i'm surprised to have seen no discussion so far about the fact that all european banks will start massively leaking trans peoples deadnames in october. so let's change that! (๐Ÿงต thread with more information)

image source: https://www.europeanpaymentscouncil.eu/sites/default/files/kb/file/2024-10/EPC218-23%20v1.0%202024%20Verification%20Of%20Payee%20Scheme%20Rulebook_0.pdf

quick note to start: this is just my understanding from reading the epc documents on vop. this is glossing over a lot of detail. i might make mistakes, if they are relevant to the larger message, please correct me in a reply.

starting october 2025 banks taking part in sepa (aka all banktransfers between european banks) need to perform verification of payee (vop).

verification of payee means that if you ("requester") send money to someone your banks checks in with the bank of the person you're sending money to ("payee") and tells you if the name you entered matches the iban. a simple check to make sure you're not sending money to the wrong person, right?

well not so much for people who use another name than their legal name, for example many trans people. every time someone tries to send them money, a warning is shown that the names do not match. so you either have to give people your deadname or at least out yourself and warn them beforehand that this will happen. but it gets even worse!

because your bank not only tells you whether the name you entered is correct or not. if the name you entered is close enough to the name associated with the iban ("close match"), you also get told that name. great if you mistyped, but horrible if your legal name should stay private!

but what qualifies as a "close match"?

the european payments council (who make the rules for this) leave that to the banks to decide for themselves, so the real implementation might differ. but they give some guidance on how these rules should look.

so if your bank account is registered to your deadname (which often is the case), all someone has to know (or guess) is your last name and the initial of your legal name. since the last name might very well be public, this takes a bad actor at most 26 tries.

and if your legal name is close enough to your real name (or has the same initial), it might even be shown to everyone sending you money.

this is the part of the thread where i would like to offer some hope or solutions on how people can protect themselves. but i don't know any. so if you have good solutions that work for most people or know how to prevent a specific bank from leaking that information, please add a post to this thread :)
@pajowu fwiw i asked my bank about this, and they offered to add my usual name to what they use to do the matching so both should be allowed now. I guess we'll see how well that works in October ๐Ÿ™ˆ