Virtual IBAN Regulation in the EU: What Applies in 2026

Virtual IBAN regulation in the EU doesn’t yet have one dedicated rulebook. Today, it’s a patchwork of supervisory guidance, national practice and general AML rules that each touch vIBANs from a different angle. That changes on 10 July 2027, when the EU Anti-Money Laundering Regulation starts to apply and vIBAN issuers take on specific, named obligations.

This guide is for licensed institutions that issue vIBANs to their customers, and for the compliance teams that keep those programmes running. We work with institutions at exactly this point, so we’ve written it the way we’d explain it to a new compliance lead: what applies now, what’s coming, and what to get in order before the deadline.

If you’re building compliance into a payments product more broadly, see our approach to embedded compliance.

What Is a Virtual IBAN?

Any discussion of vIBAN regulation starts with a definition, and until recently there wasn’t one at EU level. The AMLR now fills that gap. It defines a virtual IBAN as “an identifier causing payments to be redirected to a payment account identified by an IBAN different from that identifier.”

Put simply, a vIBAN looks exactly like a normal IBAN to the payer. Behind it, every payment routes to a master account, which is where the money actually sits. The vIBAN itself holds no balance.

Institutions use them to give each customer a dedicated number, so every incoming payment is tied to the right customer without manual matching. That’s also why regulators pay attention: one master account can sit behind hundreds or thousands of vIBANs, each used by someone different. For a fuller walkthrough of how they work in practice, read our guide to virtual IBAN accounts.

Virtual IBAN Regulation Timeline

Six dates shape where things stand. Two are already history, one is in force now, and the rest are still ahead.

The 2027 date is fixed. The PSD3 and PSR date isn’t, because the package hasn’t been published in the Official Journal yet. Treat that row as an estimate until it is.

Ready to upgrade your payment infrastructure?

Stop struggling with fragmented payment flows. Access dedicated IBANs, SEPA Instant, and seamless API integrations – all from a single, unified platform.

Contact Sales Explore Our Products

Why There Is No Single Rule Yet

In May 2024, the European Banking Authority (EBA) published its report on virtual IBANs (EBA/Rep/2024/08). Its central finding was simple: there was no EU-level legal definition of a vIBAN.

Without a definition, national regulators filled the gap in different ways. Some treat a vIBAN as an identifier of the master account. Others treat it as a separate payment account in its own right. The EBA also flagged risks around transparency, traceability and consumer protection, especially where the institution holding the master account can’t see who is using each vIBAN.

You’ll often read that vIBANs are “regulated under PSD2”. That’s imprecise. The Second Payment Services Directive governs payment services and the institutions that provide them, but it doesn’t mention virtual IBANs at all. vIBANs fall within the scope of PSD2 only indirectly, through the licensed institutions that issue them.

The practical effect is uneven. Today, what an issuer must do depends on the member state it operates in and the licence it holds.

The EU AML Regulation (AMLR) and AMLD6

This is where virtual IBAN regulation gets concrete. The AMLR (Regulation (EU) 2024/1624) defines a virtual IBAN and applies from 10 July 2027. From that date, credit and financial institutions that issue vIBANs must obtain the information needed to identify and verify the people or entities using them, along with the associated account.

One misconception comes up often: that KYC on the master account holder covers everyone using vIBANs under it. It doesn’t. Under the AMLR, each vIBAN user is a separate point of identification and verification, distinct from the master account holder.

The sixth AML Directive (Directive (EU) 2024/1640, or AMLD6) adds the register side. National bank account registers will have to hold vIBAN information, so authorities can trace a payment from the virtual number back to the real account.

Here’s how the obligations split:

The middle row matters if you use an infrastructure provider: it doesn’t onboard your customers, but it must be able to get their data from you quickly. If you’re reviewing your onboarding standards, our overview of KYC requirements for corporates is a good reference point.

PSD3 and the PSR: What Changes for Virtual IBANs

PSD3 and the Payment Services Regulation (PSR) mention virtual IBANs directly. The Council published final compromise texts in April 2026. But the package isn’t in force yet. Formal adoption and publication in the Official Journal are still pending, and most PSR rules will apply around 21 months after entry into force. That points to application in 2028.

Three changes matter for vIBANs. First, the PSR expressly recognises virtual IBANs as valid payment account identifiers. That settles a question the EBA found regulators answering differently. Second, the Commission must review the risks and benefits of vIBANs within three years, which leaves room for further rules later. Third, IBAN-name checks extend to more credit transfers, beyond the current euro requirement.

That third point builds on something that already exists. Verification of Payee has applied to euro transfers in the euro area since 9 October 2025, under the Instant Payments Regulation. So PSD3 and the PSR extend name checks rather than create them. Either way, the name behind each vIBAN needs to be accurate.

National Supervisors: Germany and BaFin

While EU rules catch up, national supervisors are already acting. Germany’s BaFin is the clearest example.

BaFin moved first in December 2020, with an order requiring institutions to record the end users behind vIBAN structures. Germany had a vIBAN rule years before the EU did.

On 27 July 2026, BaFin went further with Supervisory Communication 6/2026. It confirms that vIBANs remain a legitimate tool. But it flags multi-layered, cross-border structures as a particular risk. In those setups, the institution holding the master account may only know its direct payment partner, not the businesses or people actually using the vIBANs further down the chain.

The communication introduces no new legal obligations. It applies immediately and stays valid until the AMLR applies on 10 July 2027. Where structures are layered or opaque, BaFin points institutions toward enhanced due diligence.

This is one supervisor’s view, and other member states may take a different line. Still, it’s a useful signal of where supervision across the EU is heading.

What vIBAN Issuers Should Do Before 10 July 2027

This isn’t legal advice. But if we were preparing a vIBAN programme for the new virtual IBAN regulation, we’d check these five things first:

1. Map every live vIBAN. Each one should link to an identified and verified user and the associated account. No unassigned or shared vIBANs should stay in use.
2. Review existing user data. vIBANs issued before July 2027 must meet the new rules too, so check existing identification data against AMLR standards.
3. Agree on data requests. Settle with the institution servicing your master account how it will get your identification data on request, within 5 working days.
4. Document your risk approach. Write down how you risk-assess layered or cross-border vIBAN structures, including when you apply enhanced due diligence.
5. Keep clean records. Log each vIBAN’s number, the account it routes to, and its opening and closing dates, since national registers will hold this data under AMLD6. Keep block and unblock events in your own audit trail.

Issuers who already keep these records will find the July 2027 deadline mostly a documentation exercise.

How ConnectPay Approaches Virtual IBAN Compliance

Our vIBANs are LT-prefix IBANs that licensed institutions issue to their own business customers. They’re EMIs, payment institutions and specialised banks licensed in the EEA, UK, US or another accepted jurisdiction, with their own AML/KYC programme.

Each vIBAN routes to the institution’s master account with us and holds no balance of its own. Payments are sent and received in the end customer’s name, with Verification of Payee, and every incoming payment arrives tagged to the right customer with full payer details. Institutions manage vIBANs through our API (open, block, unblock, close and list), with webhooks, and can use them for SEPA, SEPA Instant and internal transfers only.

The split of roles is clear. The institution handles KYC and monitoring, and its end customers are never onboarded to ConnectPay. We provide the infrastructure and safeguard the funds. Using us doesn’t remove the institution’s own obligations under the AMLR.

Platforms, marketplaces and regular businesses should use our Business, Personal or Segregated IBAN accounts instead. For the wider market, see our roundup of virtual IBAN providers.

Treat Every Virtual IBAN as a Regulated Identifier, Not Just a Number

The details are still settling, but the direction isn’t in doubt. Every step points the same way: more identification of vIBAN users, more records, and more supervisory attention. The EBA named the gap, BaFin is already acting on it, and the AMLR turns it into law on 10 July 2027.

For issuers, that means a vIBAN can no longer be treated as a routing label someone else is responsible for. Each one needs a known user, a known account and a clear paper trail.

Institutions with clean user records and well-defined structures will adapt most easily. The ones that will struggle are those still untangling who uses which number. If you’re planning a vIBAN programme or reviewing an existing one, get in touch with our team.