How to Verify French Supplier Bank Accounts: VoP, SIREN, and the Kbis

France made account-name verification mandatory in October 2025 — la Vérification du Bénéficiaire, the French face of the EU's VoP scheme. It's the control against fraude au faux RIB and faux ordres de virement, the change-the-bank-details scams that hit French finance teams hardest. But VoP only checks the name on the account. The harder questions — is this SIREN real, who controls this SAS — live in the RNE and the RBE. France has the cleanest company identifier in Europe and one of its trickiest ownership gaps.

On 9 October 2025, every payment service provider in the eurozone had to start offering Verification of Payee under the EU Instant Payments Regulation. In France it's called la Vérification du Bénéficiaire, and the major banks — BNP Paribas, the Banque de France's member institutions, and the rest — rolled it out as a free, systematic check on every SEPA credit transfer. Before you authorise a virement, your bank confirms whether the name you entered matches the account holder behind the IBAN. The check takes about three seconds and, for affected transfers, can't be switched off.

The French regulator framed it plainly: VoP exists to fight FOVI — faux ordres de virement, fake transfer orders — and fraude au changement de RIB, the scam where a fraudster persuades you to update a supplier's bank details (the RIB, relevé d'identité bancaire) to an account they control. These are the attacks that drain French accounts payable, and account-name verification is the front-line defence. Manipulation fraud in France rose sharply through 2025, and the change-RIB scam is its most common B2B form.

But VoP is only the account layer. It confirms the name matches the IBAN. It doesn't tell you whether the French company behind that account genuinely exists and is solvent, or who ultimately controls it. Those questions live in France's company registers — the RNE, the Kbis, and the RBE — and France's entity layer has a particular quirk: the identifier system (SIREN/SIRET) is the cleanest in Europe, but the ownership transparency of its most popular company form, the SAS, is one of the weakest. This article covers both layers, and the workflow a business paying French suppliers needs in 2026.

The French verification landscape in 2026

Three pillars define bank account verification for French suppliers: the EU-mandated VoP at the account layer, the SIREN/RNE/Kbis system for entity verification, and the RBE for beneficial ownership. A brief refresh on each.

• VoP (Vérification du Bénéficiaire) became mandatory on 9 October 2025. Under the EU Instant Payments Regulation (Regulation (EU) 2024/886, amending Regulation 260/2012), every PSP in the eurozone must offer a free beneficiary-verification service before a SEPA credit transfer is authorised. It applies to both standard transfers (SCT) and instant transfers (SCT Inst).
• The check is systematic and free. Per the Banque de France's national usage guide, the service is automatic for all affected SEPA transfers, cannot be disabled, and is free to the user — individuals and businesses alike. For a natural person it checks first name and surname; for a legal entity (personne morale) it checks against the registered company name (raison sociale or nom commercial).
• The RNE is the central company register. Since 1 January 2023, the Registre National des Entreprises (RNE), managed by the INPI, has merged the old RCS (commercial register), the RM (trades register), and the RAA (agricultural register) into one system. The free attestation RNE from data.inpi.fr now carries the same legal validity as the paid Kbis extract.
• SIREN and SIRET are France's company identifiers. Every French business has a 9-digit SIREN identifying the legal entity, and one or more 14-digit SIRET numbers identifying each physical establishment. Unlike Germany's fragmented court-by-court numbering, France has a single national identifier that doesn't change when a company moves — a genuine advantage for verification.
• The RBE holds beneficial ownership under the LCB-FT framework. The Registre des bénéficiaires effectifs records the natural persons who hold more than 25% of capital or voting rights, or otherwise control a company. Public access ended on 31 July 2024 following EU regulatory changes — more on that below.

The practical takeaway: in France, the account-name check is now solved, free, and universal. What differentiates a robust supplier-payment workflow is the entity layer — and France's entity layer is a story of one big strength (the SIREN identifier) and one big gap (SAS ownership opacity).

VoP: what it does and how it reads

La Vérification du Bénéficiaire compares the payee name you enter against the name registered to the destination IBAN at the receiving bank. You get a result before you authorise the virement. It applies to all euro SEPA credit transfers, standard and instant.

The French banking federation (FBF) describes the possible outcomes:

• Correspondance exacte (Match) — the name and IBAN agree. Safe to proceed.
• Correspondance approchante (Close match) — close but not identical (for example, a commercial name vs the full raison sociale). The registered name is typically returned so you can decide.
• Pas de correspondance (No match) — the name doesn't match the account holder. The full name isn't disclosed, for data-protection reasons. Contact the supplier through an independent channel before proceeding.
• Vérification impossible (Not possible) — the check can't be performed: the receiving bank isn't reachable, the account type isn't covered, or the destination is outside the scheme. Proceed with extra caution.

As everywhere in SEPA, VoP informs rather than blocks. A no-match is a warning, not a hard stop — you decide whether to proceed, and you bear the consequence if you push past it. That's the key point for French finance teams writing internal policy: VoP secures the name-IBAN match, but the decision and the liability remain with the payer.

The regulatory VoP vs the commercial "IBAN-name check"

One useful distinction the Banque de France draws: the free, regulatory Vérification du Bénéficiaire is separate from the commercial "IBAN-name check" services that private providers sell for cleaning supplier databases. The regulatory VoP runs at the moment of transfer. The commercial services run ahead of time — verifying an IBAN when you first add a supplier to your master file, before any payment. Both have a place: regulatory VoP is the per-transfer backstop; pre-transfer verification stops a bad RIB from ever entering your database. A complete workflow uses both.

What VoP does NOT cover

VoP covers euro SEPA credit transfers. It does not cover payments to banks outside the eurozone, non-euro payments, or non-payment accounts. For a French business paying a supplier in the UK, Switzerland, or the US, VoP provides no coverage — a separate verification method is needed for each of those corridors.

Where VoP falls short for French B2B payments

VoP is the right first-line check. But three gaps matter for businesses paying French suppliers, and all three sit at the entity layer.

1. A "Match" doesn't tell you the company is real or solvent

VoP confirms the account belongs to whoever registered it. It doesn't tell you whether the company is genuinely trading, or whether it's in liquidation judiciaire. A company can have a valid SIREN and still be in insolvency or have ceased activity without formal removal. A fraudster who registers a company, opens an account in its name, and submits an invoice passes VoP cleanly — the account name matches. The fraud is in the entity. Closing that gap requires the Kbis or RNE attestation and a BODACC insolvency check, not a name match. See KYB verification for marketplaces for how entity verification complements account verification.

2. For an SAS, VoP tells you nothing about who controls the company

This is France's distinctive KYB gap. The SAS (société par actions simplifiée) is France's most popular company form for new businesses — and its shareholder identity is not required to be disclosed in a structured public form. Share-transfer agreements aren't registered publicly. So for an SAS, the statuts filed at incorporation may not reveal current ownership at all. The only reliable route to current beneficial ownership is the RBE — now access-restricted — or a formal shareholder declaration from the company itself. (For an SARL the situation is better: the associés appear in the statuts, which must be updated within a month of any change and filed with the greffe.) This SAS transparency gap is the French equivalent of the holding-company traps in other markets, and it's why a VoP match tells you nothing about control.

3. VoP doesn't catch a compromised supplier (FOVI)

The most common attack on French businesses isn't a fake company — it's fraude au faux RIB: a real supplier whose email has been compromised, sending a convincing request to change their RIB to a new account. The supplier is real, their Kbis is clean, and the new account passes VoP because it's registered correctly to a money mule. The fraud lives in the change request, not the account details. This is the textbook FOVI scenario, and it's why French regulators built VoP — but VoP alone can't catch it, because the name on the fraudulent account genuinely matches. For the operational picture, see vendor email compromise vs business email compromise.

A concrete scenario: fraude au faux RIB

A composite, anonymised French scenario showing how the FOVI gap plays out.

The setup. “Paris Digital SAS” has paid “Lyon Matériel SARL” monthly for two years — around €16,000 per invoice. Lyon Matériel banks with a French mutual; the registered account name matches its Kbis exactly. Every virement has cleared cleanly.

The attack. On a Tuesday, Paris Digital’s comptabilité team receives an email from their regular Lyon Matériel contact — the familiar address. It says the supplier has changed banks and asks them to update the RIB for this month’s invoice. It quotes the correct invoice number and reads exactly like the contact’s usual style. This is a textbook faux ordre de virement.

What the process catches — and misses. Paris Digital runs a VoP check on the new RIB, entering “Lyon Matériel SARL.” The result: correspondance exacte. The receiving bank confirms the account is registered to Lyon Matériel SARL. The analyst updates the supplier master file and sends the €16,000.

What actually happened. The Lyon Matériel contact’s email was compromised weeks earlier. The “new account” was opened in the supplier’s legal name using fraudulent documents that passed the receiving bank’s onboarding. The VoP match was technically correct — the registered name really did read “Lyon Matériel SARL.” The fraud lived in the RIB-change request, not the account details. On an instant virement, the money settled in seconds with no recall window.

What would have caught it. A callback to Lyon Matériel on a number from Paris Digital’s records or the company’s official Kbis contact — not the email signature — would have exposed the fraud in under a minute. So would a continuous-monitoring check flagging the destination account as recently opened. Both are mature, available controls. Neither is part of a “VoP-first” policy, because VoP secures the name match, not the RIB-change channel — which is exactly where fraude au faux RIB operates.

The entity layer: SIREN, the Kbis, and the RBE

France's company-data system is, in one respect, the cleanest in Europe — and in another, one of the trickiest. The identifier system is excellent; the ownership transparency for its most common company form is poor. Understanding both is the key to French KYB.

SIREN and SIRET: one clean identifier

Every French business has a single 9-digit SIREN that identifies the legal entity and never changes — not when the company moves, not when it changes activity. Each physical establishment gets a 14-digit SIRET (the SIREN plus a 5-digit establishment code), so a company with three offices has one SIREN and three SIRETs. This is a real advantage over Germany, where the Handelsregister number can change when a company moves between courts. With a SIREN you have a stable, national key to everything else: the Kbis, the financial filings, the RBE declaration.

The Kbis and the RNE attestation

The Kbis (or extrait Kbis) is the official proof of a French company's registration — its legal "carte d'identité." It shows the SIREN, legal form, registered address, share capital, directors, and activity code (code APE/NAF), and it's an acte authentique issued by the commercial-court clerks. Since the 2023 RNE reform, the free attestation RNE from data.inpi.fr carries the same legal validity as the paid Kbis (around €3.06–3.37 via Infogreffe). A critical operational rule French finance teams know well: never trust a Kbis received by email without verifying it against the source — a forged Kbis is a classic onboarding-fraud tool. Always pull it from data.inpi.fr or Infogreffe yourself.

The RBE and the SAS transparency gap

The RBE (Registre des bénéficiaires effectifs) records the natural persons controlling a company — anyone holding more than 25% of capital or voting rights, exercising control over management, or, failing that, the legal representative. Companies must declare their beneficial owners at incorporation. But two things complicate French UBO verification in 2026:

First, public access to the RBE ended on 31 July 2024, following the EU regulatory changes triggered by the 2022 European Court of Justice ruling. Access is now reserved for competent authorities and for parties able to demonstrate a legitimate interest in the fight against money laundering (LCB-FT). For a Wwft- or LCB-FT-regulated institution, access can be requested from the INPI or the greffe; for everyone else, it's restricted.

Second, even with access, the SAS form limits what's discoverable. Because SAS shareholder identity isn't required in structured public filings and share transfers aren't publicly registered, the RBE declaration is often the only route to current ownership of an SAS — and when access is restricted, that route narrows. For an SARL, the associés appear in the publicly accessible statuts, updated within a month of any change. The practical consequence: French UBO verification quality depends heavily on the company's legal form, and for the increasingly popular SAS, it depends on RBE access. This is exactly the kind of ownership tracing that registry-aggregating verification platforms automate. See beneficial ownership verification in B2B payments for the deeper case.

One French advantage: open APIs

Unlike Germany's fragmented, API-less registers, France exposes its company data through public APIs — the Sirene API (legal status, NAF code), the INPI RNE API (registration data and non-confidential accounts), the BODACC bulletin (insolvency and sales announcements), and an RBE API. This makes French entity verification far more automatable than German verification, provided you can navigate the access rules — particularly the RBE legitimate-interest requirement.

The full French supplier verification workflow

What a working verification workflow looks like for a business paying French suppliers in 2026 — across onboarding, before each material payment, and continuously thereafter.

At supplier onboarding

• Verify the entity via SIREN. Pull the Kbis or free RNE attestation from data.inpi.fr. Confirm the company exists, the legal form, the registered name and address, the directors, and that it's active — not radiée or in liquidation.
• Check BODACC for insolvency. A valid SIREN doesn't mean a solvent company. The BODACC bulletin shows procédures collectives (insolvency proceedings) and business sales — a free, essential check.
• Run a VoP / IBAN-name check on the supplied account. An exact match, or a close match with an explainable commercial-name reason, is acceptable. A no-match requires independent contact with the supplier.
• Establish beneficial ownership. Pull the RBE declaration if you have access (legitimate interest under LCB-FT). For an SARL, cross-check the associés in the statuts. For an SAS, the RBE is usually your only structured route — plan for it.
• Screen the entity and its beneficial owners against sanctions and PEP lists. Required under the LCB-FT framework for obliged entities; advisable for any business paying higher-risk suppliers.
• Never trust a Kbis or RIB sent by email. Pull the Kbis from source yourself, and verify any RIB through VoP plus an independent channel. A document received in an inbound message is the fraudster's favourite vector.

Before each RIB change

The highest-risk event in the workflow. Fraude au changement de RIB is the single most common B2B payment fraud in France — and on instant rails, a successful one is irreversible in seconds.

• Treat every RIB change request as suspicious by default. The question isn't "does this look like fraud" — it's "have we verified this through an independent channel."
• Call back on a known number. Not the number in the email requesting the change — a number from your existing records or the company's official contact details.
• Run VoP on the new account before saving it. Verify first, update the master file second.
• Confirm the new account's registered name matches the supplier's legal entity name. A supplier whose entity is one SIREN should not suddenly bank under a different name without a documented reason.

Continuous monitoring between payments

French companies change constantly — director changes, share transfers, insolvencies (recorded in BODACC), RBE updates. Continuous monitoring catches these before the next payment cycle.

• Monitor BODACC and RNE status changes. Insolvency proceedings, dissolution, and director changes are early warning signs — and BODACC is published continuously.
• Monitor RBE / beneficial-ownership changes. A supplier that cleared screening at onboarding can come under sanctioned or high-risk ownership through a share transfer — especially in an SAS, where the change may not surface anywhere else.
• Re-screen against sanctions and PEP lists on a defined cadence. Designations change frequently; a supplier clean at onboarding may have been designated since.

For the full case on why one-time verification isn't enough — and why continuous monitoring is now the operational standard — see why one-time verification fails.

How French verification methods compare

Businesses paying French suppliers have several verification options. They differ in what they confirm and where they fit.

The pattern: no single method is sufficient for French B2B verification. VoP is the right first-line account check, but it works alongside the Kbis/RNE at onboarding, a BODACC solvency check, RBE-based UBO tracing, callback verification for RIB changes, and continuous monitoring between payments. For how these methods interact with their non-French equivalents, see our 7 verification methods compared article.

Paying French suppliers from outside France

If you pay French suppliers from another country, VoP coverage depends on where your PSP sits. Since 9 October 2025, all eurozone PSPs must offer VoP, so payments from euro-area countries to French accounts get the name check. Notably, the first cross-border VoP corridor went live between France and the Netherlands, linking more than 100 French banks with over 30 Dutch banks — a sign of how cross-border verification will expand. Non-euro EU countries have until 9 July 2027 to comply; outside the EU — the UK, US, Switzerland — there's no automatic VoP coverage.

The entity layer is the harder cross-border problem. France's open APIs make automation possible, but the RBE legitimate-interest requirement and the SAS ownership gap mean foreign businesses verifying French suppliers at scale need either LCB-FT-regulated access or a verification provider that aggregates French registry and ownership data. See cross-border bank account verification for the country-by-country picture.

Frequently Asked Questions