API Specifications

EPC FAQ: #27386 — Verification Of Payee scheme — Last updated: 26/08/2025

What are best practices to mitigate security risk when sharing a QWAC certificate with an RVM?

PSPs are required to use a QWAC PSD2 certificate when sending a VOP Request for authentication by the Responding PSP.

Read more about What are best practices to mitigate security risk when sharing a QWAC certificate with an RVM?

EPC FAQ: #27501 — Verification Of Payee scheme — Last updated: 24/07/2025

Does a timestamp in the VOP API that contains trailing zeroes for milliseconds, lead to a rejection due to invalid format?

The VOP API specifications include a number of timestamp fields in the headers and body. The format of these timestamps does not allow for trailing zeroes for milliseconds.

Read more about Does a timestamp in the VOP API that contains trailing zeroes for milliseconds, lead to a rejection due to invalid format?

EPC FAQ: #27516 — Verification Of Payee scheme — Last updated: 07/10/2025

What character set should be used in the VOP scheme API specifications and what about the special characters?

As mentioned in the VOP scheme API specifications, only the Latin characters set should be transported in the inter-PSP API messages, through UTF-8. This restriction has been agreed in order to overcome the complexity that

Read more about What character set should be used in the VOP scheme API specifications and what about the special characters?

API Specifications

What are best practices to mitigate security risk when sharing a QWAC certificate with an RVM?

Does a timestamp in the VOP API that contains trailing zeroes for milliseconds, lead to a rejection due to invalid format?

What character set should be used in the VOP scheme API specifications and what about the special characters?

Update from EPC and insights on payments in Europe delivered to your inbox monthly