Pushing back on APP fraud: mandatory reimbursement rules

Briefing

As the FCA's latest update on financial crime demonstrates, tackling fraud continues to be one of the major areas of concern of the regulators. Authorised push payment (APP) fraud, in particular, remains a key priority given the harm it can cause consumers. According to recent market research by VISA, one in three surveyed consumers have fallen victim to APP fraud. Data from UK Finance shows that in the first half of 2023, the volume of APP cases increased by 22% compared to the equivalent period in 2022 and the PSR's APP fraud performance report demonstrates that APP fraud accounted for 40% of total fraud losses in 2022.

It will therefore be some relief to consumers when the APP scam reimbursement requirement rules come into force on 7 October 2024. In this article, we summarise the background to the new regime and consider the key changes that payment service providers (PSPs) and consumers should be aware of.

Background

On 19 December 2023, the PSR published its policy statement issuing its final decision on fighting APP scams and setting out parameters of the reimbursement requirement policy. This policy statement follows the June 2023 policy statement, which introduced the reimbursement requirement for payments within the Faster Payments scheme. Broadly, the aims are to:

incentivise industry investment in end-to-end fraud prevention
improve customer protections, boosting confidence in the UK payments ecosystem
pursue the PSRs long-term aim for Pay.UK to take a broader role and actively improve rules on Faster Payments. Pay.UK is the UK's operator and standards body for interbank payment systems. Among other things, Pay.UK is responsible for running retail payments operations such as the Faster Payments System, Bacs Payment System, and the Image Clearing System.

By taking responsibility for protecting customers, the PSR expects that in-scope firms will develop effective data-driven interventions to change customer behaviour. The Treasury has also committed to legislate to provide clarity on risk-based delays to support fraud prevention.

The reimbursement requirement rules form part of the Faster Payments rules and are ancillary to the execution of transactions using the Faster Payments scheme. In the June policy statement, the PSR confirmed its intention to issue three legal instruments to bring the APP scam reimbursement requirement into effect.

In October 2023, the PSR published its first report on APP scam data (referred to above), covering industry performance for 2022, as part of a new ongoing commitment. The PSR's goal is to set minimum standards, define outcomes and align incentives for firms.

Policy: key changes and takeaways

The PSR has issued three legal instruments that give effect to the reimbursement rules. These are PSR Specific Requirement 1 (SR1), PSR Specific Direction 19 (SD19), and PSR Specific Direction 20 (SD20).

Together these instruments combine to impose obligations on Faster Payments participants so that they are subject to the reimbursement requirement rules. SR1 imposes a requirement on Pay.UK to amend existing Faster Payments rules to include the reimbursement requirement. SD19 directs Pay.UK to implement a compliance monitoring regime for PSPs with regards to the reimbursement rules. SD20 directs Faster Payments participants to comply with the reimbursement requirement rules.

The key changes and takeaways from these are:

Sending PSPs will be liable to reimburse APP scam victims, unless there is an exception in the consumer standard of caution (see below for further details), or the time limit to bring the claim has expired. However, if the APP scam claim is made up of a series of payments, any payments made before the start date of the reimbursement requirement (7 October 2024) are not covered by these rules.
The time limit to submit an APP scam claim is 13 months after making the last payment in the case. If the claim is made more than 13 months after, the sending PSP is not subject to the requirement to reimburse the customer. Pay.UK will keep the 13-month period under review.
The maximum reimbursement level is £415,000 per claim, which will apply to all in-scope consumers. The PSR has confirmed this will not increase automatically with inflation or any other metric, although the PSR will monitor the incidence and impact of high value APP scams prior to the start date and may review the maximum reimbursement level if it considers it necessary. Sending PSPs may choose to reimburse a value exceeding the maximum level of a single APP scam case.
Sending PSPs will be allowed to levy an excess of up to £100 per claim. It is at the discretion of the sending PSPs to determine whether to apply a full excess (£100), a lower excess amount or not apply an excess at all. Any future changes to this value will be subject to review by the PSR. An excess cannot apply to vulnerable customers.
PSPs are expected to have firm plans on how to communicate this new protection in line with the FCA's Consumer Duty.
A sending PSP may claim to share the costs of reimbursement with a receiving PSP. If claimed, the receiving PSP must send 50% of the cost of a reimbursement claim to the sending PSP. However, if the sending PSP does not apply an excess, or applies a partial excess, it cannot claim the amount not levied from the receiving PSP as part of the 50-50 split. By way of example, if the sending PSP decided to levy an excess of £50 on a £1,000 APP scam, under the 50-50 liability split the amount reimbursed to the consumer is £950. The receiving PSP is liable for £450, and the sending PSP is liable for £500.
Sending PSPs will be required to notify the receiving PSP of an APP scam within a specific period to maximise the chance of recovering stolen funds. The notification timeframe will be determined and kept under review by Pay.UK.
The 'stop the clock' provision has been amended so that the sending PSP can stop the clock when contacting the receiving PSP to request information to inform the APP scam assessment. The timescale for deciding whether to reimburse is 35-business days.
Where a sending PSP requests information from a receiving PSP, the receiving PSP is required to respond.
Indirect access providers will be required to provide information on the indirect PSPs whom they supply Faster Payments to on an annual basis from 31 March 2024. From 30 April 2024, they must provide notice of any changes to the list on a monthly basis.
Whilst Pay.UK's scheme rules only apply to direct participants, SD20 brings all in-scope PSPs under the reimbursement requirement.
Credit unions, municipal banks and national savings banks are excluded from the scope of the reimbursement policy as they are considered far less susceptible to APP scams.
Pay.UK is directed by the PSR to create and implement an effective monitoring regime. The PSR expects Pay.UK to measure whether in-scope PSPs are consistent in compliance with the reimbursement rules, identifying non-compliance and ensuring they address compliance issues.

The policy statement confirms that the PSR is engaging extensively with other regulators regarding APP scams, namely the FCA, the Treasury, the Home Office, Ofcom, the Financial Ombudsman, the Department for Science, Innovation and Technology, law enforcement and other public bodies. The PSR will also work with the FCA and Pay.UK to ensure customers are treated fairly under the Consumer Duty.

Consumer standard of caution

The policy statement confirms the final approach to the consumer standard of caution, this includes that consumers should:

Have regard to interventions made by their sending PSP or competent national authority, eg the police. Interventions must be clear in communicating the assessment of the probability that an intended payment is an APP scam.
Report promptly to the PSP when they learn or suspect that they are victim of an APP scam. This should be at least within 13 months after the last scam payment was authorised.
Respond to reasonable and proportionate information requests from their PSP when assessing a reimbursement claim.
After making a claim, consent to the PSP reporting the APP scam to the police on behalf of the consumer, or request the consumer directly reports the scam to a competent national authority.

If one or more of these standards are not met, and it is deemed the consumer has done so in gross negligence, under the consumer standard of caution exception, the PSP is not required to reimburse the consumer. However, this exception cannot be relied upon in relation to a vulnerable consumer.

Alongside the policy statement, the PSR has also published The Consumer Standard of Caution Exception Notice, and The Consumer Standard of Caution Exception Guidance.

What's next?

The reimbursement rules take effect on 7 October 2024, and in-scope PSPs will need to implement the rules by this date. PSPs may make voluntary reimbursements for APP scams before this date.

Prior to the start date of the rules, the legal instruments require Pay.UK to submit its compliance monitoring proposals to the PSR by 5 April 2024, and Pay.UK must publish the approved compliance monitoring regime and final version of the reimbursement rules by 7 June 2024.

In addition, Pay.UK is expected to share its implementation delivery plan with the industry in good time. The PSR plans to monitor its progress in accordance with the plan.

CHAPS

Separately, the Bank of England has announced on its website that it intends to implement a comparable reimbursement requirement for retail CHAPS payments. The Bank is working with the PSR and CHAPS direct participants, and other stakeholders, to create a similar model that is closely aligned to the Faster Payments reimbursement rules. It has so far confirmed that it will be in line with the same maximum reimbursement level of £415,000 per claim. The PSR is considering whether it is required to consult on a specific direction for CHAPS participants, if it does so, this consultation is expected by the end of Q1 2024.