As far as I've been able to tell, the root of this particular issue (and there are plenty of other issues with the IOR) is that the bank 1) did not supply required originating party information on its wires to an Italian bank, as required under EU law, 2)further declined to supply them to the Italian bank when asked. The Italian bank then escalated the case to its regulator.
Now, the Vatican isn't a member of the EU, but the Italian bank is covered under the EU law. Everything they did seems appropriate under that law.