The Finland Financial Supervisory Authority reviewed nine banks' compliance with the EU Instant Payments Regulation and with earlier supervisory recommendations on online and mobile banking security. It found that instant credit transfers are now available in almost all euro-denominated payment accounts and key channels, and that execution within the 10-second deadline is generally working well. However, the review identified gaps in how some banks handle failed execution confirmations, customer security limits, payee verification and customer warnings, and fraud monitoring. A separate survey of sanctions screening linked to the new instant payments obligations will feed into separate supervisory actions on sanctions monitoring. The authority urged banks to follow the regulatory procedure requiring the payer's bank to return funds if the payee's bank does not confirm within 10 seconds that funds have been made available, and to promptly inform the payer and any payment initiation service provider of the outcome. On security limits, all banks offer limits and require strong customer authentication when customers raise them, but practices still vary and not all banks fully meet the requirement to let customers set both transaction-specific and daily limits for instant payments. The review also found shortcomings in payee verification, including service disruptions, weaknesses in matching the payee's name and account number, and warnings that in some cases do not clearly explain the risk of sending money to the wrong recipient or the effect on the bank's liability. Fraud monitoring has improved, with most banks using behavioural analysis and automated blocking of suspicious payments, but the authority recommended broader use of customer behaviour factors, more risk-based automated blocking, real-time blocking of credential use in critical cases, stronger controls when authentication apps are activated on new devices, and adequate staffing for fraud prevention and case handling. The authority said it will monitor the correction of the identified shortcomings in future supervision. The new recommendations supplement those issued in a supervision release on 9 October 2025.
Finanssivalvonta2026-06-04
Finland Financial Supervisory Authority identifies shortcomings in banks' compliance with the EU Instant Payments Regulation across nine banks
The Finland Financial Supervisory Authority found that nine banks have broadly rolled out instant euro credit transfers and generally meet the 10-second execution deadline, but identified compliance gaps under the EU Instant Payments Regulation. The main issues concern failed-payment handling, customer security limits, payee verification warnings and reliability, and fraud monitoring. Separate findings on sanctions screening will be used in further supervisory action.