SEPA: credit transfers and direct debits end to end. 7 chapters and a final quiz.

Chapter 1. The SEPA area: one payments area, 41 countries.

SEPA stands for Single Euro Payments Area, the single payments area for the euro. The European Payments Council (EPC) has driven the project since 2002, and its goal fits in one sentence. A euro credit transfer or direct debit from Paris to Lisbon should be as simple, fast, and cheap as a payment from Paris to Lyon. To get there, Europe replaced dozens of national formats with common schemes: single interbank rulebooks that every participating payment service provider (PSP) applies in exactly the same way.

The EPC also manages a newer scheme, One-Leg Out Instant Credit Transfer (OCT Inst), launched in late 2023 to connect instant payments where only one “leg” is inside the SEPA area. This scheme opens a bridge to international payments. The four original schemes remain the foundation. In France, in the first half of 2024, the Banque de France counted 16.3 billion cashless transactions, with credit transfers up 8.2% in volume. Credit transfers alone account for the bulk of the value exchanged, roughly nine euros out of every ten of bank money.

Chapter 2. IBAN and BIC: the anatomy of account identifiers.

Every SEPA payment identifies the account to credit or debit by its IBAN (International Bank Account Number, ISO 13616). An IBAN can be up to 34 characters long, with a fixed length for each country. It always starts with the country code (2 letters), followed by check digits (2 digits), then the national account number, the BBAN.

FR76 3000 4000 0312 3456 7890 143
│    │
│    └─ IBAN check digits (2 digits, ISO 7064 MOD 97-10)
└────── ISO country code (FR)

French BBAN (23 characters) = the former RIB (French bank details):
30004        bank code     (5 digits)
00003        branch code   (5 digits)
12345678901  account no.   (11 characters)
43           RIB key       (2 digits)

The BIC (Business Identifier Code, ISO 9362) identifies the institution in 8 or 11 characters: 4 for the bank, 2 for the country, 2 for the location, and 3 optional ones for the branch (for example BNPAFRPP). Since February 2016, the “IBAN only” rule in Regulation 260/2012 has prohibited asking customers for their BIC for a SEPA payment, since banks derive it from the IBAN themselves.

The check digits, a last point often misunderstood, validate the IBAN’s consistency: the MOD 97-10 algorithm catches typos. They prove neither that the account exists nor that it belongs to the named payee. Fraud using fake bank details exploits exactly this gap, which Verification of Payee, covered in the next chapter, closes.

Chapter 3. Credit transfers: standard SCT vs. SCT Inst.

An SCT is a push payment: the payer gives the order, and the funds move from their account to the payee’s. Standard credit transfers are processed in batches, on business days only, with each bank setting its own cutoff times. The legal timeframe inherited from the Payment Services Directive requires the payee’s bank to be credited by the next business day (D+1) at the latest. SCT Inst, by contrast, is processed one transaction at a time, continuously. The funds are available to the payee within 10 seconds at most, 24/7, 365 days a year.

Verification of Payee (VoP) addresses the historical weakness of credit transfers: you paid an IBAN, not a name. Since October 9, 2025, before a payer approves a transfer, their bank queries the payee’s bank and compares the name entered with the actual holder of the IBAN. There are four possible responses: match, close match (the actual name is displayed and the payer decides), no match, and verification not possible. The payer is still free to approve, but ignoring a “no match” shifts liability to them.

Chapter 4. Direct debits: SDD Core and SDD B2B.

A SEPA direct debit is a pull payment: the creditor initiates the debit from the payer’s account based on a signed mandate. This is a clean break from the old French system, because the mandate is given to the creditor, which keeps it and bears the burden of proof. Under the Core scheme, the debtor’s bank never sees it. Two identifiers underpin everything: the SCI (SEPA creditor identifier, issued in France by the Banque de France through the creditor’s bank) and the UMR (unique mandate reference), specific to each mandate.

A mandate doesn’t last forever. It expires after 36 months with no collection, and reusing it after that risks a reject for lack of a valid mandate. The 2014 migration converted the old French direct debit authorizations into SEPA mandates. Every new relationship requires a compliant signed mandate, and the creditor bears the burden of proof for 13 months.

Chapter 5. R-transactions: when a payment fails.

Every SEPA transaction that doesn’t complete normally generates standardized return messages, called R-transactions. Their terminology tells you who sent the transaction back, when (before or after interbank settlement), and why. Read any returned-payments report through this grid first.

Each return carries an ISO 20022 reason code, which should trigger a different action in your collections process (dunning). Re-presenting only makes sense if the cause is temporary.

• AC01, incorrect IBAN: fix the data, and never re-present as is.
• AC04, account closed: contact the customer for a new mandate, and stop presenting.
• AM04, insufficient funds: a temporary cause, so one or two spaced-out re-presentments are legitimate.
• MD01, unauthorized transaction or invalid mandate: red alert. Check the mandate/UMR chain; a spike in MD01 draws the attention of banks and regulators.
• MD07, debtor deceased: close the direct debit relationship.
• MS02 / SL01, refused by the debtor / blocked by a bank service (blocklist, limits): talk to the customer before presenting again.

For credit transfers, the equivalent is the Recall. The sending bank can request it up to 13 months after an SCT is executed, for only three reasons (duplicate, technical error, fraud). The payee’s bank responds within about 15 business days. It can refuse, notably if the funds are gone or if its customer objects. With credit transfers, prevention (VoP, internal controls) beats remediation.

Chapter 6. pain.001, pain.008: the ISO 20022 plumbing.

All of SEPA speaks ISO 20022, an XML messaging standard organized in families: pain (payment initiation, customer-to-bank), pacs (payment clearing and settlement, interbank), and camt (cash management, statement reporting). A company only needs to master three or four messages to cover most of its production.

<CstmrCdtTrfInitn>
  <GrpHdr>                          <!-- Batch header -->
    <MsgId>BATCH-2026-07-11-001</MsgId>
    <NbOfTxs>2</NbOfTxs>
    <CtrlSum>3150.00</CtrlSum>      <!-- Control sum -->
  </GrpHdr>
  <PmtInf>                          <!-- Payment batch -->
    <PmtMtd>TRF</PmtMtd>
    <ReqdExctnDt>2026-07-15</ReqdExctnDt>
    <Dbtr><Nm>MY COMPANY SAS</Nm></Dbtr>
    <DbtrAcct><Id><IBAN>FR7630004000031234567890143</IBAN></Id></DbtrAcct>
    <CdtTrfTxInf>                   <!-- One transaction -->
      <PmtId><EndToEndId>INV-2026-0457</EndToEndId></PmtId>
      <Amt><InstdAmt Ccy="EUR">1900.00</InstdAmt></Amt>
      <Cdtr><Nm>SUPPLIER GMBH</Nm></Cdtr>
      <CdtrAcct><Id><IBAN>DE89370400440532013000</IBAN></Id></CdtrAcct>
      <RmtInf><Ustrd>Invoice 2026-0457</Ustrd></RmtInf>
    </CdtTrfTxInf>
  </PmtInf>
</CstmrCdtTrfInitn>

pain.008 follows the same logic, plus attributes specific to direct debits: scheme type (Core or B2B), sequence (FRST, RCUR, OOFF, FNAL), the creditor’s SCI, and the UMR and mandate signature date for each transaction. In France, these files usually travel over EBICS (the long-standing bank-to-corporate channel), or over SWIFTNet for large groups. Submission cutoffs are binding. A pain.008 must reach the bank no later than D-1 business day before the due date.

Chapter 7. Use cases and common mistakes.

Eight costly mistakes

• Confusing submission date and execution date: a pain.001 submitted after the cutoff goes out the next business day, and salaries arrive late.
• Forgetting to pre-notify direct debits (14 calendar days by default): this makes it easier for customers to dispute and complain.
• Not having the debtor register the B2B mandate with its bank: a guaranteed reject on the first collection.
• Reusing a UMR or presenting on an expired mandate (36 months with no collection): MD01 rejects across the board.
• Refusing a foreign IBAN: IBAN discrimination, illegal since 2014.
• Ignoring a VoP “close match” or “no match”: in fake bank details fraud, liability tilts toward the payer who approved despite the warning.
• Believing a credit transfer can be revoked: a recall is only a request; with instant payments, the funds are final within 10 seconds.
• Overlooking the 8-week liability under SDD Core: a treasurer must set aside a provision for refund risk on recent collections.