Regulation (EU) 2024/886 gives payment institutions and EMIs in the euro area until 9 April 2027 to send and receive euro instant credit transfers, 24/7, inside a ten-second window. Simon McFeely sets out what changes, what is enforceable, and where Irish payment firms are most exposed.
By Simon McFeely, Managing Director, Finvisor. Adapted from a briefing delivered to the PCF Peer Group Ireland on 13 May 2026.
Regulation (EU) 2024/886 amends the SEPA Regulation to require that any payment service provider offering euro credit transfers from payment accounts must also send and receive instant credit transfers in euro, on demand, 24 hours a day, every day of the year. There is no opt-out. Payment institutions and e-money institutions offering euro credit transfers are fully in scope, and for non-credit institutions in the euro area the deadline is 9 April 2027. Full compliance is required from that date; there is no phased approach. The penalty regime allows fines of up to 10% of annual net turnover for legal persons, and individual accountability applies under the Irish Individual Accountability Framework.
If you are a PI or EMI that holds client euro payment accounts, you are in scope. If you route payments through a sponsor bank, you remain the contractual provider. If you are a UK-parented Irish entity, the EU-authorised entity is assessed on a standalone basis. Indirect participation in a clearing and settlement mechanism is permitted, but every Article 5a obligation still attaches to you.
The carve-outs are narrow. Money remittance is excluded only where no payment account is maintained in the payer's name, and that needs formal product-level documentation. Internal on-us e-money flows and closed-loop transactions using internal reference numbers rather than IBAN to IBAN fall outside. Individual transactions routed exclusively through TARGET2 are excluded at transaction level, not firm level.
Article 5a(3) to (5) contains the hardest operational constraint in the Regulation. The clock starts at the payer's PSP when the payment is authorised, not at your webhook or API callback, so intermediary latency is your risk. Confirmation must be received within ten seconds. If it is not, restoration of the payer's funds is immediate and non-discretionary; there is no investigation period. Verification of payee sits outside the ten-second clock because it occurs before authorisation. Manual processing after receipt is incompatible with the Regulation. Full straight-through processing for euro payments is a critical-path item for April 2027.
Before the IPR, accepted practice was to screen each payment against the EU sanctions list at the point of execution, hold it in a queue pending human review and release or block on an analyst's decision. After the IPR, that is prohibited for EU targeted financial sanctions during execution. Instead, firms must screen their entire payment service user base at least daily against the EU lists and re-screen immediately on any new or amended designation.
AML/CFT obligations are unchanged; the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 is not displaced. But transaction controls must move to before acceptance or after execution. The Article 5d(2) prohibition applies to EU sanctions only, so real-time OFAC or OFSI screening is not prohibited by the IPR, although any hold requires a clear legal basis and must not breach the ten-second window. A three-bucket model of auto-accept, auto-reject and human review is permissible if designed correctly, with human review confined to onboarding, periodic review and event-driven controls outside the live payment flow. DG FISMA Q&A 90 confirms that PSD2 does not provide a general basis to refuse or delay instant execution; any intervention needs a specific basis under PSD2 Article 68(2) or Article 79. Document the legal basis for every intervention type.
An instant-only model, routing all eligible euro payments as SCT Inst by default with no client choice, is permitted under DG FISMA Q&A 28 and is the simplest architecture to manage from an Article 5a perspective, provided onboarding and terms clearly reflect it. A dual-rail model, offering both SCT and SCT Inst, is permitted but more complex: the payer's choice must be respected (Q&A 27), you cannot reclassify a standard transfer as instant, you cannot downgrade an instant payment where instant execution fails, and there is no client opt-out from instant execution beyond transaction limit controls under Article 5a(6) and the VoP batch opt-out for non-consumers under Article 5c(6) and (7).
There is no published penalty tariff, but there is a published supervisory priority: the Central Bank has said it will focus on the implementation of incoming regulation, PSD3 and the PSR in particular. Expect it to look for board-level governance with named senior management owners, treating IPR as a critical regulatory change programme; individual accountability under the IAF Conduct Standards, even though SEAR does not currently apply to PIs; evidence-based implementation, meaning system outputs, audit trails and latency performance evidence rather than policy statements; and proactive engagement. If you have concerns about meeting the April 2027 deadline, engage the Central Bank early. Structured, transparent engagement consistently reduces enforcement risk.
If you hold client euro payment accounts you are in scope regardless of your PI or EMI structure or sponsor bank model. The ten-second window is a hard statutory requirement; manual processes and intermediary latency are your execution risk, not your excuse. Sanctions screening must be fundamentally redesigned. Non-compliance is not a viable risk posture, although we expect the Central Bank to take a pragmatic approach with firms that have credible implementation plans and engage early.
To discuss IPR readiness, scope analysis or sanctions redesign, see how Finvisor supports payment and e-money firms or contact simon@finvisor.ie.
We use strictly necessary cookies to run this site, and optional analytics cookies (Google Analytics) to understand how it is used. Analytics cookies are only set if you accept them. See our Cookie Policy and Privacy Policy.