PSR removes separate minimum threshold for APP fraud claims

The Payment Systems Regulator (PSR) has removed the separate minimum threshold for authorised push payment (APP) fraud claims from its new reimbursement requirement, and will consult on the appropriate level for a claim excess instead¹. The change is set out in the regulator's policy statement PS23/3, published in June 2023, which confirms a new reimbursement requirement for APP fraud within the Faster Payments system¹.

The PSR said the new requirement will apply to Faster Payments authorised after the regulatory requirement comes into force in 2024¹. It will cover all payment service providers (PSPs) in scope, which the regulator said includes high street banks and building societies as well as smaller payment firms, reaching over 1,500 PSPs¹. Sending PSPs must reimburse all customers who fall victim to APP fraud, subject to the exceptions and limits in the policy¹. There are two exceptions: where the customer has acted fraudulently, known as first-party fraud, and where the customer has acted with gross negligence¹.

Under the policy, sending PSPs must reimburse customers within five business days, with a "stop the clock" provision that allows them to gather additional information from victims to assess the claim¹. The PSR said there is no limit to how many times a PSP can use that provision¹. Sending PSPs have the option to deny claims submitted more than 13 months after the final payment to the fraudster¹. The PSR said there is no separate minimum value threshold for APP fraud claims, and that there is a maximum level of reimbursement by value, on which it will consult and publish guidance in Q4 2023¹.

The regulator also said it will develop additional guidance on the customer standard of caution, or gross negligence, to be published in Q4 2023¹. It said the customer standard of caution and any claim excess must not be applied to vulnerable customers¹. Failure to notify the police cannot be considered a reason for denying a reimbursement claim¹.

The PSR reported that in 2022 there were around 207,000 reported APP fraud cases on personal accounts, an increase of 6% on 2021, with losses totalling £485.2 million¹. It said 66% of APP fraud losses within scope of the Contingent Reimbursement Model (CRM) Code were reimbursed to the victim in 2022¹. The CRM Code was launched in 2019 as good industry practice to prevent APP fraud and respond to its growth¹.

Why it matters for households

The change affects how APP fraud claims will be handled once the requirement takes effect in 2024. Removing a separate minimum threshold means the point at which a claim can be made will not be set by a separate floor, and the PSR will instead consult on a claim excess, a fixed amount a victim may have to bear before reimbursement¹. The level of that excess has not been reported.

The policy sets a five business day deadline for sending PSPs to reimburse customers, extended from the 48 hours proposed in the September 2022 consultation, with a "stop the clock" provision that can be used without limit¹. Claims can be denied if submitted more than 13 months after the final payment to the fraudster¹. The maximum level of reimbursement by value is still to be consulted on, with guidance due in Q4 2023¹.

The PSR said the new requirement provides a consistent set of minimum standards reaching over 1,500 PSPs, which it said gives significantly wider coverage within Faster Payments than the CRM Code¹. The regulator also noted that the FCA's Consumer Duty comes into force on 31 July 2023 for new and existing products or services open for sale or renewal¹.

What happens next

The PSR said it will consult on a specific start date alongside draft legal instruments in early Q3 2023¹. It will consult on the appropriate maximum value for APP fraud claims and publish this in PSR guidance in Q4 2023, and will publish additional guidance on the customer standard of caution in Q4 2023¹. The regulator said PSPs should act now to prepare for the new reimbursement requirement to come into force in 2024¹. It has also set a deadline to complete migration to the new, competitively procured infrastructure by 1 July 2026¹.