SCIPAFI: Italy’s identity-fraud check for PSPs
SCIPAFI is the Italian state’s identity-fraud check, and Italian e-money and payment institutions are on its list of mandatory members. The system lets a member send the identity, tax and income data a customer has supplied and check them in real time against the databases of the Agenzia delle Entrate, the Ministry of the Interior, INPS and other public bodies. It was built for consumer credit, but the law now lets members use it whenever a check helps confirm a person’s identity, and a draft regulation published by the Ministry of Economy and Finance (MEF) in July 2025 would open it formally to every AML obliged entity. This piece covers the legal text, who must join, how to join, what a check returns, what the draft would change, and three cases from practice.
1. The legal basis: Title V-bis of Legislative Decree 141/2010
SCIPAFI stands for the public system for the administrative prevention of fraud in consumer credit, with specific reference to identity theft. Legislative Decree No. 64 of 11 April 2011 inserted it as Title V-bis of Legislative Decree No. 141 of 13 August 2010, the decree that transposed the Consumer Credit Directive. The core provisions are short:
| Article | What it does |
|---|---|
| 30-ter(1) | Sets up the system within the MEF to prevent identity-theft fraud in consumer credit and deferred payments; it may also support AML/CFT work and identity checks in other sectors |
| 30-ter(3) | The MEF owns the archive and may run it through Consap S.p.A., its in-house company, under a convention |
| 30-ter(5) | Lists the mandatory members (“aderenti”) |
| 30-ter(5-bis) | Lets other obliged entities under Article 3 of Legislative Decree 231/2007 join, on terms set by the implementing decree |
| 30-ter(7) and (7-bis) | Verification requests for credit and deferred-payment applications, and, outside that case, wherever a member judges a check useful to confirm identity |
| 30-quater | The archive’s three IT tools and access for police, the UIF and the Guardia di Finanza |
| 30-quinquies | The data categories that can be checked |
| 30-octies | Basis for the implementing regulation, currently MEF Decree No. 95 of 19 May 2014 |
Article 30-ter(9) adds a permanent working group with members from several ministries, the Banca d’Italia and the Guardia di Finanza. It steers the system and reports to Parliament each year. Article 30-ter(8) gives the public a free telephone and online channel to report a suspected identity theft.
2. Who must join, and who may
Article 30-ter(5) names the mandatory members. For a payments firm the first limb is the one that matters: banks, including EU and non-EU banks, and the financial intermediaries entered in the registers under Articles 106, 114-quater and 114-septies of the Consolidated Banking Act (TUB). Article 114-quater is the register of e-money institutions and Article 114-septies the register of payment institutions. The rest of the list covers telecoms providers, digital identity providers, energy retailers, pay-TV providers, insurers and credit-information system operators.
A firm outside those registers is not shut out. Article 30-ter(5-bis) lets any obliged entity under Article 3 of Legislative Decree 231/2007 join, on the terms set by the implementing decree. That is the route for most firms that operate in Italy under a passport, and it is the route the draft regulation sets out in detail (see section 6).
3. What sits inside the archive
Article 30-quater builds the archive from three tools:
- Network interconnection. Takes a member’s verification request and checks it against the databases of the public and private bodies connected to the system.
- Centralised module. Stores, in aggregated and anonymous form, the cases where one or more data items in a request turned out not to be authentic. It feeds fraud analysis and periodic guidance.
- Alert module. Holds members’ reports of frauds suffered and of cases showing a fraud risk, plus preventive alerts from the MEF. The statute keeps these only for as long as members need to establish whether the risk is real.
The Carabinieri, the Guardia di Finanza and the Polizia di Stato have free access. Results of specific interest go to the Department of Public Security and, where relevant, to the UIF and to the Guardia di Finanza’s special currency police unit. Consap lists the connected databases as those of the Agenzia delle Entrate, the Ministry of Infrastructure and Transport, the Ministry of the Interior, the State General Accounting Office, INPS and INAIL.
4. What a check covers
Article 30-quinquies makes three categories of personal data open to verification: identity and recognition documents, including whether they have been reported lost or stolen; VAT numbers, tax codes and documents showing income; and social-security and welfare contribution positions. The public bodies holding the data must make it available free of charge. A member sends the data the customer supplied; the system returns whether each item matches. SCIPAFI does not tell you who the person is. It tells you whether what they gave you is consistent with the state’s records.
The draft regulation spells out the fields. For identity it lists name, date and place of birth, sex, citizenship and a check that the person is alive, plus the ANPR (national resident register) identifier and residence. For documents it lists type, number, issue and expiry dates, issuing body and the serial number of the plastic card. It adds the health card number, tax code, VAT number, last tax return and taxable income, and employment and payroll data matched against INPS and INAIL. The system also flags whether a document is on the lost-or-stolen list and how many times the same document failed a check in the previous 180 days.
5. How to join, and what it costs today
Joining is a two-stage online procedure run from the SCIPAFI administrative portal:
- Formulario to the MEF. The firm declares which Article 30-ter(5) category it belongs to and names its contacts. MEF staff review it and reply by ordinary e-mail and PEC (certified e-mail), with approval or a request for changes. Progress shows under “Stato Richiesta” in the portal.
- Convention with Consap. After MEF approval, the firm submits the convention through the same portal. Consap reviews it; once approved, each named contact receives credentials by e-mail and PEC, and the firm gets a signed, time-stamped copy.
The procedure needs a qualified digital signature, a time stamp and a PEC address. Consap’s FAQ notes that credentials come in three parts (a login and two passwords) and that a firm’s SCIPAFI security contact regenerates them if two are lost. Attachments to the formulario and convention do not need a digital signature.
Members pay. Under Decree 95/2014, the MEF’s own explanatory report states, the one-off joining fee is EUR 2,528.67 plus VAT, rising to EUR 5,027.35 plus VAT where total assets in the last balance sheet exceed EUR 5 billion, and each verification request costs EUR 0.30 plus VAT.
6. The 2025 draft regulation: what would change
On 4 July 2025 the MEF put a new 29-article regulation out for public consultation, closing on 7 August 2025. It would repeal Decree 95/2014 and enter into force 15 days after publication in the Gazzetta Ufficiale. At the time of writing we have not found it published, so treat the points below as the direction of travel, not the law in force.
| Topic | Decree 95/2014 | 2025 draft |
|---|---|---|
| AML obliged entities outside the member list | Statutory route only (Art. 30-ter(5-bis)) | Article 6 sets the access terms, aligned on the rules for “authorised subjects” |
| One-off fee | EUR 2,528.67 (EUR 5,027.35 above EUR 5bn assets) | EUR 1,500 for companies; EUR 250 for professionals and sole traders |
| Fee per check | EUR 0.30 | EUR 0.28 up to 50,000 billable checks a quarter; 0.26 to 150,000; 0.24 to 300,000; 0.22 above |
| Fraud-risk report | — | Three or more mismatches, or altered or inconsistent documents, trigger a report to the alert module |
| Deadline to report | — | As soon as available, at the latest the second working day after the member learns of it |
| Retention in the alert module | As long as needed | Frauds suffered: 18 months. Fraud risk: a monitoring period of at most 90 days, then reclassified or deleted |
| Data subject | — | Automatic notification through a web app when a record is entered |
Fees are stated net of VAT. The 90-day rule has a mechanism: the member opens the monitoring period when it files the risk report, and must close it with either “fraud confirmed” or “monitoring closed without further action”. If it does neither, the MEF deletes the record after 90 days, warning the member ten days before.
7. Worked example: the Italian EMI onboarding remotely
Facts: An e-money institution authorised by the Banca d’Italia, and therefore in the Article 114-quater register, onboards consumers through an app. It offers no credit or deferred payment.
What the rule says: As a 114-quater institution it is a mandatory member under Article 30-ter(5). The credit-application trigger in paragraph 7 does not fit its product, but paragraph 7-bis lets a member request a check whenever it judges one useful to confirm a person’s identity.
What the practitioner does: Completes the formulario and convention if not already done. Places the SCIPAFI call after document capture and before account activation, sending document number, tax code and identity fields. Treats any mismatch as a reason to step up checks, not as an automatic refusal, and records the result in the customer file alongside the remote identification evidence.
Outcome: The firm meets its membership obligation and gains a state-sourced cross-check on documents, including lost-or-stolen status, that photo analysis alone cannot give.
8. Worked example: the passported EMI with an Italian branch
Facts: An EMI authorised in another member state serves Italian customers through a branch in Milan. Its fraud team wants SCIPAFI checks for Italian onboarding.
What the rule says: If the firm is not in the TUB registers named in Article 30-ter(5), its route is paragraph 5-bis, as an obliged entity under Article 3 of Legislative Decree 231/2007. The statute leaves the terms to the implementing decree; the 2025 draft would settle them in Article 6.
What the practitioner does: Files the formulario declaring the category it actually belongs to and asks the MEF to confirm eligibility in writing. Keeps the product launch independent of SCIPAFI until access is granted, and budgets on the current fees, not the draft ones.
Outcome: The firm avoids building an onboarding flow around a data source it may not yet be entitled to query, and is ready to connect once access is confirmed.
9. Worked example: three mismatches on one applicant
Facts: A member checks a customer applying for a buy-now-pay-later limit. The document number, the residence and the taxable income all come back as mismatches.
What the rule says: Under the draft, three or more mismatches create a fraud risk that must go to the alert module by the second working day after the member learns of it, opening a monitoring period of at most 90 days. The customer is notified automatically. A SCIPAFI report is not a suspicious transaction report: the duty to report suspicions to the UIF under Legislative Decree 231/2007 runs separately.
What the practitioner does: Declines or parks the application, files the risk report within the deadline, and opens an internal case. If the investigation finds an identity theft, it reports “fraud confirmed”, which turns the record into a fraud-suffered entry kept 18 months. It also assesses, as a separate decision, whether the facts justify a report to the UIF.
Outcome: Other members checking the same documents see the alert, the genuine identity holder learns their data is being misused, and the AML file shows that the suspicion question was asked.
FAQ
What is SCIPAFI?
Italy’s public system for preventing identity-theft fraud in consumer credit, set up under Title V-bis of Legislative Decree 141/2010. It checks customer-supplied identity, tax, income and contribution data against public databases.
Who runs it?
The Ministry of Economy and Finance owns it; Consap S.p.A. manages it under a convention with the MEF.
Must an e-money or payment institution join?
Yes, if it is entered in the Article 114-quater (e-money) or 114-septies (payment institutions) register of the TUB. Other AML obliged entities may join under Article 30-ter(5-bis).
Can SCIPAFI be used outside credit?
Yes. Article 30-ter(7-bis) allows a check wherever a member judges it useful to confirm a person’s identity.
How much does a check cost?
EUR 0.30 plus VAT under Decree 95/2014. The 2025 draft would cut this to between EUR 0.22 and 0.28 depending on quarterly volume.
Is the new regulation in force?
Not as far as we can verify. The MEF consulted on it in July and August 2025; it enters into force 15 days after publication in the Gazzetta Ufficiale.
Does a SCIPAFI fraud report replace a SAR?
No. Suspicion reporting to the UIF is a separate duty under Legislative Decree 231/2007.
What to do, today
- Compliance, Italian-authorised firms: confirm you have signed the Consap convention. Membership is mandatory for 114-quater and 114-septies institutions.
- Passported firms: if you want access, file the formulario under paragraph 5-bis and get eligibility confirmed in writing before building on it.
- Onboarding product owners: decide where the check sits in the flow and what a mismatch triggers. Document both in the CDD procedure.
- Fraud operations: draft a two-working-day reporting runbook and a 90-day monitoring tracker now, so the draft regulation does not catch you out on publication.
- Finance: budget on EUR 0.30 a check until the new fee table is published.
Related: Remote identification in Italy · CAI — Italy’s interbank alarm register · The Italian AML framework beyond the UIF
