Identity verification for payment institutions and e-money issuers

What payment institutions and e-money issuers ask of identity checks

The steps of the check itself, from document to release, are on the fintech and neobank page. This page covers what is particular to payments and e-money: which branch of the AML Regulation applies to the event in front of you, and what happens when the check does not pass. A payment institution or an e-money issuer often has a thinner relationship than a bank: a single transfer for a person who has no account, a prepaid balance with a ceiling, a cash payment at a counter.

• Decide, event by event, which branch applies before the first payment moves.
• Check a one-off sender who is not a customer, without asking for an account.
• Look again at a returning customer before a higher-risk action.
• Keep a different scenario for each product.

The flow

1. Classify the event. Your own rules decide whether the event is a new business relationship, an occasional transfer, a cash transaction or the purchase of an e-money instrument, and whether several operations are linked. This step sits in your system, not in the platform.
2. E-money exemption. For an e-money instrument, your supervisor, not the platform, may exempt you from some due diligence measures on the basis of proven low risk. The exemption needs all four conditions: the instrument is not reloadable and the amount stored does not exceed EUR 150; it is used only to buy goods or services from the issuer or within a network of service providers; it is not linked to a payment account and does not permit any stored amount to be exchanged for cash or crypto-assets; and the issuer monitors transactions enough to detect unusual or suspicious ones. If any one condition is not met, the exemption does not apply.
3. Transfer below the line. For a one-off transfer within the Union that does not exceed EUR 1,000 and does not appear linked to other transfers that together exceed EUR 1,000, the sender's details accompany the transfer but need not be verified, unless the funds were received in cash or in anonymous electronic money, or money laundering or terrorist financing is suspected.
4. Transfer at EUR 1,000 or more. A transfer of funds of at least EUR 1,000, in a single operation or through linked transactions, calls for customer due diligence. You create a session, or send the sender a one-time link, or the sender scans a QR code to move from a desktop to a phone. The check runs as described on the fintech and neobank page, and your payment system reads the session status or receives a webhook, and its own rule releases the transfer.
5. Cash at EUR 3,000 or more. A cash transaction of at least EUR 3,000, alone or through linked transactions, calls for at least identifying the customer and verifying the customer's identity. The duty does not apply where the Member State has a limit on large cash payments of EUR 3,000 or less in place, except in the cases the Regulation sets out. Funds received in cash also remove a transfer from the relief in step 3.
6. Doubt about who is acting. If there are doubts as to whether the person interacted with is the customer or a person authorised to act for the customer, due diligence applies whatever the amount. Your rule holds the transfer and asks for a new session. A returning user is compared with a stored reference face.
7. When the check does not pass. Where due diligence cannot be completed, the Regulation tells the obliged entity to refrain from carrying out the transaction or establishing the business relationship, to end an existing relationship, and to consider reporting a suspicious transaction to the financial intelligence unit. Your payment system keeps the transfer held, and a staff member can decide the case manually in the dashboard. A refusal or a report is your decision and your process.
8. Evidence. The session log, reports and export for each check stay in the dashboard. The Regulation requires a copy of the documents and information obtained in due diligence to be retained for 5 years, counted from the end of the business relationship, the occasional transaction or the refusal, without prejudice to other retention rules.

Where this differs from a neobank

The fintech and neobank page describes onboarding for a customer who will keep an account. Here the sender may never become a customer, so the session is tied to one transfer, and three decisions come first: which branch applies, whether operations are linked, and what is done when a check does not pass. The regulatory frame below shows where the texts draw those lines.

Modules used

• Document verification, face verification and liveness.
• QR hand-off and one-time links for a sender who starts on another device.
• Scenario editor: a separate scenario for each product or tier.
• Dashboard for the session log, export and manual decisions.
• REST API and webhooks.

Regulatory frame

What two European Union texts say about identity at the point of payment. The first seven statements are from the AML Regulation, which is forthcoming and applies from 10 July 2027. The last three are from the Regulation on information accompanying transfers of funds and certain crypto-assets, which applies from 30 December 2024.

• Under Article 19(2) of Regulation (EU) 2024/1624, credit institutions and financial institutions, other than crypto-asset service providers, apply customer due diligence measures when initiating or executing an occasional transaction that is a transfer of funds of at least EUR 1,000, whether in a single operation or through linked transactions.
• Under Article 19(4), obliged entities apply at least the identification of the customer and the verification of the customer's identity to an occasional transaction in cash of at least EUR 3,000, whether in a single operation or through linked transactions, subject to the exception the paragraph sets out for Member States that limit large cash payments.
• Under Article 19(1), point (f), obliged entities also apply customer due diligence when there are doubts as to whether the person they interact with is the customer or a person authorised to act on behalf of the customer.
• Under Article 19(7), supervisors may exempt obliged entities from applying, in full or in part, the customer due diligence measures in Article 20(1), points (a), (b) and (c), with respect to electronic money, on the basis of the proven low risk posed by the nature of the product.
• That exemption requires four conditions: the instrument is not reloadable and the amount stored does not exceed EUR 150; it is used exclusively to buy goods or services from the issuer or within a network of service providers; it is not linked to a payment account and does not permit any stored amount to be exchanged for cash or for crypto-assets; and the issuer monitors the transactions or the business relationship enough to detect unusual or suspicious ones.
• Under Article 21(1), where an obliged entity is unable to comply with the due diligence requirement, it refrains from carrying out a transaction or establishing a business relationship, terminates the business relationship and considers reporting a suspicious transaction to the financial intelligence unit.
• Under Article 77, the obliged entity retains a copy of the documents and information obtained in due diligence, and the records of transactions, for 5 years from the end of the business relationship, the date of the occasional transaction or the date of refusal.
• Under Article 4(1) of Regulation (EU) 2023/1113, the payment service provider of the payer ensures that a transfer of funds is accompanied by the payer's name and payment account number, and by the payer's address including the name of the country, official personal document number and customer identification number, or alternatively the payer's date and place of birth.
• Under Article 4(4), before transferring funds the provider verifies the accuracy of that information on the basis of documents, data or information obtained from a reliable and independent source.
• Under Article 5(3), for a transfer within the Union that does not exceed EUR 1,000 and does not appear to be linked to other transfers that together exceed EUR 1,000, the provider of the payer need not verify the information on the payer, unless it received the funds in cash or in anonymous electronic money, or has reasonable grounds for suspecting money laundering or terrorist financing.

This block describes the texts, not our service. For information; not legal advice.

Sources

• Regulation (EU) 2024/1624 of the European Parliament and of the Council, Official Journal text, fetched 26 October 2026.
• Regulation (EU) 2023/1113 of the European Parliament and of the Council on information accompanying transfers of funds and certain crypto-assets, Official Journal text, fetched 27 October 2026.

Next

Try the interactive tour, compare with the fintech and neobank flow or read about the scenario editor.