As far as I know the "IBAN Only rule" which was recently adopted states that for credit transfers within the SEPA zone, an IBAN is sufficient to identify an account and the BIC is no longer required. I've found an article explaining IBAN and BIC which mentions the change and there are more specifics on the "IBAN Only rule" on this article from the same site. This and other sources all indicate that the IBAN only rule should have been in effect for months now.
But I just discovered that a recent transaction was refused by my new bank because the BIC, which I left empty, didn't validate. The fine print on the digital transfer form says this about the BIC code: "this field is optional for SEPA transfers within [country]". My previous bank correctly allowed me to leave the field empty. If it matters, the country of origin for the transfer is listed as using SEPA Credit Transfers for 100% of all credit transfers within the zone.
Can my bank still require me to provide a BIC? Does the IBAN only rule not cover the end-user aspect? I was under the assumption that the more convenient and less error-prone user experience was the main point of this change.
If this does indeed violate the IBAN only rule, is that potentially a red flag about my bank's system? Should I be concerned that their implementation of other aspects of their system, such as security, is equally sloppy?