The European Banking Authority released a report on 24 May addressing the issuance of virtual international bank account numbers (vIBANs), digital representations of traditional IBANs used to identify bank accounts globally. The highlighted inconsistencies in defining, interpreting and applying regulatory requirements for vIBANs across the industry and national authorities. These inconsistencies have raised significant concerns regarding money laundering, terrorist financing, consumer and depositor protection, authorisation and passporting, and regulatory arbitrage.

Earlier, in July 2023, the EBA an opinion on ML/TF risks associated with vIBANs, particularly due to a lack of legal certainty concerning customer due diligence (CDD) rules and challenges in monitoring and reporting suspicious transactions.

Following the opinion, the EBA conducted a broader assessment of practices involving vIBANs issued by payment service providers (PSPs) and other entities. This evaluation focused on market integrity, consumer protection and payment system implications. The resulting report, published on Friday, detailed the primary characteristics and use cases of vIBANs, identified potential benefits as seen by market participants, and outlined the associated risks.

Risks and recommendations

One of the potential risks highlighted by the EBA is the absence of a legal definition for vIBANs at the EU level, resulting in a lack of uniform understanding among national competent authorities and the industry. This ambiguity leads to divergences in interpreting and applying existing EU financial services laws, particularly the Anti Money Laundering Directive, the Payment Services Directive, the Capital Requirements Directive, and the SEPA Regulation, said the EBA, undermining the EU single market and fostering regulatory arbitrage.

In response, the 30-page report included recommendations for clarifying EU law and suggested actions that national competent authorities could take to address these issues. The EBA called for coordinated efforts to develop a comprehensive legal framework for vIBANs to ensure effective regulation and supervision across the EU. Additionally, the report provided several recommendations to mitigate identified risks, including potential amendments to Level-1 legislation. The EBA stressed that the legitimacy of various business models for vIBANs should be evaluated on a case-by-case basis in collaboration with competent NCAs within member states.