Verification / validation of password matching should be triggered when:

The password field contains text and...

• the user has entered a string into the confirm password field of the same length as the string they entered into password field
• the user moves from the confirm password field to another field after entering text into the confirm password field
• the user has entered text into the confirm password field and has paused typing for 2 seconds
• the user presses the 'Next' button (submits form)