What Is SurePay and How Does It Work?

Search for SurePay and you will land on at least three unrelated companies: a Dutch payee-verification business that most of Europe's banks now depend on, an American utility auto-pay programme, and a Utah consumer lender. If you are a finance or compliance team evaluating payment verification, only the first one matters. This guide explains what SurePay B.V. actually does, how the check works, what it returns, what it costs, where it reaches — and, more usefully, the two B2B payment workflows that the European and UK rules behind it explicitly leave uncovered.

What SurePay is

SurePay B.V. is a Dutch software company that answers one narrow question before a payment leaves an account: does the name you typed match the name on the account you are sending to? That is it. It does not move money, hold funds, or issue accounts. It sits in front of the payment and returns a verdict.

The company began in 2016 as an internal project at Rabobank, one of the largest banks in the Netherlands. The product was originally called the IBAN-Name Check, and by 2017 it was running for Dutch banks. In early 2020 it was spun out into a standalone private company, SurePay B.V., and began selling the same capability beyond its parent — first as Confirmation of Payee in the UK, then as Verification of Payee across the euro area.

In June 2025, Carlyle Europe Technology Partners took a strategic growth investment in the business alongside Rabobank's investment arm, Rabo Investments, replacing earlier backers Connected Capital and Iris Capital. At the time of that announcement the company reported serving over 200 banks and more than 750 corporate customers, having processed over 10 billion payment checks.

How SurePay works

The mechanic is simple and worth understanding precisely, because almost every marketing claim in this category depends on it.

Every bank knows the registered name on the accounts it holds. No bank knows the names on accounts held elsewhere. So when you type an IBAN and a payee name into your banking app, your own bank cannot check them — it has to ask the receiving bank. SurePay operates the layer in the middle: banks connect once, share their account-name data through that connection, and can then query every other connected bank through a single API rather than building a bilateral link with each one.

SurePay reports connecting 99.5% of Dutch banks within its first year, and roughly 90% coverage in the UK after adapting the product to Confirmation of Payee rules. For business accounts in the Netherlands it also draws on Chamber of Commerce (KvK) records, which is how it can distinguish a registered legal name from a trading name.

The check returns one of four results.

The interesting engineering is in the middle result. A naive string comparison rejects “Jonhson” for “Johnson”, treats “Rob” as a different person from “Robert”, and fails every company that trades under a name different from its registered one. Each false rejection creates a support call. SurePay's published position is that competing systems return roughly 40% no-match rates against 5–10% for its own algorithm. That claim comes from SurePay's own marketing and has not been independently benchmarked. For context, Banfico — another provider in the same layer — reported after the euro-area rollout that match rates across its customer base ran from roughly 70% to 88%, a spread driven as much by how conservatively each bank configured its matching rules as by the algorithm underneath. Treat single-vendor no-match percentages as directional. The underlying point still holds: in name matching, the quality of the product is the false-rejection rate, not the presence of a match feature.

Both sides of the check, and the middle

One detail catches banks out during implementation: verification is two-sided. Under the EPC scheme a bank is both a requesting PSP, sending checks on behalf of its own payers, and a responding PSP, answering checks that other banks send about accounts it holds. Building only the requesting half satisfies your customers and breaches the scheme. SurePay's developer documentation reflects this directly, with a requester API, a bulk requester API, and a separate responder service.

Between the two sides sits a category the EPC calls a Routing and/or Verification Mechanism — an RVM. Rather than connecting to thousands of banks individually, a PSP can connect to one qualified RVM that forwards requests and returns responses on its behalf. The EPC requires RVMs to pass a formal qualification process, including self-certification of their APIs against its reference toolbox. SurePay is one of several providers operating in that layer, and it is the layer that made a twelve-month, continent-wide rollout possible at all. Scheme response times are tight: a maximum execution time of three seconds, with under a second preferred.

The products either side of the core check

Four adjacent products come up in evaluations, and it helps to know what they are before deciding whether they cover a gap you have.

• Fraud Risk Indicator (FRI). An add-on to the name check that returns extra risk signals about the beneficiary account — its age, how many holders it has, whether it is a business or personal account, and whether it appears on blacklists of accounts implicated in scams. It is designed to feed a bank's transaction monitoring system rather than the payment screen, and its stated purpose is as much about cutting false positives as catching fraud.
• Switch Check. Flags when a payee has moved to another bank, so the payer can be shown the new IBAN rather than having the payment fail. It answers “has this account moved?” — not “has this company changed?”
• SWIFT pre-validation. Beneficiary checks on cross-border payments through SWIFT's pre-validation service, where SurePay operates as a partner. This is how coverage extends past the European schemes.
• Batch verification. File-based checking for corporates, sold separately from the regulated bank service — for the reasons set out below.

Why every European bank suddenly needed this

SurePay's growth is not primarily a sales story. It is a regulatory one.

In the UK, the Payment Systems Regulator began directing banks to implement Confirmation of Payee in 2019, initially covering the six largest banking groups. Specific Direction 17, issued in October 2022, widened that dramatically: Group 1 firms by 31 October 2023, and everyone else in scope — building societies and any Faster Payments or CHAPS participant with its own sort code — by 31 October 2024.

In the EU, the Instant Payments Regulation, Regulation (EU) 2024/886, made the equivalent check mandatory. Euro-area payment service providers had to offer Verification of Payee free of charge from 9 October 2025. PSPs in EU member states outside the euro area have until 9 July 2027. The European Payments Council's VoP scheme rulebook took effect on 5 October 2025, days before the regulatory deadline.

Neither rule says banks must build it themselves. That is the entire commercial opportunity, and SurePay was the vendor already holding the connections.

One live question sits at the end of that timeline. Specific Direction 17 carries a hard expiry date of 1 November 2026, after which UK PSPs would have no legal obligation to offer Confirmation of Payee at all. In July 2026 the Payment Systems Regulator opened a consultation proposing to remove that expiry date and to extend the direction to firms that adopted CoP voluntarily, giving them until 31 December 2026 to come formally into scope. That consultation closed on 20 August 2026 and the outcome had not been published when this article was written. Near-universal coverage is not currently a permanent legal fact.

What it costs

This is the question people search most and the one most articles dodge. SurePay is often described as not publishing pricing. That is only half true — the corporate portal tiers are public, and they are worth doing the arithmetic on.

Published tiers from SurePay's own pricing page, August 2026. Volume pricing at the API tier is negotiated and lower.

Three things in the small print matter more than the headline figures.

• File checks burn the allowance line by line. SurePay's pricing page states that within a file check, each individual verification counts as a separate check against your annual total. Upload a 3,000-line supplier master to an Insight Pro plan and you have consumed three quarters of the year in one afternoon.
• There is a connection fee. SurePay's own FAQ describes bank pricing as a one-off connection fee plus a per-call fee. Budget for onboarding cost, not just usage.
• Ask what a “not possible” result costs. In some pricing models you are billed for checks that return no usable answer.

If you are paying through your own online banking, none of this applies — the Instant Payments Regulation requires euro-area PSPs to provide Verification of Payee to the payer free of charge. The pricing above is for organisations checking payees themselves, before a payment run.

Those three points are the reason a per-check headline figure is not the number to negotiate on. What decides the annual cost is how many checks a supplier file consumes, what you pay before the first check runs, and whether failed lookups are billable. It is worth setting our own pricing against the same three tests, since we are asking you to compare.

What MonitorPay costs

MonitorPay is from €0.50 per check, with no setup fee and no connection fee. Bulk file, API and platform access run on the same engine at the same rate, and that price includes the company layer — registered status, directors, shareholders, beneficial owners and group structure — rather than the name match alone.

We publish it because nobody in this category does, and a category where every vendor hides its rate card is one where buyers systematically overpay.

The cost gap is the smaller half of the argument. The larger half is that the two responses are not the same product — which is the subject of the rest of this article. Book a demo and we will price your actual volume rather than a tier you have to grow into.

The part the marketing pages skip

Here is where a buyer evaluation should get sharper, because both the EU and the UK rules contain carve-outs that land precisely on the workflows where business payment fraud actually happens.

Bulk payment files. Article 5c(6) of the Instant Payments Regulation requires PSPs to let payment service users who are not consumers waive verification of the payee when they submit multiple payment orders as a bundle. In the UK, Specific Direction 17 lists a bulk payment as an exempt transaction outright — a directed PSP does not have to send a CoP request for one. A supplier payment run is, definitionally, a bundle of payment orders. The mandated free check is optional or absent exactly where a corporate pays its suppliers.

Instructions that arrive on paper or by email. Specific Direction 17 also exempts transactions where the payment details reach the bank by post, email or fax, or are hand-delivered to a branch and not processed with the customer present. A vendor emailing accounts payable to say their bank details have changed is the single most common vector for business payment fraud, and it sits outside the scheme by design.

SurePay clearly understands this, which is why it sells batch verification and a corporate portal as separate commercial products alongside the regulated bank service. But it means the mental model of “our bank does Verification of Payee, so supplier payments are covered” is wrong, and finance teams hold that belief widely.

There is a second limit, and it is more fundamental. A name match tells you that a name corresponds to an account. It does not tell you whether the company behind that name is real, currently trading, solvent, or controlled by who you think. A newly incorporated shell with a genuine bank account in its own name returns a clean match every time. We have written separately about the difference between confirming a name and confirming ownership, and it is the distinction that matters most in supplier onboarding.

Four limits worth writing into your risk register

A payee check is a strong control with a precisely defined edge. Four things sit outside it, and every supplier onboarding process has to cover them somewhere.

The same supplier, two answers

Four limits stated as prose are easy to nod along to and hard to act on. They are sharper in a payload. Below is the same supplier and the same payment, checked two ways: on the left what a payee check returns, and on the right what MonitorPay returns. We are using our own response rather than a generic alternative because we are the comparison being drawn, and it seems fairer to show it than to describe it.

{
  "name_match": "match",
  "match_score": 0.98,
  "iban_valid": true,
  "account_status": "active",
  "country": "NL"
}

{
  "name_match": "match",
  "account_owner": "confirmed",
  "company": {
    "status": "active",
    "incorporated": "2026-06-14"
  },
  "directors": 1,
  "ubo": [{ "share": 100 }],
  "group": { "parent": "none" },
  "monitoring": "enabled"
}

Field names and values are illustrative; exact schema is confirmed during onboarding. The left-hand response is not wrong — it is complete for the question it was asked.

Read them together and the point makes itself. The left response is a clean pass: the name matches, the account is live, nothing is out of order. An approver looking at it releases the payment, correctly, on the information available.

The right response contains that identical pass — and then three facts that change the decision. The company was incorporated eight weeks ago. It has one director. One person owns 100% of it. None of those is disqualifying on its own. Together, on a first payment, they are the profile that most invoice-fraud post-mortems describe. Neither response is more accurate than the other. One of them is answering a narrower question, and it is not the question your approver thinks they are asking.

Is the name check working?

Honestly assessed: yes for its stated purpose, and no for the thing people hope it does.

Pay.UK reports that since Confirmation of Payee launched, claims for Faster Payments sent to the wrong account have fallen 59%, with losses to end users down 20–40% for some categories of fraud. The Payment Systems Regulator, citing Form3 analysis, notes that transactions where the expected recipient name does not match are 25 times more likely to be fraudulent — a strong signal by any standard.

And yet UK authorised push payment fraud losses rose 19% in 2025 to £576.4 million across 248,070 cases, according to UK Finance's Annual Fraud Report 2026. Total payment fraud reached £1.28 billion. Name checking did not stop that, because most APP fraud does not depend on a name mismatch. When a victim is manipulated into paying an account that genuinely belongs to the name they were given, the check returns a match and the money leaves.

Which leaves the obvious question. If that is the shape of the control — reliable against error, partial against deception — what covers the rest, and whose job is it to run it?

SurePay compared to the alternatives

Strip out the vendors solving adjacent problems and the real decision comes down to two shapes: the scheme incumbent, built inside a bank to satisfy a regulatory obligation, and a verification layer built for whoever carries the loss if the payment goes to the wrong place. Both sell to banks; only one of them also answers what the company behind the account is.

What it is	Payee verification infrastructure, originally built inside a bank	Company bank account verification, built for whoever is releasing the payment
Built for	Banks and PSPs meeting a VoP or CoP obligation, plus corporates via a portal	Finance, AP and compliance teams — and banks and PSPs, for the company and ownership layer
Entry price	€2,700 a year for 900 checks — an effective €3.00 per check. €5,700 for 4,000 checks (€1.43). API tier quote-only.	From €0.50 per check, on the same rate across bulk, API and platform. No tier to grow into.
Setup or connection fee	✗ A one-off connection fee applies, per SurePay's own FAQ	✓ None
How a bulk file is billed	Each line of an uploaded file counts as a separate check against the annual allowance	Bulk upload priced per check at the same rate, with no annual cap to consume
Core coverage	EU and UK through the EPC VoP and Pay.UK CoP schemes, plus SWIFT pre-validation	49+ markets, including the EU and UK schemes and direct local banking infrastructure
Corridors outside Europe	– Limited; the model is scheme-based	✓ Direct verification in major non-European markets
Company behind the account	✗ Not the product	✓ Status, directors, shareholders, UBO and group structure from 200+ registries
After the check	– Fraud signals at the point of verification	✓ Continuous monitoring with alerts on status or ownership change
Scheme role	✓ Operates in the RVM layer for VoP and CoP	✗ Not an RVM; sits alongside the scheme, not inside it

Capabilities summarised from public documentation as at August 2026. Vendors change scope frequently; confirm current coverage directly before contracting. Other providers in the category are covered in our comparison of nine bank account verification providers.

The practical read: if you are a bank that must offer Verification of Payee by a regulatory deadline, SurePay is on the shortlist for good reason. If you are a corporate paying suppliers, you are buying something different — and the questions in Figure 5 are the ones to put in the RFP.

If you are a bank choosing a supplier, not a corporate

The table above compares two things a corporate weighs against each other. A bank or PSP with a scheme obligation is running a different shortlist, and it is worth naming it rather than pretending SurePay is unopposed. Bottomline and Banfico both supply CoP in the UK and VoP in the euro area. Form3 offers an API-first VoP service. iPiD operates a node for both schemes with reach into corridors the European schemes do not touch. EBA Clearing approaches it from the infrastructure side through its Fraud Pattern and Anomaly Detection service, and SWIFT covers cross-border through pre-validation.

That decision usually turns on three things rather than matching quality: whether the provider is a qualified RVM, whether it covers the responding side as well as the requesting side, and whether it can be live before your deadline. MonitorPay does not bid for the scheme connection itself and is not an RVM.

Banks and PSPs do use MonitorPay, but for the layer alongside it — registry-sourced company, director and beneficial-ownership data for onboarding and periodic review, and account verification in the corridors the European schemes do not reach. Those are separate purchases from the VoP mandate, and they are usually made by a different team.

How to evaluate any payee verification vendor

Five questions cut through most vendor decks.

1. What is your false-rejection rate, measured on our data? Not a published average. Ask for a pilot against a sample of your own supplier file, and count how many known-good suppliers come back as anything other than a match.
2. What happens on a bulk file? Confirm whether batch verification is included, priced separately, or unavailable — and what the turnaround is on ten thousand lines.
3. Which of our corridors are actually covered? Coverage claims count institutions and accounts. Bring your top twenty supplier countries and ask for a yes or no on each. Our guide to cross-border verification covers why this is where most proofs of concept fail.
4. What do you return when you cannot verify? A “not possible” result is not a pass. Ask how often it occurs in your markets and whether you are billed for it.
5. What happens after the check? A verification is a snapshot. Ask whether the vendor monitors the account after onboarding or expects you to re-run it manually.

If you are building this into a payment workflow rather than buying a portal for staff to log into, our walkthrough on automating supplier bank account verification covers the integration paths. For US suppliers, where there is no name-check scheme at all, the mechanics are different again and are covered in our guide to ACH, EIN and entity checks.

Frequently asked questions