Facebook-f Linkedin-in Twitter

Virtual IBANs and Fraud: What the AMLR Will, and Will Not, Change

  • EFRI
  • Related News
virtual IBANS

EFRI Analysis | Regulation (EU) 2024/1624 (AMLR), Art. 2(1)(26) and 22(3) · Directive (EU) 2024/1640 (AMLD6), Art. 16 · BaFin Supervisory Communication 6/2026 · EBA/Rep/2024/08 | 12 November 2026

A virtual IBAN looks exactly like an ordinary bank account number. In most cases, however, the person or company using it does not hold an account at the bank whose code the IBAN carries. That gap between what the payer sees and who actually receives the money has become a recurring feature of the fraud cases reported to EFRI.

From 10 July 2027, the EU Anti-Money Laundering Regulation (AMLR) will for the first time define virtual IBANs in EU law and impose a specific identification duty on the institutions that issue them.

This analysis explains how virtual IBANs work and how fraudsters exploit them. It then sets out what the AMLR actually requires and assesses whether victims will notice any difference.

1. How a virtual IBAN works

A virtual IBAN (vIBAN) is a number in IBAN format that does not necessarily identify a separate account. Payments sent to it are automatically redirected to an underlying account, often called a master account. A simple chain looks like this:

Bank → payment service provider (PSP) → end customer

A bank opens a master account for a payment institution or e-money institution and gives it a range of IBANs carrying the bank’s country code and bank code.

The PSP allocates individual vIBANs to its own customers.

When money arrives on Customer A’s vIBAN, it is credited to the PSP’s master account. The vIBAN tells the PSP that the funds belong to Customer A.

Customer A has a contract with the PSP, not with the bank. The bank knows the PSP. The PSP knows, or is supposed to know, Customer A.

The structure has legitimate uses. It allows businesses to reconcile incoming payments automatically and to allocate them to customers, invoices or business lines. It also lets PSPs from one Member State offer local IBANs in another, which works around the persistent refusal of some payers and merchants to accept “foreign” IBANs despite the SEPA Regulation. The European Banking Authority (EBA) documented these benefits in its May 2024 report on virtual IBANs (EBA/Rep/2024/08).

The payment chains are often longer than three links. A PSP can pass vIBAN ranges on to another PSP, which allocates them to its own clients. Each additional layer reduces what the bank at the top can see.

2. What the payer sees, and what the name check confirms

To the payer, a vIBAN is indistinguishable from an ordinary IBAN. A German-format IBAN suggests a German bank account. A payer reasonably assumes that the named recipient holds an account at the bank behind the bank code, which has identified the recipient and monitors the account. BaFin has pointed out that such arrangements can create exactly that impression, when in fact the end customer’s relationship is with a PSP, often one based abroad.

Since 9 October 2025, euro-area payment service providers must offer Verification of Payee (VoP) before a credit transfer is executed: Article 5c of Regulation (EU) No 260/2012, inserted by the Instant Payments Regulation (EU) 2024/886. VoP checks whether the name the payer enters matches the name recorded for the IBAN. For a vIBAN, the recorded name is that of the vIBAN user. If the fraudster has set the vIBAN up in a name the payer expects, the check returns a match.

VoP was designed to stop misdirected payments and impersonation of known payees. It cannot tell the payer that the “account” is virtual, which institution actually holds the funds, or who controls them. In vIBAN fraud, a positive match does not protect the payer. It reassures the payer at exactly the moment a warning would be needed.

3. Three abuse patterns in EFRI’s files

Pattern 1: the fake merchant. German banks – Deutsche Handelsbank as an example – had issued vIBANs to intermediary PSPs, many based abroad, which passed them on to their own customers. Law-enforcement agencies increasingly reported these vIBANs being used in online-fraud. Payers believed they were paying into a German account while the money ended up abroad, and perpetrators often could not be identified.. In response, BaFin’s General Administrative Order of 8 December 2020 under § 24c of the German Banking Act (KWG) required German institutions to record vIBANs, including the persons entitled to dispose of them and the beneficial owners, in the account-retrieval system available to authorities.

Pattern 2: the corporate-name receiving account. In a case reported to EFRI in November 2026, an Austrian investor lost €84,349 to an online trading scheme. Three of his payments, €29,000 in total, went in June and July 2026 to two German GmbHs. Their IBANs carry the bank code of Banking Circle S.A.’s German branch. For each transfer his bank’s name check confirmed the company name. Banking Circle states publicly that it provides (virtual) IBANs to regulated clients, who assign them to their own customers, “with whom Banking Circle has no business relationship” (Banking Circle). The victim cannot tell from his bank records whether he paid into a real account or a virtual one, nor which PSP’s customer controlled it. See EFRI’s Case Note “One Bank Code, Eight Years”.

Pattern 3: the victim-named vIBAN. This is the pattern EFRI encounters most often in investment fraud, and it is the most damaging. The fraudster arranges for a vIBAN to be created in the victim’s own name. The victim is told to “transfer money to your own trading account”. The payment looks like a transfer between two of the victim’s own accounts. The name check returns a match, and the sending bank’s fraud filters see no third-party beneficiary.

Kraken / Banking Circle (2026). An Austrian consumer made three transfers totalling €60,749 to German-format IBANs that Kraken displayed inside its app as his own “fiat funding details”. Each transfer named him as beneficiary, and each name check returned a match (EFRI, 8 September 2026).

OpenPayd / WeWire (2026). A 71-year-old Austrian transferred €121,520.99 (net of one returned payment) to a Maltese OpenPayd IBAN bearing his name. OpenPayd’s response to his data-access request shows that the IBAN record was created on 11 August 2026 through the API of a corporate client, WeWire Technologies Inc. It had a system-generated e-mail address and no onboarding contact with him. OpenPayd described WeWire as its customer and the victim as WeWire’s “sub-customer”.

OpenPayd / ClearBank (2026). A Viennese couple transferred €386,400 between May and June 2026 to a Dutch-format IBAN in the wife’s name. The IBAN was routed via ClearBank to OpenPayd, whose customer was WeWire, whose customer in turn was a Polish crypto company. The couple say they never opened an account with any of these firms.

In each case, the institution whose code appears in the IBAN, the PSP that issued the vIBAN and the firm that actually controlled the funds were three different entities. The victim knew none of them.

4. What supervisors have said so far

The EBA (May 2024) found that there was no legal definition of vIBANs at EU level and that industry and national authorities applied existing rules inconsistently. It identified risks for anti-money-laundering controls, consumer and depositor protection, authorisation and passporting, and regulatory arbitrage. It recommended clarifications to EU law and supervisory action by national authorities.

BaFin (27 July 2026) issued Supervisory Communication 6/2026 on money-laundering and terrorist-financing risks in vIBAN structures. It applies until the AMLR becomes applicable on 10 July 2027. Law firms advising the industry stress that it creates no new legal obligations (Simmons & Simmons, 6 August 2026). It does, however, set out BaFin’s expectations:

Due-diligence and monitoring duties must not stop at the holder of the master account.

Multi-tier and cross-border vIBAN chains are a risk indicator.

Where risk is elevated, institutions must apply enhanced due diligence under § 15 of the German Money Laundering Act (GwG) and run functioning transaction monitoring.

BaFin’s executive director for anti-financial crime, Birgit Rodolphe, said that some institutions offer models in which the money-laundering risk is “significantly increased”.

5. What the AMLR and AMLD6 actually provide

A definition. Article 2(1), point (26) AMLR defines a virtual IBAN as “an identifier causing payments to be redirected to a payment account identified by an IBAN different from that identifier”. The definition is functional. It covers any number that redirects payments, whatever the industry calls it. This closes the definitional gap the EBA identified.

An identification duty on the issuer. Article 22(3) AMLR, in the provision on identifying and verifying customers and beneficial owners, contains two rules:

Credit and financial institutions must obtain the information needed to identify and verify the identity of the natural or legal persons using any virtual IBAN they issue, together with the associated bank or payment account.

Where a vIBAN issued by one institution redirects payments to an account held at another, the institution servicing that account must be able to obtain the identifying information from the issuer without delay, and in any event within five working days of its request.

Registers for authorities. Article 16 AMLD6 requires national centralised automated mechanisms (bank-account registers) to include virtual IBANs. For each one they must record the vIBAN number, the identifier of the account to which payments are redirected, and the opening and closing dates.

Who has access: Financial Intelligence Units (FIUs) get direct, immediate and unfiltered access. AMLA has the same access for joint analyses. Supervisors get timely access.

Cross-border: The national registers are to be interconnected through the EU’s Bank Account Registers Interconnection System (BARIS) by 10 July 2029 (Art. 16(6) AMLD6).

Germany has recorded vIBANs in its account-retrieval system since BaFin’s 2020 order.

Timing. The AMLR applies from 10 July 2027. Until then, the only binding vIBAN-specific rule is national, as in Germany.

6. Will it change anything?

What will improve:

The “we only know the PSP” answer becomes harder to give. Under Article 22(3), an institution that issues vIBANs must itself be able to identify the persons using them. A bank or EMI that hands out ranges of IBANs can no longer limit its knowledge to the PSP in between.

Authorities will be able to trace vIBANs across borders, once the registers and BARIS are in place. That helps investigators and FIUs to reconstruct payment chains after the event.

A common definition ends the argument over whether a given product “is a vIBAN” at all.

What will not change:

The payer still cannot see that the IBAN is virtual. Nothing in the AMLR requires a vIBAN to be marked as such: not in the IBAN, not in the payment message, and not in the name-check response. The victim-named vIBAN in Pattern 3 will produce the same reassuring match in 2028 as it did in 2026.

Five working days is too slow. An instant payment settles in seconds. In EFRI’s files, funds received on vIBANs were typically moved on within hours, often the same day. A five-day information exchange between institutions helps an investigation. It does not stop the money.

Victims get no access. The registers are reserved for FIUs, AMLA and supervisors, and the five-day exchange runs only between institutions. A victim, or the victim’s bank acting on a fraud report, has no right under the AMLR to learn which PSP or end user controlled the vIBAN. Victims remain dependent on data-access requests under Article 15 GDPR, on police investigations and on the institution’s goodwill.

No liability rule. The AMLR is public-law prevention. It creates no civil claim for victims when an institution fails to identify a vIBAN user. Whether such a breach supports a claim for damages is left to national law and remains contested.

Nested chains remain unclear. Article 22(3) speaks of the persons “using” the vIBAN. Where a vIBAN passes through several PSPs, the text does not say whether the “user” is the next PSP down the chain or the end customer. In the OpenPayd cases above, the record named the victim, while the corporate client that created it controlled the funds. Whose identity did the issuer “verify”?

The payment-services reform does not fill the gap.

The other side of the argument. vIBANs are a lawful and useful tool. Treating every vIBAN as suspicious would push legitimate payment flows towards less transparent channels.The AMLR’s identification duty is a genuine step, and under the risk-based approach the PSP closest to the end customer has the best information. It can also be argued that disclosing vIBAN structures to every payer would expose commercial relationships and confuse consumers. These points have weight. They do not explain why the protection mechanisms the EU has chosen, the name check above all, should confirm a payment to a vIBAN in the victim’s own name without any indication that the account is virtual.

Our Assessment

The AMLR treats virtual IBANs as a traceability problem for authorities. For victims of investment fraud they are something else: an attribution problem at the moment of payment, and an addressee problem afterwards. The rules that apply from 2027 will help investigators reconstruct where money went. They will not stop money from leaving, and they will not tell victims whom to hold responsible.

That matters because the receiving side of the payment chain is where accountability can attach. The institution whose code appears in the IBAN is findable, regulated and solvent. When it can answer that it has “no business relationship” with the user, victims are left without a counterparty. Article 22(3) AMLR weakens that answer. The rest of the framework has not yet drawn the consequences.

EFRI calls for five measures:

A vIBAN marker. A machine-readable flag in the payment message and in the name-check response, stating that the IBAN is virtual and naming the institution that actually holds the funds. The payer’s bank can then warn when a “transfer to own account” is in fact a payment to a third-party PSP.

A response to fraud reports within hours. When the payer’s bank or a victim’s representative reports fraud on a vIBAN, the issuing institution should be obliged to block, to identify the PSP and the end user to the reporting bank and the police, and to document what it did, within hours rather than five working days.

A route for victims. Victims, or their authorised representatives, should be able to learn the identity of the PSP behind a vIBAN they paid, without having to wait for a criminal investigation.

Liability after notice. The proposed PSR already gives prevention duties financial consequences. Under Articles 73(3) and 87(3), receiving-side failures to act on clear and incontrovertible fraud indications, or failures to perform required transaction monitoring, can trigger liability. For vIBAN arrangements, the question is which institution bears those duties and whether a substantiated fraud notice meets the applicable threshold. EFRI calls for effective enforcement throughout that payment chain.

Closing the “own account” loophole. The Commission should clarify, as the EBA requested in 2024, how the name check applies to vIBAN end users. A payment to a vIBAN in the victim’s own name, created through a third party’s API, should never return an unqualified match.

Until these measures exist, EFRI will continue to document every fraud notice its members send on virtual IBANs. A recorded notice establishes when an institution knew, and that date is the starting point for any later liability claim.

Sources

More about this topic.

More News

Virtual IBANs and Fraud: What the AMLR Will, and Will Not, Change

  • EFRI
  • Related News

More News