Your rights under the Payment Services Regulations

Every time you tap a card, set up a direct debit, send a bank transfer or approve a purchase in your banking app, a set of rules called the Payment Services Regulations stands behind the transaction. They decide what your bank must tell you before you pay, how quickly a payment must arrive, what happens when a payment goes wrong, and who pays when someone uses your card without permission.

The headline protections are straightforward. If a lost or stolen payment instrument is misused, your liability is capped at £35¹. If a payment from your account was not authorised, your provider must refund it and put your account back as it was². Traders cannot charge you extra simply for paying by card³. And if your provider will not put things right, you can take the complaint to the Financial Ombudsman Service for free.

Where the Payment Services Regulations come from

The Payment Services Regulations 2017 are the main set of rules governing payment services in the UK. They were made on 18 July 2017⁴, with the first provisions coming into force on 13 August 2017 and further provisions, including the Part 2 authorisation and registration regime, on 13 October 2017⁶.

The regulations were the UK's implementation of the EU's second Payment Services Directive, known as PSD2. Since the UK left the EU, the regulations have become assimilated law: they still broadly govern the authorisation of payment service providers and the requirements placed on them, but they are now amended by UK instruments rather than by EU directives⁷. One example is the Payment Services (Amendment) Regulations 2024, which applies only to outbound authorised push payments wholly executed in the UK in sterling⁷.

The rules distinguish between consumers and business users in one important way. Where the payment service user is not a consumer, a micro-enterprise or a charity, the parties may agree that any or all of the provisions of Part 6 of the regulations, which covers information requirements and the terms of payment contracts, do not apply⁸. Consumers cannot be asked to give up these protections.

The regulations also interact with older consumer law. The Financial Services (Distance Marketing) Regulations 2004, which govern contracts agreed at a distance, require a supplier to provide only specified items of information for contracts for payment services under the 2017 regulations⁹. Alongside the regulations sit the Consumer Rights Act 2015, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 and the Consumer Rights (Payment Surcharges) Regulations 2012, each of which adds its own protections around payments, as later sections of this page explain.

Strong customer authentication: why your bank asks you to verify online payments

If you have wondered why your banking app asks you to confirm an online purchase, or why a card payment sometimes needs a passcode texted to your phone, the answer is a legal duty, not a marketing choice. A payment service provider must apply strong customer authentication where a payment service user accesses its payment account online, initiates an electronic payment transaction, or carries out any action through a remote channel which may imply a risk of payment fraud or other abuses¹⁰.

Strong customer authentication means checking at least two independent elements, such as something only the user knows, something only the user possesses, and something the user is. In practice this is what happens when you approve a payment with your phone using a fingerprint or face check, or enter a one-time passcode as well as your password. The duty applies to logging into your account online, to starting any electronic payment, and to any other remote action that could open the door to fraud¹⁰.

The duty sits with the provider, not with you: a firm cannot simply opt out of authentication checks because they are inconvenient. If a provider fails to apply the required authentication, that failure is relevant to who bears the loss when a disputed payment is investigated.

The same logic extends beyond banks. Government and other online services apply their own identity checks, and consumers may be asked to prove identity with photo ID such as a passport or driving licence when using an online service. These checks are about keeping details safe and preventing identity fraud, and they mirror the reasoning behind the payment rules: remote channels carry fraud risk, so access to them is verified.

Unauthorised card payments: you pay no more than £35

The regulations cap what a provider can make you pay when a payment instrument is lost, stolen or otherwise misappropriated and someone uses it without your permission. A payment service provider which is liable for an unauthorised transaction may require that the payer is liable up to a maximum of £35 for losses resulting from use of a lost or stolen payment instrument, or from misappropriation of a payment instrument¹. Everything above that must be refunded.

The £35 cap is the rule under the Payment Services Regulations, but card users also have a parallel protection with a different figure under the Consumer Credit Act 1974. There is a limit of £50 liability for unauthorised transactions made before the card issuer is notified where the card has been lost or stolen¹¹. In practice, the more favourable treatment applies to the cardholder, and card firms' terms generally reflect the stricter cap.

There is an important exception to both caps. There is no limit on the customer's liability for transactions made before notification of the card issuer where the card has been used by an individual who had the card with the cardholder's consent¹¹. In plain terms, if you gave your card or its details to someone and they used it, the caps do not apply, which is why banks ask careful questions about who had access to the card before deciding a dispute.

Two further points are worth knowing. First, the caps cover losses before you notify the provider; once you have told your bank that a card is lost or stolen, or that payments are appearing that you did not make, the provider bears what happens next. Second, the £35 and £50 caps are about unauthorised use of the instrument. They are separate from Section 75 of the Consumer Credit Act, which is about the goods or services themselves: if you paid by credit card and the cost was more than £100 and less than £30,000, you have rights against the card issuer when a trader fails to deliver or misrepresents what it sold¹².

Your bank must refund a payment you did not authorise

When a payment from your account was not authorised, the regulations put the duty to put it right on your provider. Regulation 76(1) requires the provider to refund the amount of the unauthorised payment transaction to the payer and, where applicable, to restore the debited payment account to the state it would have been in had the unauthorised payment transaction not taken place¹³. The refund includes not just the money taken but the knock-on effects: charges and interest that would not otherwise have arisen.

The Financial Conduct Authority's conduct rules reinforce this. Under the FCA's banking conduct of business rules, where a payment from a banking customer's account was not authorised, a firm must, within a reasonable period, refund the amount of the unauthorised payment and, where applicable, restore the account to the state it would have been in had the payment not taken place¹⁴. So the duty is both to refund and to do so promptly.

The rules bite in situations people often do not expect. Recurring card payments let businesses charge your payment card on a recurring basis without getting your permission each time, which is how subscriptions and gym memberships work. If you did not consent to the recurring card payments, your card issuer should stop the payments and give your money back, and any further payments taken by the business after you cancel are considered to be unauthorised transactions¹⁵. Providers apply the same principle to their own products: NS&I, for example, states that if you did not authorise a payment from your account it will normally return the account to the position it would have been in had the unauthorised payment not happened¹⁶.

The refund duty is not unlimited. A provider can refuse or reduce a refund where the customer failed to take reasonable care, for example by keeping security details in a way that allowed the misuse, or by not reporting lost security details promptly¹⁶. Where a payment was authorised by you but you were tricked into making it, different rules apply: the authorised push payment scams reimbursement requirement covers payments that were authorised by the consumer, executed in the UK, and received into an account not controlled by the consumer, where the payment was not to the recipient or purpose the consumer intended¹⁷.

If your provider refuses a refund and you disagree, the Financial Ombudsman Service can look at the case, and it may ask the provider to refund any payments you did not authorise, refund charges and interest the bank has applied, compensate you for money you lost, and pay compensation for distress or inconvenience⁵.

When a payment is not made, or is made wrongly

Not every payment problem is about fraud. Sometimes a payment simply does not arrive, arrives late, or goes to the wrong place or in the wrong amount. The regulations treat these as execution problems and give the payment service user a route to redress. Regulation 74 provides that a payment service user is entitled to redress under regulation 76, 91, 92, 93 or 94, which cover liability for unauthorised transactions, non-execution or defective or late execution of transactions, and charges and interest¹⁸.

Regulation 74 also closes a trap that could otherwise catch people out. A user is normally expected to notify their provider of a problem, but where the provider failed to provide or make available information concerning the payment transaction in accordance with Part 6 of the regulations, the user is entitled to redress notwithstanding that they failed to notify the provider¹⁸. In other words, if the provider did not give you the information you were owed about the transaction, you do not lose your rights by not having spotted and reported the problem.

For payments initiated by or through a payee, such as direct debits and recurring card payments, regulation 80 sets out how a refund request must be handled. The payment service provider must either refund the full amount of the payment transaction, or provide justification for refusing to refund it, indicating the bodies to which the payer may refer the matter². A provider cannot sit on a request: if it requires further information from you, it may not refuse the refund until it has received that information².

Direct debits have their own long-standing protection on top. Direct debits are covered by the Direct Debit Guarantee, and if the bank or an organisation you are paying makes a mistake, your bank must refund the payment to you⁵. For payments that go missing abroad rather than at home, the guide to tracing, cancelling or recalling a payment explains the practical steps.

No surcharges for paying by card

A trader cannot charge you extra simply for the way you choose to pay. Regulation 6A provides that a payee must not charge a payer any fee in respect of payment by means of a card-based payment instrument which is not a commercial card, a payment instrument which would not fall within the definition of a commercial card, or a payment service to which Regulation (EU) 260/2012 applies³. In everyday terms, consumer debit and credit cards and common electronic payment methods are covered; corporate cards are not.

The ban is stated in consumer guidance in the same terms: under the Consumer Rights (Payment Surcharges) Regulations 2012, traders are banned from imposing surcharges on consumers for using certain payment methods¹⁹. Before the outright ban, the rules were a cap: a trader could not charge consumers, in respect of the use of a given means of payment, fees that exceeded the cost borne by the trader for the use of that means²⁰. The Consumer Rights Act 2015 also provides that a trader must not impose any fee on the consumer in respect of the payment²¹.

The rules have teeth. Where a fee is charged in contravention of the ban, any contract provision requiring payment of the fee is unenforceable to that extent, and the contract is treated as providing for the fee to be repaid²⁰. So a card surcharge is not just unfair, it is legally recoverable.

The ban is about what traders charge consumers. Behind the scenes, businesses still pay fees to accept cards, and the Payment Systems Regulator is examining card fees to ensure businesses and consumers are getting a good deal on card payments²². That work is about the wholesale market, but it matters to consumers because card scheme fees feed into what shops pay and, in turn, into prices.

Knowing the real cost of a payment

The regulations also control what a provider can charge you and what it must tell you. Under regulation 66, charges must be agreed between the parties and must reasonably correspond to the payment service provider's actual costs¹³. A provider cannot invent a penalty figure: the charge has to reflect what the service actually cost to provide.

The same principle applies when a payment contract ends. Any charges for the termination of the contract must reasonably correspond to the actual costs to the payment service provider of termination²³. This is the rule that stops a provider from imposing a large exit fee on a closing account.

Information duties sit alongside the price rules. Under regulation 101, a payment service provider must inform the payment service user about the details of one or more providers of dispute resolution services able to deal with disputes concerning rights and obligations under the regulations, if the provider uses such services, and this information must be available on the provider's website, at its branches and in its general terms and conditions²⁴. The Payment Accounts Regulations 2015 add duties around basic bank accounts: designated credit institutions must make available to consumers, free of charge, accessible information about the specific features of the accounts they offer and the associated fees and conditions of use, and the Money and Pensions Service must endeavour to raise awareness among consumers about the availability of these accounts, their pricing, access procedures and the right to complain to the Financial Ombudsman Service²⁵.

Consumer contract law adds a consent rule that catches hidden extras. Under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, no payment is payable in addition to the remuneration agreed for the trader's main obligation unless, before the consumer became bound by the contract, the trader obtained the consumer's express consent²⁶. And if a trader provides a telephone helpline about goods you have bought, it cannot be charged at more than the basic rate¹⁹.

Where the rules stop: charges hidden in exchange rates

The disclosure rules are powerful, but they have a boundary, and it matters most on international payments. The regulations provide that a payer or payment service user is not obliged to pay a charge for use of a particular payment instrument if not informed of the full amount before initiation of the transaction²³. That is a clear rule for upfront charges: if the fee was not disclosed in full before you made the payment, you do not have to pay it.

The gap is the exchange rate itself. A provider can quote a rate that includes a margin in its favour, and the payment regulations require the rate, or the way a reference rate is used to calculate it, to be disclosed, but they do not apply the "actual costs" fairness test to what is inside that rate. The charge rules bite on fees; the margin hidden in the conversion is disclosed as part of the rate rather than capped. This is why two providers can quote the same upfront fee and still deliver very different amounts to the recipient.

Where a fee is charged unlawfully, redress extends beyond the payment regulations. Regulation 10 extends the consumer's right of redress to cases where any payee charges a fee in contravention of regulation 6A, with the fee to be repaid to the extent the charging contravenes the rules²⁸. And under the Consumer Protection from Unfair Trading Regulations 2008, where a misleading action or aggressive practice is established, the consumer has the right to unwind the contract, the right to a discount and the right to damages¹⁹.

For practical help on this front, the guide to exchange rates on international payments explains the mid-market rate, margins and quotes, and banks vs specialist providers sets out the options side by side.

Who enforces the rules

Enforcement is split between bodies with different jobs. The Financial Conduct Authority authorises payment service providers and enforces its conduct rules, including the requirement to refund unauthorised payments within a reasonable period¹⁴. The Payment Systems Regulator is the first economic regulator to oversee payment systems²⁹, and it is the main competent authority for the monitoring and enforcement of the UK Interchange Fee Regulation, monitoring compliance with all its provisions including caps and business rules³⁰.

The Payment Systems Regulator is explicit about what it does not do: it does not deal with consumer related issues, handle complaints from consumers about individual payments, or get involved with financial issues beyond the payments industry²⁹. Its work on card fees and card acquiring market rules is about the systems as a whole²². Individual disputes belong elsewhere: your provider first, then the Financial Ombudsman Service.

The ombudsman route is built into the regulations themselves. Providers are required to inform payment service users of any right they may have to complain to the Financial Ombudsman Service⁸, and where a provider refuses a refund it must indicate the bodies to which the payer may refer the matter². The ombudsman is free to use and its decisions bind the firm if you accept them.

How to claim a refund and where to complain

The process starts with your provider. The best thing to do first is contact your account provider, for example your bank²², and you can also contact the Financial Ombudsman Service if you are still unhappy²⁹. For lost or misused cards, report to your bank or payment provider as soon as you can, since the liability caps cover the period before notification.

Timing matters for one category of payment. For payments initiated by or through a payee, such as direct debits and recurring card payments, the payer must request a refund under regulation 79 from its payment service provider within 8 weeks from the date on which the funds were debited². Once you have made the request, the provider must either refund the full amount or provide justification for refusing, indicating the bodies you can refer the matter to, and if it needs further information from you it may not refuse the refund until it has received it².

If the provider says no and you remain unhappy, complain to the Financial Ombudsman Service. It can ask the provider to refund payments you did not authorise, refund charges and interest the bank applied, compensate you for money you lost, and pay compensation for distress or inconvenience⁵. The ombudsman does not charge consumers, and the provider must follow its decision if you accept it.

After Brexit: the same rights, amended in the UK

The rights described on this page did not end when the UK left the EU. The Payment Services Regulations 2017 are assimilated law, which means they continue broadly to govern the authorisation of payment service providers and the requirements placed on them, while being open to amendment by UK instruments⁷. The £35 liability cap, the refund duties, the surcharge ban and the authentication requirements all remain in force.

The same is true of the surrounding consumer rules that originally implemented EU directives. The Alternative Dispute Resolution (Competent Authorities and Information) Regulations 2015 implemented the EU's Alternative Dispute Resolution Directive and continue in force after EU exit, subject to amendment by the Consumer Protection (Amendment etc) (EU Exit) Regulations 2018³². The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 implemented most of the provisions of Directive 2011/83/EU and continue in force as a result of the European Union (Withdrawal) Act 2018³².

What has changed is who amends the rules and where the changes come from. New UK instruments, such as the Payment Services (Amendment) Regulations 2024, now adjust the framework directly rather than through EU directives⁷. For a consumer, the practical position is unchanged: the protections are UK law, enforced by UK regulators, and disputes go to the UK ombudsman.