PSR to consult on draft legal instruments for reimbursement

The Payment Systems Regulator (PSR) will consult in July on the draft legal instruments that would put mandatory reimbursement requirements for authorised push payment (APP) fraud in place, according to a timetable set out after its consultation¹. The rules would require banks and other firms using the UK Faster Payments system to split the cost of reimbursing victims¹.

Under the plans, all payment service providers (PSPs) using Faster Payments would have to meet minimum standards for reimbursement, applying to over 1,500 PSPs, compared with the 10 banks and building societies signed up to the voluntary Contingent Reimbursement Model (CRM) Code¹. The PSR said the cost of reimbursing victims would be shared 50:50 between sending and receiving payment firms, that firms would reimburse all in-scope customers who fall victim to APP fraud in most cases, and that there would be additional protections for vulnerable customers¹.

Sending PSPs would have to reimburse customers within five business days, and firms could reject fraud claims submitted more than 13 months after the final payment to the fraudster¹. The PSR has removed plans to introduce a £100 minimum threshold¹. Firms would not reimburse customers who have acted fraudulently, known as first-party fraud, or with gross negligence, which the PSR describes as a high bar with the burden of proof on the PSP; customers deemed vulnerable to a specific type of APP fraud are not subject to the gross negligence test or claim excess¹.

The requirement does not currently apply to international payments, to payments across other systems such as card payments, cryptocurrency transfers and CHAPS transactions, or to "on us" payments where the fraudster uses an account provided by the victim's own PSP¹. The PSR said work is underway to consider whether the new requirement, or equivalent protections, should apply to other payment systems, and that firms should reimburse APP fraud in the same way as Faster Payments¹.

Industry figures cited show victims lost £485.2m to APP fraud in 2022, and that only 59% of APP fraud losses were returned to victims that year, either through direct refunds or recovery by the receiving bank¹. A Which? survey of over 1,000 fraud victims found 20% of authorised fraud victims used a cryptocurrency app or website, 19% sent money to a foreign bank account and 17% used a digital wallet such as Apple Pay or Google Pay¹.

Why it matters for households

People who are tricked into sending money to a fraudster by bank transfer are the group affected. At present, reimbursement depends on whether their bank has signed up to the voluntary CRM Code, which covers 10 banks and building societies; the new requirement would extend minimum reimbursement standards to over 1,500 PSPs using Faster Payments¹. The change would mean sending firms reimburse in-scope victims within five business days, with the cost split evenly between the sending and receiving firms¹. Claims made more than 13 months after the final payment to the fraudster could be rejected, and the £100 minimum threshold originally proposed has been dropped¹. The maximum level of reimbursement and any claim excess that providers can charge victims have not yet been set; the PSR intends to consult further on both¹. Losses on international payments, card payments, cryptocurrency transfers, CHAPS transactions and "on us" payments are outside the requirement as it stands¹.

What happens next

In August the PSR will consult on the maximum level of reimbursement and claim excess, and on additional guidance on the customer standard of caution (gross negligence)¹. In October it will give the final legal instruments to Pay.UK and hold a further consultation on the legal instrument to be given to PSPs¹. By the end of 2023 the PSR will publish the claim excess, the maximum level of reimbursement, the additional guidance and all legal instruments¹. The new reimbursement requirement comes into force in 2024¹. The PSR will be able to direct firms to reimburse fraud victims under the Financial Services and Markets Bill, which is expected to receive Royal Assent in 2023¹. The voluntary CRM Code requirements are expected to stay in place until the new requirement comes into force¹.

The Payment Systems Regulator oversees Faster Payments and the reimbursement rules, and the consultations process sets out how new rules are made and how responses are submitted.