Instant euro transfers become compulsory outside the euro area in January. Nothing in the regulation says who carries the fraud loss.

From 9 January 2027, a bank in Warsaw, Prague, Stockholm or Bucharest has to be able to receive a credit transfer in euro and have the money in the customer's account inside ten seconds — at three in the morning, on a Sunday, in August. From 9 July 2027 it has to be able to send one. That is four months and ten months. The second date is the one that costs money.

What changes is a single property of the payment: it becomes final before anyone can look at it. A SEPA credit transfer that settled next business day could be stopped in the queue by someone who came in early. An instant transfer is in the beneficiary's account before the call reporting it has connected.

The cost sits in three places, none of them the ten seconds. Liquidity has to be available on a Saturday night, which means prefunding a settlement position against a weekend nobody staffs. Sanctions screening has to be rebuilt, because the regulation moves the check off the transaction and onto the customer. And the name-check has to be wired into every channel a payment can start in, including the ones the payments team does not own.There are more obligations than three. The charging rule, the reachability requirement and a later date covering these PSPs' national-currency accounts are all in the text. These three are the ones that eat a quarter.

The liquidity problem arrives before the payments problem

A batch rail has a cut-off, and a cut-off is a control. It is where reconciliation happens, where the exception queue gets worked, and where someone notices that a corporate customer has sent forty-one payments to the same new beneficiary since lunch.

Twenty-four by seven removes the cut-off, not the reconciliation. That still has to happen, now against a moving position, in a window that never closes. Firms prefund generously, which is expensive and quiet, or tightly, which is cheap until the Sunday it is not. Either way the choice is made by someone who will not be in the room when the consequence lands.

The sanctions check moved, and it did not make the slide

Screening every transaction against a list, in flight, cannot be done reliably in ten seconds without a false-positive rate that would stop the rail. So the regulation stops asking. The obligation shifts to checking your own customers against the EU designated-persons lists on a regular cadence, and letting the payments through in between.

That is a defensible engineering decision and a real change in where the risk sits. The answer to "was this payment screened" becomes "the parties were, recently". Compliance functions that have spent fifteen years describing a transaction-level control to supervisors need a new sentence, and it is a weaker one.

Close match is a state, not an answer

Verification of payee is the control the whole fraud story now rests on. Before the payer confirms, their bank asks the beneficiary's bank whether the name matches the account. The answer comes back in one of four states: match, close match, no match, or the check could not be performed.

Two of those are easy. A match tells the payer nothing new. A no match, ignored, puts the loss on the payer, and that is both fair and long-settled.

The middle state is the product. Close match is what comes back when the account belongs to Krystyna Nowak and the payer typed K. Nowak — a legitimate payment — and also when a mule account has been opened in a name chosen to sit one character from a real builder's. The bank must display something, and whatever it displays is a warning the customer has seen many times and been right to ignore nearly every time.

A warning that is correct to dismiss ninety-nine times teaches the customer to dismiss it the hundredth.

The regulation puts the loss on the PSP where the PSP failed to provide the check and the customer suffered as a result. It does not, so far as we can read it, say what happens when the check was provided, returned close match, and the payer went ahead. We could not establish that any Member State has answered this in national law either.

What the text declines to do

It does not create a reimbursement regime for authorised push payment fraud, and was never meant to. That rewrite lives in the payment services revision, a separate file, and where the file stands this month we could not establish with enough confidence to print.

So the sequence is fixed. The rail goes live outside the euro area in January. The rule allocating loss on a payment the customer was tricked into authorising arrives later, or does not. Until it does, the allocation is settled by whichever bank holds the weakest position in a complaints process — a policy, just not one anybody voted for.

The United Kingdom ran this in the other order: instant retail transfers first, mandatory reimbursement fifteen years later, once the numbers stopped being explainable. What happened in between is documented, and it is what is about to happen here.

The review is already written

The first quarter after go-live produces a fraud spike. The second produces a review. The review recommends clearer customer warnings and better education. Every review recommends that. The warnings are already there, the education already exists, the fraud works anyway, and whoever signs the recommendation knows all three.

None of which is an argument against the rail. It is a good rail and the public asked for it.

The January date will be met — it is a reachability requirement, and programme managers are good at those. What nobody has settled is what the screen says on a close match, who wrote those words, and what the bank's position is in February when the customer says they read it and pressed confirm anyway.