What’s the max duration for optout that we can define? What’s recommended?
I would recommend validating the point with your legal team. Regarding our recommendation, I propose :
1/ Single verification : 24 hours maximum - the typical use case we want to prevent is a double VoP check when the client adds a new beneficiary + processes a 1st payment a few minutes later.
2/ Batch verification
: it depends, if you have the client 'Opt out' I would recommend 365 days. If not, 24 hours as well.
Will you be able to provide with a list of public IBANs that should be whitelisted (like public tax organisms)?
Qombo's whitelist is a shared list between the different clients. We encourage our clients to process an historical analysis internally and to share it with us before going live with VoP.
After a couple weeks using VoP, we will be able to enrich the list with your client's data and we will process this task on a regular basis to enrich the list with the most recurring bank accounts owned by legal entities (we don't accept individuals on our whitelist for GDPR concerns).
How should it work for automatic recurring transfers (according to EPC)?
The Verification of Payee must be performed at the time of setting up a recurring credit transfer, not before each individual execution.
This is confirmed in the official clarification published by the European Commission: “The service ensuring verification of the payee is to be executed immediately after the payer provides relevant information about the payee and before the payer is offered the possibility of authorising that credit transfer. In such a scenario, the payer would still be present at the time of placing a payment order for a recurring credit transfer and thus would be duly informed about the outcome of the payee verification process prior to the authorisation of the payment order and its subsequent execution by his PSP.”
Therefore, once the recurring payment is established and authorised, subsequent scheduled executions do not require a new VoP, unless the payer’s PSP or the payment data changes.