pdf?trk=public_post_comment-text
[2] Regulation (EU) 260/2012 establishing technical and business requirements for credit transfers and direct debits in euro.
