First, ask who owns the account behind the number
A typical virtual IBAN can allocate incoming payments from different sources to the same master account, making it easier to identify orders and customers. Suppose a customer receives a dedicated number, but the account name of the bank master account is the platform; the customer may only have a corresponding claim to the balance against the platform or the payment institution, rather than directly becoming a bank depositor. It is necessary to review the account-opening contract, the funds ledger and the provider's responsibilities; characterization cannot be based solely on the number format or on the ability to receive payments.
Not all virtual IBANs are merely technical labels
In their official 2026 report, the French ACPR and Tracfin stated that some virtual IBAN arrangements correspond to payment accounts separate from the master account; for virtual IBANs bearing the French country code, the report proposes that they be analyzed as payment accounts held in France. This is the specific position of the French authorities on the relevant arrangements and cannot be generalized to the rules of all countries, yet it is sufficient to serve as a reminder: a cross-border number does not inherently exempt one from local account regulation.
The number, the balance and the payment function must be verified separately
If a product only performs order reconciliation, the legal issues may differ from a situation where customers can retain balances over the long term, pay any third party at will, and transfer funds to other users. It should be confirmed who provides the payment service, who carries out customer identification, who controls withdrawals, and which regime applies to the protection of customer funds. The functions of an ordinary fiat currency account cannot automatically be extended to stablecoin exchange permissions, and bank deposit protection and the protection of funds at payment institutions must not be conflated.
Test receipt, refund and account closure before launch
It is advisable to use hypothetical transactions to verify whether the payee name entered by the payer, the country displayed and the actual destination of the funds are consistent, and to test duplicate payments, unknown incoming payments, and credits and refunds after a customer closes an account. Contracts and web pages should explain the actual service provider and the flow of funds; where automatic cross-border transfers are involved, particular attention should be paid to whether customers or payers are misled into believing that the funds remain local. Necessary data must be traceable to the actual payer and the ultimate beneficiary.
Recommended actions
- Obtain a map of the contractual relationships among the master account, the virtual numbers and the end users.
- Verify, one by one, the country code, the actual location of the account, the customer-facing balance and the legal nature of the payment function.
- Verify the account-name display, refund and post-closure crediting processes, and correct inaccurate marketing such as "bank account".
Information note: This article provides general information and does not replace legal advice based on specific facts.
References
- ACPR and Tracfin: Overview and Analysis of Virtual IBAN Services Offered in France (2026) — French Prudential Supervision and Resolution Authority (ACPR), Tracfin
- Safeguarding requirements for payment institutions and electronic money institutions — UK Financial Conduct Authority (FCA)
