Financial Services and Markets Act 2023 inserts fraud liability provisions into Regulation 90

New sub-regulations 90(6) and 90(7) were inserted into regulation 90 of the Payment Services Regulations 2017 on 29 August 2023 by the Financial Services and Markets Act 2023, according to the textual amendment note on the legislation¹. Regulation 90 is headed "Incorrect unique identifiers"¹.

The inserted text states that nothing in the regulation affects a payment service provider's liability under a "relevant requirement" where the payment order is executed subsequent to fraud or dishonesty, and that the requirements imposed by the regulation are subject to any such relevant requirements¹. A "relevant requirement" is defined in regulation 90(7) as a requirement imposed by or under a direction given under regulation 125, a direction given under section 54 of the Financial Services (Banking Reform) Act 2013, a rule made under section 55 of that Act, an order made under section 56(3) of that Act, or a variation of an agreement under section 57(2) of that Act¹.

The rest of regulation 90, which predates the amendment, sets out how incorrect unique identifiers are treated. Where a payment order is executed in accordance with the unique identifier, it is deemed correctly executed by each provider involved with respect to the payee specified by that identifier¹. Where the unique identifier provided by the payment service user is incorrect, the provider is not liable under regulation 91 or 92 for non-execution or defective execution, but must make reasonable efforts to recover the funds and may, if agreed in the framework contract, charge the user for that recovery¹.

The payee's provider must co-operate with the payer's provider in recovery efforts, in particular by providing all relevant information for the collection of funds, and if the payer's provider cannot recover the funds it must, on receipt of a written request, give the payer all available relevant information so the payer can claim repayment¹. Where the user provides information additional to that specified in regulation 43(2)(a) or paragraph 2(b) of Schedule 4, the provider is liable only for execution in accordance with the unique identifier the user supplied¹.

The page records that section 90 is up to date with all changes known to be in force on or before 28 September 2026, and that there are changes that may be brought into force at a future date¹. It also lists a regulations power to amend conferred by section 23 of the 2021 Act¹. No commencement date beyond 29 August 2023, and no guidance on how the provisions will be applied in individual cases, has been reported in the material available.

Why it matters for households

Regulation 90 governs what happens when someone pays money using a sort code, account number or other identifier that turns out to be wrong, for example after being given false payment details. The pre-existing rules limit a provider's liability for non-execution or defective execution where the user supplied an incorrect identifier, while requiring recovery efforts and information to be passed on¹.

The 2023 addition means that, where a payment order is executed after fraud or dishonesty, the regulation does not override a provider's liability under the listed requirements, and the regulation's own requirements are subject to those¹. The listed requirements arise from directions, rules, orders and agreement variations under regulation 125 and the Financial Services (Banking Reform) Act 2013¹. The change took effect on 29 August 2023¹.

What happens next

The legislation page notes that changes may be brought into force at a future date and that a power to amend the regulations is conferred by section 23 of the 2021 Act¹. No further steps have been reported.