A SEPA payment investigation is a request, opened by the sender's bank, to trace, recall or correct a euro payment that went wrong. Wrong IBAN, duplicate payment, suspected fraud or a payment that never arrived can all trigger one. You can't open it directly with the recipient's bank. You ask your own bank, which then works through the scheme's fixed message flow and deadlines. This guide walks a US finance or accounts payable team through that flow, the clocks that apply, the outcomes to expect, and the checks that keep most cases from starting.
One note on the keyword: "SEPA" also stands for environmental review rules in Washington State and for Scotland's environmental regulator. This article covers only the Single Euro Payments Area, the euro payment system.
TL;DR
- An investigation starts at your bank. Your bank contacts the beneficiary's bank, and the beneficiary's bank answers within scheme deadlines counted in banking business days.
- Recall requests for duplicates or technical errors must be started within 10 banking business days. Fraud-related recalls can be started within 13 months. The beneficiary's bank has 15 banking business days to answer.
- A recall is a request, not a guarantee. Recovery depends on the recipient and their bank.
- SEPA Core direct debits have an eight-week no-questions-asked refund window, and unauthorized debits can be claimed within 13 months.
- Verifying the name and IBAN before you release payment is the cheapest way to avoid an investigation.
Table of Contents
- What a SEPA investigation actually is
- What triggers an investigation
- The process step by step
- Deadlines: the clocks that matter
- Direct debits follow different rules
- Which rules apply to a US business
- Prevent the investigation before it starts
- Perspective
- Check payees before your next euro payment run
- FAQ
- Sources
What a SEPA investigation actually is
"Investigation" is the everyday word. The scheme itself uses several distinct procedures, and picking the right one matters because each has its own trigger and clock.
For credit transfers, the European Payments Council (EPC) separates SCT Inquiries, meaning Claims of Non-Receipt and Claims for Value Date Correction, from R-transactions such as Rejects, Recalls and Returns. In plain terms:
| Situation | Procedure | Who starts it |
|---|---|---|
| Payment sent, beneficiary says it never arrived | Claim of Non-Receipt (inquiry) | Your bank, at your request |
| Funds arrived late or with the wrong value date | Claim for Value Date Correction (inquiry) | Your bank |
| Duplicate payment or technical error | Recall | Your bank |
| Fraud or scam | Recall | Your bank |
| Wrong IBAN or wrong amount | Request for Recall by the Originator (RFRO) | Your bank |
| Payment refused before or after settlement | Reject or Return | The beneficiary side |
The EPC also says exception handling starts where the problem is detected. A Reject or Return can come back to you with no action on your side. A Recall or inquiry only exists because you asked for it.
If your payment came back with a code you don't recognize, our guide to SEPA return codes explains what the common ones mean and what to do next.
What triggers an investigation
The EPC's clarification paper lists duplicate sending, technical problems that cause an erroneous transfer, and fraud as reasons for a Recall. It lists a wrong IBAN and a wrong amount as reasons for an RFRO.
In an accounts payable department, the realistic triggers are:
- A supplier says they were never paid. Often the money went to an old or mistyped account.
- A bank change request that turns out to be fraudulent. The invoice looked right, the email was not.
- A batch uploaded twice. Duplicate payment runs are common after a failed file import.
- A name and IBAN that don't belong together. The payment may settle at a bank that doesn't compare names at all.
One EU bank's support page tells customers that to reverse a transfer for a wrong recipient, wrong amount or suspected scam, the sender requests a payment investigation. The same page is frank that the money may not come back, because the outcome depends on the recipient and their bank.
The process step by step
1. Contact your bank immediately
Only the sender's bank can open the case. If you pay from a US account through a correspondent or a payment provider, the request goes to whichever institution actually submitted the euro payment into SEPA. Ask your payments contact whether they send the SEPA credit transfer themselves or pass it to a partner, because that decides who can raise the recall.
2. Give the bank the evidence it asks for
Banks ask for roughly the same details. One EU bank's help page lists a description of the problem, both IBANs, the payment date and amount, a payment confirmation document and the transaction ID, and says it reviews the case within five working days of receiving them. Have these ready:
- The unique transaction reference or end-to-end ID from your bank statement or payment file.
- The intended beneficiary name and IBAN, and the details actually used.
- The amount, currency and execution date.
- The reason: duplicate, technical error, wrong IBAN, wrong amount or fraud.
- For fraud, the fraudulent email or invoice, the date the bank-detail change request arrived, and any police or internal incident report.
A clean, complete package shortens the back-and-forth. If you suspect fraud, treat it as a security incident as well as a payment case. Our colleagues elsewhere cover incident response in banking security management, which helps when you are mapping who in your organization does what while the clock runs.
3. Your bank contacts the beneficiary's bank
The sender's bank asks the recipient's bank for a credit confirmation containing the date, amount and transaction ID. Under the scheme, the EPC says participants must send Rejects, Recalls, RFROs, Returns and inquiries through the same clearing and settlement mechanism used for the original payment, unless the participants agree otherwise.
Behind the scenes this is standardized messaging. The Bundesbank's technical specifications show that a Claim of Non-Receipt uses camt.027, a Claim for Value Date Correction uses camt.087, and the resolution uses camt.029. You will rarely see these names, but a bank agent may quote them.
4. The beneficiary's bank answers
The beneficiary's bank checks the account and, for a Recall, usually needs the account holder's consent or another legal basis before returning funds. It then answers positively or negatively. A rejected recall is a final answer from the scheme's perspective, so your next step moves outside it: direct contact with the recipient, a legal claim or, for fraud, law enforcement.
5. Resolution
The possible outcomes are:
- Funds returned in full. The recipient agrees or the bank has grounds to return.
- Partial or no return. The money has already moved on, or the account holder refuses.
- Inquiry resolved. The bank confirms the credit date, or corrects the value date.
As a documentation hub for a core banking platform describes it, in the inquiry scheme the beneficiary contacts the originator outside the scheme, and the originator then asks their bank to start the inquiry. So when a supplier complains, your own bank is where it begins.
Deadlines: the clocks that matter
All SEPA credit transfer deadlines are counted in banking business days, not calendar days. The numbers below come from the EPC and bank documentation.
| Event | Deadline |
|---|---|
| Start a Recall for duplicate sending or technical error | Within 10 banking business days of execution |
| Start a Recall for fraud | Within 13 months |
| Beneficiary bank answers a Recall or RFRO | 15 banking business days after receipt |
| Beneficiary bank answers an SCT Inquiry | 10 banking business days after receipt |
| Chase an unanswered inquiry | After 10 banking days with no answer |
The EPC says the originator's bank must start a Recall within 10 Banking Business Days, or within 13 months for fraud, and the beneficiary's bank must respond within 15. It counts the initiation period from the banking business day after execution and the response period from the banking business day after receipt. The same paper notes that the EPC applies the maximum interpretation when counting, which is why a bank may tell you a deadline that is a day later than your own count.
For inquiries, the EPC says the beneficiary's bank breaches the scheme if it doesn't answer within 10 banking business days, and a core banking platform's documentation advises a Request for Status Update if there's no answer after 10 banking days. The same documentation also notes the payer can ask for cancellation while funds are in transit.
Two practical points follow:
- Your bank's internal cut-off is earlier than the scheme's. Ask for the real deadline for requests on your account, then report the problem the same day you find it.
- Your bank may need up to 15 business days overall. One EU bank states an investigation can take up to 15 business days. Plan cash and supplier communication around that, not around the best case.
For teams that need to understand what the beneficiary bank is obliged to do, and how to build a response process around those timers, the same incident discipline that applies to any banking event applies here: log the date of discovery, the date of the request and the date each answer arrives.
Direct debits follow different rules
If you collect from European customers by SEPA Direct Debit, or a European customer disputes a debit against you, the clocks differ.
For SEPA Core, the EPC rulebook describes an eight-week period of no-questions-asked refunds. If the request concerns an unauthorized transaction, the debtor must claim within 13 months of the debit date under Article 71 of PSD2. A bank's creditor service description says the same: a refund right up to 8 weeks after the due date for basic (Core) direct debits, and 13 months if the collection was unauthorized. A payment institution's terms likewise count the eight weeks from the date the account was debited.
The practical effect for a creditor is that revenue from a Core debit isn't final for eight weeks, and for 13 months if the debtor claims it was unauthorized. Keep the signed mandate and proof of the service you delivered.
Which rules apply to a US business
SEPA rules bind banks and payment providers in participating countries, not you directly. The rules that touch you are indirect:
- Euro only. A SEPA credit transfer is denominated in euros and uses the recipient's IBAN. A payment in dollars is an ordinary cross-border payment, not a SEPA one.
- Your route decides your rights. If a US bank sends your wire or a euro payment via a provider with a euro account, the investigation runs through that provider's SEPA connection. Ask who the SEPA participant is.
- Verification of Payee. From 9 October 2025, EU payment service providers must offer payers a Verification of Payee service before authorizing a credit transfer, and the requirement applies to all credit transfers, not just instant ones. Non-consumer payers can waive it. If your payments originate through an EU-based account, expect a name check; payers outside that setup may get no check at all, which is where a standalone check helps.
- The recipient's bank, country and scheme. Whether a name is compared, how strictly, and how fast the recipient's bank answers are decided on their side. Responses can differ between banks even when the scheme deadline is the same.
For more on the rule itself, see our guide to SEPA confirmation of payee for compliance teams.
Prevent the investigation before it starts
Most of the investigation cases an AP team sees are wrong-IBAN or fraudulent-detail cases. Both are preventable before you release funds.
- Use the exact legal name. One bank's payment guide advises obtaining the IBAN and using the beneficiary's full legal name and address without abbreviations or hyphenation, and warns that inaccurate information risks rejection, delay, return or extra charges.
- Hold bank-detail changes. Confirm a changed account through a known phone number before paying. See vendor bank change fraud for a hold-first routine.
- Check name against IBAN. A valid IBAN format only proves the number is well-formed. It doesn't prove the account belongs to your supplier. Our explainer on how match, close match and no match work shows how to read the results, and IBAN name match codes for AP teams shows how to act on each.
- Verify in bulk before a payment run. Running the supplier file through verification before the run catches stale details across the whole vendor master. Track your payee match rate over time to see whether master data is improving.
- Pair checks with BEC controls. Business email compromise is the usual path to a fraudulent recall case. Our piece on BEC controls and name-to-IBAN checks lays out the controls.
We have also written about business payee verification and about spotting mule accounts in real time, which matter when the recipient account itself is the problem.
Perspective
Every investigation we hear about has the same shape: the payment left, the mistake was found days later, and the clock was already running. The scheme is built to handle that, but a recall is still a request, and the money's return depends on the recipient and their bank.
That's why we built Vopify around the moment before payment. You enter a name and an IBAN, and you get a result in under two seconds, for individual and business accounts. There's no contract to sign and no integration needed to start. Our platform has processed over 10,000 verifications across 20 Eurozone countries, and it also covers India, Indonesia, South Korea and China (Alipay).
For a US team paying European suppliers, that matters most. You may not get a name check from your own bank, so the check has to be part of your process. We think a verified payee is the cheapest investigation you will ever avoid.
David
Check payees before your next euro payment run
Vopify matches the IBAN and account holder name in real time for individuals and businesses. You can run a single lookup or upload a CSV of suppliers, and API integration is planned for high-volume programmatic checks. Pay-as-you-go verification is $0.70 to $1.00 per check, and subscription plans are Starter at $240 per month, Growth at $750 per month and Scale at $2000 per month.
Start with the Vopify platform, check a whole supplier file with bulk IBAN verification, or see the supported networks.
FAQ
Can I open a SEPA investigation directly with the recipient's bank?
No. Only the sender's bank can open the case, and it contacts the recipient's bank on your behalf. You can still ask the recipient to cooperate, because the beneficiary's bank usually needs their consent to return funds.
How long does a SEPA investigation take?
The beneficiary's bank has 15 banking business days to answer a Recall and 10 to answer an inquiry, according to EPC guidance. One EU bank says its investigations can take up to 15 business days. Add the time your own bank needs to start the request.
Will I get my money back after a wrong-IBAN payment?
Not always. A wrong IBAN is a valid reason for a recall request, but the outcome depends on the recipient and their bank. Report it to your bank the day you find it, with the transaction ID and both IBANs.
What is the deadline for a fraud-related SEPA recall?
The EPC allows the originator's bank to start a recall for fraud within 13 months. Duplicate and technical-error recalls have a much shorter limit of 10 banking business days, so do not wait for fraud-style timing in those cases.
How is a direct-debit refund different from a credit transfer recall?
For a Core direct debit, the debtor can claim a refund within eight weeks without giving a reason. Unauthorized debits can be claimed within 13 months. A credit transfer has no such automatic window and relies on the recall process.
Sources
- EPC Guidance on Reason Codes for SCT R-transactions
- EPC Clarification Paper on SCT and SCT Inst rulebooks
- EPC SEPA Direct Debit Core Rulebook
- Bundesbank technical specifications SCT/SCL
- Recall or check the status of your transfer, N26 Support
- How can I open an in-app Payment Investigation, bunq Help
- SEPA Credit Transfer Inquiries, Mambu Documentation Hub
- SEPA Credit Transfers introduction, Mambu Documentation Hub
- SEPA Core Direct Debit terms, Holvi
- SDD Service Description Creditor, Nordea
- Nordea Payment Guide
- Verification of Payee requirements under the Instant Payments Regulation, PwC Legal
- How do I make SEPA transfers, CurrencyTransfer.com
- Incident Response in Banking ISMS: A 2026 Guide