Publication of the report ‘Overview and Analysis of Virtual IBAN Services Offered in France’ – ACPR and Tracfin warn against certain virtual IBAN usage practices presenting high money laundering risks

While most of the offerings of French institutions reviewed by the ACPR relate to legitimate uses to facilitate (i) payment reconciliation, (ii) analytical accounting, or (iii) treasury management, this report highlights the recent emergence of higher‑risk use cases for virtual IBANs that may be misused by criminal networks. The risk level associated with such products depends on how they are used and must be accompanied by adequate monitoring measures.

The use of multiple vIBANs for a single account appears acceptable provided that they exhibit homogeneous characteristics and, in practice, fall within the scope of merged accounts (i.e. virtual IBANs issued by the same institution, under the same country code, and used by the customer who holds the bank or payment account to which the transactions are posted).

Conversely, certain forms of vIBANs correspond to genuine payment accounts that are distinct from the master account, particularly where they are associated with a different country. As a matter of law, the same account cannot be opened simultaneously in multiple countries. Such use cases enable cross‑border flows to be processed while giving the appearance of domestic transactions. ACPR supervisory reviews and Tracfin’s work show that these services are not only used to address IBAN discrimination, but also, to a significant extent, to facilitate money laundering, by complicating the traceability of funds and hindering the action of financial intelligence units and law‑enforcement authorities (including longer investigation and asset‑seizure timelines). They are notably used by fraudsters to mislead victims as to the true destination of funds. In this context, institutions providing vIBAN services involving automatic redirection between two payment accounts must exercise heightened vigilance over their use and ensure they have the means to maintain an overall view of the operation of the accounts concerned. They must also demonstrate responsiveness and transparency vis‑à‑vis supervisory authorities, as well as financial intelligence units and law‑enforcement authorities.

European regulatory reforms will enter into force in July 2027 and will help reduce the risks associated with vIBANs, notably by improving their registration in bank account registers such as the French FICOBA database. However, ACPR and Tracfin also call on the International Organization for Standardization (ISO) to enhance the ISO 13616‑1 standard in order to distinguish IBANs from vIBANs more clearly, particularly in cases involving redirection from one country to another. Pending these reforms, the report reiterates the legal framework currently applicable and sets out good practices for risk management. The report notably concludes that, under the current legal framework, vIBANs bearing a ‘France’ country code must be analysed as payment accounts held in France, even where the underlying account is not held in France.

The report is based on a questionnaire conducted by ACPR in 2023, supplemented by several on‑site inspections by ACPR and case studies carried out by Tracfin.

Key figures: at the end of 2022, approximately 1.7 million active vIBANs in France were used by 400 000 customers, representing around EUR 4 billion in monthly flows (including legitimate flows).