Short answer
An EU bank or payment provider cannot refuse a properly authorised transfer merely because it prefers not to process it. Under PSD2, an authorised order meeting the framework contract's conditions generally must be executed unless EU or national law prohibits it.
There are, however, several lawful intervention routes. A provider may block a card or other payment instrument for objectively justified security or suspected-fraud reasons if its framework contract reserves that right. Anti-money-laundering (AML) rules can require a provider to refrain from executing a suspicious transaction, follow Financial Intelligence Unit (FIU) instructions, or stop where customer due diligence cannot be completed. A directly applicable EU sanctions regulation may require an asset freeze or prohibit making funds available to a listed person or controlled entity. Missing payer or payee information can trigger risk-based rejection, suspension or an information request.
“Reverse” is different. Once an order has reached the PSD2 point of irrevocability, the payer normally cannot cancel it unilaterally. A recall request may be attempted, but recovery generally needs provider cooperation, the payee's agreement, a legal order or a separate refund right. Fraud suspicion alone does not guarantee that a completed credit transfer can be clawed back.
First identify what the provider actually did
The legal test changes with the event:
- instrument block: the card, app credential or payment instrument cannot be used;
- order refusal: a specific transfer is not accepted for execution;
- temporary hold: execution waits for AML review, missing data or an authority instruction;
- asset freeze: funds stay in a frozen account and cannot be made available under sanctions law; or
- recall or reversal: an already received or executed order is cancelled, returned or recovered.
“Pending compliance review” does not identify the power used. The customer should ask for status, the disclosable legal or contractual basis and the complaint route. AML reports or investigations may remain confidential.
PSD2 permits a security or fraud block, but sets limits
Article 68 of Directive (EU) 2015/2366 allows a framework contract to reserve a right to block a payment instrument for objectively justified reasons relating to its security, suspected unauthorised or fraudulent use, or—where the instrument has a credit line—a significantly increased repayment risk.
The provider should tell the payer about the block and its reasons before it takes effect where possible, or immediately afterwards. It can withhold that information where disclosure would compromise objectively justified security reasons or another EU or national rule prohibits notice. The instrument must be unblocked or replaced once the reasons no longer exist.
This power concerns a payment instrument, not an unlimited account freeze. Denial of payment-initiation or account-information access requires evidenced unauthorised-or-fraudulent-access reasons, limited notice, restoration when those reasons cease and a report to the competent authority.
Case C-287/19, DenizBank, also limits reliance on the PSD2 derogation for low-value instruments that supposedly cannot be blocked. A provider cannot merely assert that blocking is impossible where available technology does not establish that impossibility. The case does not create a general duty to approve a suspicious transaction; it prevents an unsupported claim that an instrument falls outside normal blocking protections.
A transfer order can be refused only on a valid basis
PSD2 requires notice of refusal, the reason if possible, and how to correct factual errors, unless another law prohibits disclosure. More fundamentally:
Where the framework-contract conditions are met, the provider “shall not refuse to execute an authorised payment order” unless prohibited by other relevant EU or national law. —
A provider may refuse for insufficient funds, invalid execution data, AML, sanctions, a court order or another applicable rule. “Compliance” should reflect a real rule and documented assessment, not commercial preference.
A refused order is treated as not received for PSD2 execution-time and non-execution liability purposes. This differs from an order received and then delayed beyond the required execution period, which may raise separate liability questions.
AML rules may require silence and delay
Banks and payment institutions are obliged entities under the EU AML framework as transposed nationally. If they cannot complete required customer identification, beneficial-owner identification or purpose-and-nature checks, Article 14(4) of Directive 2015/849 requires Member States to ensure that they do not execute through a bank account or establish or continue the relevant relationship, and that they consider an FIU report.
That Directive remains the operative reference for these duties through 9 July 2027, subject to national transposition. Regulation (EU) 2024/1624 generally applies from 10 July 2027, when Directive (EU) 2024/1640 repeals Directive 2015/849. Providers should therefore version their AML basis rather than applying the future regulation early.
Where an institution knows or suspects that a transaction relates to criminal proceeds or terrorist financing:
Member States must require it to “refrain from carrying out transactions” until it has reported and complied with further FIU or competent-authority instructions. —
If waiting is impossible or likely to frustrate pursuit of the beneficiaries, the Directive provides for immediate reporting afterwards. National law determines the FIU's suspension powers, time limits and review procedures.
The provider is also subject to anti-tipping-off rules. A customer may therefore receive only a general explanation while a suspicious-transaction review is active. Lack of detail does not prove that the hold is lawful, but the ordinary PSD2 explanation duty expressly accommodates legal prohibitions on disclosure.
Missing transfer information triggers a risk-based response
Regulation (EU) 2023/1113 requires prescribed payer and payee information to accompany transfers of funds and corresponding originator and beneficiary information for covered crypto-asset transfers.
For missing or incomplete information, the payee's provider must use risk-based procedures to execute, reject or suspend the transfer. It must reject or request the information, before or after crediting depending on risk. Repeated failures can lead to warning, restriction or termination and a competent-authority report.
Missing data indicates risk, not money laundering. The provider should apply its documented process rather than treat every formatting problem identically.
Sanctions can require a freeze rather than a return
EU restrictive measures are adopted in separate regulations with different targets, prohibitions, ownership and control tests, exceptions and licensing routes. The provider must identify the actual regime and listing applicable on the transaction date.
For example, Council Regulation 269/2014 provides:
“All funds and economic resources” belonging to, owned, held or controlled by listed targets “shall be frozen”. —
It also prohibits making funds or economic resources available, directly or indirectly, to or for listed targets. A frozen payment is not simply rejected and returned: incoming funds may be credited to a frozen account while remaining frozen, and release may require a competent-authority authorisation under the regulation's derogations.
For euro instant transfers, Regulation 2024/886 requires user checks against targeted financial measures at least daily and after changes. It generally prevents duplicative payer/payee screening during each transfer, without displacing other sanctions or AML controls or authorising payment to a listed person.
Reversal depends on timing and legal basis
Under PSD2 Article 80, the payer generally cannot revoke an order after the payer's provider receives it. Orders initiated through a payment-initiation service or by the payee become irrevocable at the rule's specified consent point. Scheduled payments and direct debits have limited earlier cancellation windows.
After those points, revocation usually requires agreement with the relevant providers and, for payee-initiated transactions and direct debits, the payee. The framework contract may allow a charge. A “recall” message sent through the banking network is therefore a request, not a judicial clawback and not proof that funds will return.
Separate rules may require reimbursement for an unauthorised or defectively executed payment, and national law may permit freezing or recovery following fraud. Those questions concern loss allocation and legal remedies, not a general right to reverse every transfer later regretted or fraudulently induced.
What notice and review should be expected?
The provider should ordinarily communicate a PSD2 block or refusal promptly and give reasons. Exceptions protect investigations, security and confidential AML action. Sanctions may instead require authority reporting, licensing or delisting.
A useful written challenge identifies:
- the payment instrument and transaction reference;
- whether the order is unreceived, refused, pending, executed, returned or frozen;
- the time and channel of authorisation;
- any requested identity, beneficiary or source-of-funds information supplied;
- whether the provider is asserting contract, fraud, AML, sanctions or authority instruction; and
- the internal complaint, national alternative-dispute-resolution and supervisory routes.
The customer should not evade a freeze by rerouting funds. For a false name match, accurate identity and ownership evidence is more useful than repeated attempts.
Conclusion
EU law permits targeted intervention, not unexplained discretion. PSD2 governs instrument blocks and order refusals; AML rules may require a confidential hold or customer-due-diligence stop; transfer-information rules use a risk-based reject, request or suspend process; and the applicable sanctions regulation may mandate a true asset freeze.
Once an order is irrevocable or executed, “reversal” becomes a separate recovery question. The key is to identify the transaction's exact status and legal basis, then apply the matching notice, release, complaint or authorisation route.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.