🏦 SEPA credit transfers and direct debits

The four SEPA rails: SCT, SCT Inst, SDD Core, and SDD B2B

SEPA credit transfers and SEPA direct debits are two euro-denominated, bank-money payment instruments governed by common rules across the area. A credit transfer is initiated by the payer, who instructs the movement of funds. A direct debit is initiated by the creditor, based on a mandate signed by the debtor. The European Payments Council (EPC) publishes four versions, called schemes, whose rules on timelines and revocability differ from one scheme to another. In France, in the first half of 2025 (according to the OSMP, France’s payment security observatory, in a statistical note published January 27, 2026), credit transfers accounted for 17.9% of cashless transactions by number and 90% of the value exchanged. Direct debits accounted for 14.3% of transactions, with an average amount of €453, typical of a recurring bill rather than an occasional payment. The distinction between SDD Core and SDD B2B determines the refund window: eight weeks, no questions asked, in the first case, and none at all in the second for an authorized transaction.

Reading an IBAN correctly

FR 14 20041 01005 0500013M026 06      French IBAN: 27 characters (34 max, ISO 13616)
|  |  |     |     |           |
|  |  |     |     |           +-- RIB key: 2 digits, legacy French national check
|  |  |     |     +-------------- account number: 11 characters, digits AND letters
|  |  |     +-------------------- branch code: 5 digits
|  |  +-------------------------- bank code: 5 digits
|  +----------------------------- IBAN check digits: 2 digits, ISO 7064 MOD 97-10
+-------------------------------- ISO 3166-1 country code (FR)

# Checking the IBAN check digits by hand:
#   1. move the first 4 characters to the end    -> 20041010050500013M02606FR14
#   2. convert letters to digits, A=10 ... Z=35  -> 200410100505000132202606152714
#   3. the result modulo 97 must equal exactly 1 -> IBAN is arithmetically valid
# National lengths: 27 in France, 22 in Germany, 16 in Belgium, 15 in Norway.
# A shorter IBAN is therefore perfectly normal, and SEPA no longer requires the BIC.

The IBAN, or International Bank Account Number, is the standardized bank account identifier defined by ISO 13616. It combines a country code, check digits, and a national account identifier, and its total length varies by country. Two features of this structure govern how it is used. First, the BIC is no longer required for a SEPA credit transfer or direct debit: Regulation (EU) No 260/2012 removed that requirement in February 2014 for domestic transactions and in February 2016 for cross-border ones. A form that still asks for it adds a data-entry step, and therefore a source of errors, without improving processing. Second, the IBAN check digits prove only that the number is arithmetically consistent. An IBAN that passes the calculation may belong to a closed account or to a fraudster. The account holder is not verified. Verification of payee, mandatory since October 9, 2025, addresses exactly that point.

VOP: what verification of payee has checked since October 9, 2025

Verification of payee (VOP) is the check that compares the name entered by the payer with the actual holder of the account identified by the IBAN, before the transfer is authorized. It has been mandatory for every payment service provider (PSP) in the euro area since October 9, 2025, under Article 5c of the SEPA Regulation. That article was inserted by Regulation (EU) 2024/886 on instant payments, which made instant credit transfers mandatory in the euro area. The payer’s bank queries the payee’s bank, which holds the name registered on the account. The check takes place before any authorization, whether or not the transfer is instant. The service is free (Article 5b(2)) and must be offered on every initiation channel. Paper instructions are subject to the same check, carried out on receipt if the payer is present. The EPC standardizes the exchanges between PSPs through the VOP rulebook, which took effect on October 5, 2025, four days before the regulatory deadline.

• Normalization before comparison: case ignored, accents and diacritics neutralized (é = e, ö = o = oe), titles and punctuation removed, leading and trailing spaces trimmed (EPC288-23 recommendations, October 2024).
• Individuals: exact first and last name = Match; the exact name of just one of the joint account holders is enough.
• Legal entities: the trade name can count as a Match if the payee’s bank has a reliable source for it, in addition to the registered company name.
• Close match: two transposed letters, a first name reduced to an initial, a phonetic substitution, or a misspelling below the Levenshtein distance threshold set by the payee’s bank.
• Identification codes (VAT number, legal entity identifier): Match or No match only; no Close match is possible on a code.
• The payee’s bank is responsible for the verdict it returns: that bank, not the payer’s, decides what counts as a Match.

The regulation allocates liability among providers based on whether each has met its own obligations. A PSP that has met them is not liable for a transfer executed to the wrong payee on the basis of an incorrect unique identifier. A failure on its part, such as not offering VOP or not giving the payer the result, can however make the transaction defectively executed. In that case, it refunds the amount transferred without delay and restores the debited account. When the failure lies with the payee’s bank or the payment initiation service provider, liability shifts to them (Article 5c(8)).

SCT Inst and the IPR: what actually changed in 2025–2026

• Tighter intermediate deadlines in the 2025 SCT Inst rulebook v1.1 (EPC004-16, in force since October 5, 2025) to meet the statutory 10 seconds. The old 10-20-25 s sequence becomes 5-7-9 s: a 5 s target for confirmation by the payee’s bank (down from 10 s), time-out at 7 s (down from 20 s), and receipt of the confirmation by the payer’s bank by the 9th second at the latest (down from the 25th).
• Millisecond time stamps are mandatory (the Time Stamp attribute): they are the reference for measuring the 10 seconds.
• After 10 s without confirmation, the payer’s bank must immediately restore the payer’s account and notify the payer.
• Sanctions screening redesigned (Art. 5d): screening covers the customer base, immediately after any list update and at least once every calendar day. Rescreening the payer and payee transaction by transaction is prohibited, which removes the main source of delays.
• SCT Inst Recall: only one per transaction, for limited reasons (duplicate, technical problem, fraudulent transfer); 10 banking days, extended to 13 months for fraud; the payee’s bank has 15 business days to respond, after which a Request for Status Update is the only recourse.

The direct debit mandate: SCI, UMR, and pre-notification

FR 72 ZZZ 123456      French SCI (ICS): 13 characters (35 max in SEPA)
|  |  |   |
|  |  |   +-- national identifier, 6 alphanumeric characters (formerly NNE), assigned
|  |  |       by the Banque de France via the creditor's bank
|  |  +------ business code (Creditor Business Code): 3 free characters, chosen
|  |          by the creditor, NOT included in the check digits, NOT checked by
|  |          the debtor's bank -> they do NOT create a new creditor
|  +--------- check digits, ISO 7064 MOD 97-10, calculated on country + national
|             identifier only
+------------ country code: FR, MC (Monaco), NC, PF, WF

# Mandate uniqueness across SEPA = pair (SCI minus business code; UMR).
# One SCI covers the whole SEPA area: no need for one SCI per country.

<PmtInf>
  <PmtMtd>DD</PmtMtd>
  <PmtTpInf>
    <SvcLvl><Cd>SEPA</Cd></SvcLvl>
    <LclInstrm><Cd>CORE</Cd></LclInstrm>      <!-- CORE or B2B: never mixed -->
    <SeqTp>RCUR</SeqTp>                       <!-- OOFF | FRST (optional) | RCUR | FNAL -->
  </PmtTpInf>
  <ReqdColltnDt>2026-08-05</ReqdColltnDt>     <!-- D: due date = debit date -->
  <Cdtr><Nm>ACME ENERGIE SAS</Nm></Cdtr>      <!-- name shown on the debtor's statement -->
  <CdtrSchmeId><Id><PrvtId><Othr>
    <Id>FR72ZZZ123456</Id>                    <!-- SCI (ICS) -->
    <SchmeNm><Prtry>SEPA</Prtry></SchmeNm>
  </Othr></PrvtId></Id></CdtrSchmeId>
  <DrctDbtTxInf>
    <PmtId><EndToEndId>FACT-2026-08-004512</EndToEndId></PmtId>
    <InstdAmt Ccy="EUR">64.90</InstdAmt>
    <DrctDbtTx><MndtRltdInf>
      <MndtId>RUM-CLI-004512</MndtId>         <!-- UMR: identical for the life of the mandate -->
      <DtOfSgntr>2024-03-11</DtOfSgntr>       <!-- signature date: can be relied on in a dispute -->
    </MndtRltdInf></DrctDbtTx>
    <Dbtr><Nm>MARTIN DUPONT</Nm></Dbtr>
    <DbtrAcct><Id><IBAN>FR1420041010050500013M02606</IBAN></Id></DbtrAcct>
  </DrctDbtTxInf>
</PmtInf>

• Mandatory pre-notification: the creditor tells the debtor the amount and date no later than 14 calendar days before the due date, unless both parties agree on a shorter period. A schedule with dates and amounts counts as pre-notification for every line on it.
• UMR: up to 35 Latin characters chosen freely by the creditor, but strictly identical in the first direct debit, all subsequent ones, and all R-transactions. Spaces are discouraged (they cause rejects when files are read manually), and the CFONB, France’s banking standards body, recommends including no sensitive data (IBAN, ID document number, card number).
• Lapse after 36 months: a mandate with no direct debit presented for 36 months after the last due date lapses, as does a mandate after a collection with sequence type FNAL. Resuming collections requires a new mandate and a new UMR.
• Sequence type: since version 9.0 of the SDD Core rulebook, applicable from November 2016, using FRST for the first collection in a series is optional, and RCUR is accepted from the very first collection. An inconsistent sequence, however (an RCUR after an OOFF), triggers an AG02 reject.
• Retention: the creditor must be able to produce the mandate for at least the full dispute window for unauthorized transactions, or 13 months after the last direct debit. This is the copy the debtor’s bank will request.

The life cycle of a direct debit, from D-14 to D+13 months

After 8 weeks, the basis for a debtor’s claim changes. Only a transaction presumed unauthorized, because the mandate never existed, was revoked with the creditor, or lapsed after 36 months, can still be disputed, for up to 13 months. The debtor’s bank then applies the proof-of-consent investigation procedure, which requires the creditor to produce a copy of the signed mandate. In France, each step of this procedure has a time limit. The debtor’s bank forwards the claim within 4 banking days, and the creditor’s bank passes it on to the creditor within 3 days. The creditor responds within 7 days, and the debtor’s bank concludes within 4 days of the response, no later than 30 calendar days after its customer’s claim. The refund may include compensatory interest calculated on €STR. Under French law, the foundation is the Monetary and Financial Code. Its Article L. 133-18 requires immediate refund of an unauthorized transaction, and Article L. 133-24 sets the reporting deadline at 13 months after the debit. Article L. 133-25 grants the right to a refund of an authorized direct debit within 8 weeks.

Core or B2B: the choice that determines return risk

The choice between the two schemes comes down to the risk of returns versus the cost of obtaining the mandate. B2B is used when individual amounts are high, the contractual relationship is stable, and the debtor is equipped to handle mandate registration with its bank. Commercial rents, franchise fees, and recurring supply orders meet those conditions. For a €49-a-month software subscription sold online to microbusinesses, the balance flips. The friction of mandate registration, in both delay and signature rate, far outweighs the risk of returns. Core, combined with automated follow-up on reject codes, then costs less than a B2B mandate.

When it fails: ISO codes, deadlines, who pays

Credit transfers have a narrower set of R-transactions than direct debits, and each procedure depends on when the problem is detected. Before settlement, the originator’s bank or the CSM rejects the transaction (invalid IBAN or BIC, duplicate, file past the cut-off). After settlement, the payee’s bank can return the transaction within 3 banking days (closed account, deceased payee, transfers not allowed on that account type, payee refusal). Finally, the originator’s bank can initiate a Recall within 10 banking days, for three reasons only: duplicate, technical problem, or fraudulent transfer. The deadline extends to 13 months for fraud. Only one recall is allowed per transaction, and the payee’s bank has 15 business days to respond. For any other reason, such as the customer sending money to the wrong payee, the only option left is a Request for Recall by the Originator, which requires the payee’s consent. Technically, the request is sent with camt.056.001.08 and the response with camt.029.001.09.

Deadlines to put on the calendar