Why an Open Banking expert is the ideal partner for VOP
As PSPs have to implement a free-of-charge and real-time Verification of Payee service by October 9th 2025, the European Payments Council (EPC) had released a series of several key documents. From the EPC VOP Scheme guidelines to VOP Inter-PSP API specifications and more, one key element stands out from the crowd: Open Banking players, that have developed a strong expertise in connectivity and mutualization, are well equipped to support Payment Service Providers in their current VOP challenges.
Electronic identification for increased security
In the context of Open Banking in the European Union, TPPs (Third Party Providers) authentication and authorization rely on the eIDAS (electronic IDentification, Authentication and trust Services) regulation and notably on QWAC PSD2 (Qualified Website Authentication Certificate) certificates. In its VOP Scheme, the EPC has reused this authentication mechanism based on the said certificates, in order to minimize the impact on PSPs and other stakeholders.
Concretely, in a VOP verification flow, the Requesting PSP is expected to use a QWAC PSD2 certificate as technical means for authentication (see below). On the other hand, the Responding PSP should verify, based on the EPC Directory Service (EDS) extract, if the combination of the BIC of the Requesting PSP and the Authorization Number retrieved from the QWAC PSD2 certificate are present. This step will be required regardless of the sender of the message, either the Requesting PSP directly, or the RVM acting on its behalf.
LUXHUB, as an Open Banking enabler and one of the biggest Open Banking hubs in Europe, has developed an expertise in connectivity and authentication, based notably on QWAC PSD2 certificates. In this respect, the Payee Verification Platform provided by LUXHUB, which is listed on the EPC website as a recognized RVM (Routing and/or Verification Mechanism) benefits from this technical and compliance expertise developed through the years, particularly when it comes to the collection, safe storage and use of the above-mentioned certificates on behalf of TPPs.
As explained during the EPC RVM Information Session #1 in the month of January, “in the context of VOP API specifications and of the API Security Framework (ASF), the following analogy applies “by design”: (1) the TPP role (AISP, PISP, CBPII) matches the role of a VOP Requesting PSPS (or VOP API client), (2) the ASPSP role matches the role of a VOP Responding PSP (or VOP API server), and (3) the TSP (Technical Service Provider) role(s) matches the RVM role(s) (or VOP API proxy)”.
The following visual depicts the different steps, from the initial request from either the PSU (XS2A) or the Requestor (VOP), with the presence of LUXHUB as a technical service provider in the context of Open Banking, or as a RVM (on the requesting or responding side, or both) for VOP, in the middle of the process.
In both cases – PSD2 and VOP – the technical service provider (TPP or RVM) is not a regulated entity. Yet, being regulated, like LUXHUB, represents a key advantage: as a Payment Institution (AISP/PISP) and Support PFS (Professional of the Financial Sector), the company and its compliance-related services are supervised by the NCA (National Competent Authority – the CSSF in Luxembourg). This specific status ensures that the right safeguards are put in place when it comes to data sharing and security, while also reassuring clients and partners in LUXHUB’s ability to deliver quality and compliant solutions to the financial services industry.
Connecting PSPs all over Europe
Another point of analogy between Open Banking and Verification of Payee ecosystems is the massive scale of services interconnectivity required between consumers and providers.
The ONE Connect service offered by LUXHUB of account aggregation and payment initiation services available to European banks and leveraging PSD2 APIs. The solution currently covers several markets in the EU (notably France, Germany, Belgium, Portugal and more) with more than 530 banks supported.
Account aggregation and more generally connecting with different sets of eIDAS certificates to other PSPs in Europe, located in different countries and using different standards, represents an important challenge. Through ONE Connect, which is already used by thousands of end users, LUXHUB once again demonstrated its expertise, and willingness to facilitate the access of data and information, removing the technical barriers for PSPs.