2026-08-17 • 12 Min Read

The Instant Payments Regulation: Engineering Banks for a 10-Second SLA

The EU's Instant Payments Regulation did not ask banks to be faster. It asked them to be instant — and to keep every control that used to run in the gaps between business days running inside a ten-second window, every second of every day. Institutions that treated the deadline as a network upgrade got an SLA-breach machine; institutions that treated it as an architecture problem got a permanent capability.

A Regulation That Changes the Physics of Payments

SEPA Instant Credit Transfer has existed since November 2017, but as an opt-in overlay on top of the standard scheme: a bank could offer it, price it however it liked, and roughly 60% of the market did, unevenly, at extra cost to the customer. Regulation (EU) 2024/886 — the Instant Payments Regulation, in force since April 2024 — ends the opt-in era. Any payment service provider that offers standard euro credit transfers must now also offer the instant variant, execute it in ten seconds or less around the clock, and charge no more for it than an ordinary transfer.

Ten seconds sounds like a network problem. It is not. An ordinary SEPA credit transfer settles within a business day, moving through batches that get screened against sanctions lists refreshed overnight, checked by fraud engines with hours of slack, and reconciled at end of day. IPR asks the same set of controls — anti-money-laundering checks, sanctions screening, fraud detection, liquidity management, core ledger posting — to run to completion, correctly, inside ten seconds, with no batch window to hide in. That is not an SLA tightening. It is a change in what kind of system a bank has to be.

The Deadlines Were Real, and So Was the Rework

The phasing was deliberately staggered but tight. From 9 January 2025, euro-area payment service providers had to be able to receive instant credit transfers 24/7/365, which in practice meant they also had to screen every inbound transaction against EU sanctions lists in real time from that date — a receiving bank cannot credit an account before the check clears. From 9 October 2025, the same institutions had to be able to send instant transfers, and Verification of Payee became mandatory for outbound transfers. Non-euro-area EU member states — Sweden, Poland, and others outside the euro — get an extended runway: receiving by January 2027, sending and Verification of Payee by October 2027.

What separated a genuinely completed programme from a patched one showed up fast. Institutions already running real-time payment cores, or challenger-bank-grade engines built for continuous processing, treated January 2025 as a formality. Institutions running batch-oriented ledgers built thin real-time front ends that queue into a batch core underneath — technically inside ten seconds on a quiet day, brittle the moment volume spikes. And almost everywhere, the sanctions-screening rebuild — from a nightly list refresh to continuous ingestion — turned out to be the tail that wagged the whole programme, because a stale sanctions list is a regulatory finding waiting to happen, not merely a UX defect.

EA = euro-area PSPs. VoP = Verification of Payee. Bars mark the ongoing obligation once each deadline takes effect; dates per Regulation (EU) 2024/886.

Verification of Payee: The New Front Door

Before a transfer executes, the payer's bank must now check, in real time, whether the name the payer typed matches the account holder registered at the destination IBAN — querying the payee's bank or a shared directory and returning a match, close-match, no-match, or not-verifiable signal before the payer confirms the payment. The mechanism echoes schemes already live in the UK and the Netherlands, and it is easy to underestimate how far it reaches: IPR extends the Verification of Payee obligation to ordinary SEPA credit transfers as well as instant ones, not just the fast rail.

The operational bite is in the edge cases. A false "no match" erodes customer trust and generates support tickets on transactions that were entirely legitimate; a false "match" defeats the fraud-prevention purpose, since impersonation and authorized-push-payment fraud are exactly the failure mode Verification of Payee targets. Getting the fuzzy-matching logic right — legal-entity suffixes, transliterated names, joint accounts, diacritics — is a genuinely hard data-quality problem, not an API integration exercise, and the quality of a bank's underlying customer and account records now directly determines how good its Verification of Payee responses are. That is a new and unusually direct incentive to fix data debt that has sat untouched for years.

Sanctions Screening at Wire Speed

The ten-second budget has to include checking every beneficiary and originator against EU, UN, and national designation lists that can change intraday — a new listing can land at any hour, and supervisory expectations require PSPs to screen against updated lists without undue delay, commonly read as hours rather than overnight. Batch architectures built around a nightly list refresh could not survive that requirement unchanged; the pattern that did survive is a continuously ingested, in-memory list cache paired with a pre-built fuzzy-matching index, so a screening call returns in milliseconds rather than seconds.

Speed pressure sharpens a tradeoff that was already uncomfortable. An engine tuned to catch every fuzzy near-match throws off enough false positives to blow the ten-second budget the instant a human has to look at one; an engine tuned for speed risks under-screening. The pattern that emerged is a split path: low-risk transactions get risk-scored and auto-cleared inside the instant rail, while genuinely ambiguous hits are pushed to a hold-and-review queue that deliberately falls outside the instant SLA — a transfer that needs a human is, by design, no longer an instant transfer.

Illustrative allocation of a compliant ten-second processing budget; actual splits vary by PSP architecture and clearing path (TIPS, RT1, or a domestic instant scheme).

Liquidity and Always-On Operations

Twenty-four-seven-three-sixty-five breaks the assumption every core banking and RTGS system was originally built on: a nightly window to reconcile and rebalance. TARGET Instant Payment Settlement (TIPS), the Eurosystem's settlement layer for instant payments, itself runs continuously, and participants must keep sufficient liquidity in a dedicated account at all times — including weekends and public holidays, with no "we'll true it up Monday" fallback.

That forces continuous, intraday liquidity monitoring and forecasting in place of end-of-day batch reconciliation, and it exposes a seam between treasury and payments operations that used to be organizationally comfortable to keep separate — because a liquidity shortfall now blocks live customer transactions in real time rather than surfacing as a settlement exception the next morning. Banks that built automated, continuously rebalancing liquidity buffers absorbed this without drama. Banks still running manual treasury processes found that weekends had quietly become the highest-risk window of their week.

Ten Seconds, One Currency: Why Cross-Border Is the Next Fight

IPR's ten-second guarantee is scoped to euro-denominated transfers within SEPA. It does not yet reach cross-currency transfers or payments outside the scheme, where correspondent banking and FX conversion still take hours to days. The European Commission and the ECB have both signaled interest in pushing instant-payment expectations beyond the euro area, and corporate treasurers — who now simply expect a euro payment to land in seconds — are the loudest voice arguing that the same standard should apply everywhere else too.

The practical read for the rest of 2026: banks that built Verification of Payee, real-time screening, and continuous liquidity management as reusable platform capabilities — not one-off compliance projects bolted onto a legacy core — are positioned to extend instant rails into new corridors as the perimeter grows. Banks that patched their way through 2025 will refight the same battle every time the scope expands, on someone else's timetable.

From Compliance Sprint to Standing Capability

The pattern is a familiar one: a regulatory deadline forces investment, and that investment either becomes durable infrastructure or a patch that needs patching again next cycle. IPR is unusual in how little room it leaves for the patch to hide. A ten-second wall-clock SLA, with supervisory reporting on non-compliance, is not something an integration layer can quietly absorb — failures surface immediately, in production, to a customer watching a spinner.

Banks that used the mandate to rebuild sanctions screening, payee matching, and liquidity management as standing, real-time capabilities now hold a durable operational edge: the same infrastructure differentiates the next fraud rail, the next open-banking data flow, and the next always-on regulatory expectation that arrives without warning. The banks that treated 2025 as a deadline to survive will meet 2027, and whatever follows it, from a standing start all over again.