PSR to consult on Draft Direction for Payment Service Providers

The Payment Systems Regulator (PSR) has set out that it will consult on a Draft Direction for Payment Service Providers in October 2023, as part of its work on a new reimbursement requirement for authorised push payment (APP) fraud within the Faster Payments system¹. The policy statement, PS23/3, confirms the regulator's decision to require all payment service providers (PSPs) to make reimbursements available to all in-scope customers who become victims of APP scams¹.

APP fraud happens when a fraudster tricks someone into sending a payment to an account outside of their control, and the PSR says it has quickly become one of the most significant types of payment fraud globally¹. The regulator is increasing protections within Faster Payments because the majority of APP fraud is currently enacted with a Faster Payment¹. The new reimbursement requirement will apply to all PSPs within the scope of the policy, which the PSR says includes high-street banks and building societies but also smaller payment firms¹.

Under the policy, payment firms will be required to reimburse all in-scope customers who fall victim to APP fraud in most cases, and the cost of reimbursing victims will be shared 50:50 between sending and receiving payment firms¹. The PSR also says it will provide additional protections for vulnerable customers¹. The policy statement confirms the regulator will implement the requirement by issuing directions under Sections 54 and 55 of the Financial Services (Banking Reform) Act 2013¹.

The PSR says it will consult on a specific start date alongside its draft legal instruments¹. It also sets out that it will no longer require a minimum threshold for claims to be valid, and that it will introduce a maximum level of reimbursement for APP fraud claims by value, on which it intends to consult¹. The regulator intends to permit sending PSPs to charge a claim excess, and intends to consult on what level that excess should be set at¹. Other areas covered include the time limits within which in-scope customers must make a claim, the time limit for PSPs to reimburse eligible cases, the exceptions for when reimbursement does not have to be issued, special protections for customers deemed vulnerable, and the proposed approach to multi-step fraud cases¹.

The PSR's published timetable for consultation lists the following steps¹:

The policy statement also covers which customers are considered within scope of the requirement and how the cost of reimbursement will be shared between sending and receiving PSPs in each case¹. The PSR has published a cost benefit analysis and the responses to its consultation, along with its views on those responses¹.

Why it matters for households

The requirement is aimed at people who use authorised push payments to send money and who fall within scope of the policy once it is implemented¹. For those customers, the change means that in most cases a payment firm would have to reimburse them if they are tricked into sending a payment to a fraudster, rather than the loss falling on the customer as it largely has done. The cost of that reimbursement would be split equally between the firm that sent the payment and the firm that received it¹.

Two features of the design affect how much a victim might receive. The PSR says it will no longer require a minimum threshold for claims to be valid, so small losses would not be excluded on size grounds, but it also says it will introduce a maximum level of reimbursement by value, with the level still to be consulted on¹. Sending firms would also be permitted to charge a claim excess, again with the level still to be set through consultation¹. The PSR says it will provide additional protections for customers deemed vulnerable¹.

The requirement applies to all PSPs in scope, which the PSR says includes high-street banks and building societies as well as smaller payment firms¹. It comes into force in 2024, with the specific start date to be consulted on¹.

What happens next

The PSR says it will engage in a series of workshops with interested parties in June and July to gather preliminary views and aid understanding¹. It then plans to consult on the allowable claim excess (August 2023), the maximum cap on reimbursement (August 2023), guidance on how to interpret the customer standard of caution of 'gross negligence' (August 2023), a timeline for the requirement to come fully into effect, Draft Directions for Pay.UK (July 2023), and the Draft Direction for Payment Service Providers (October 2023)¹. The PSR says it expects industry to start work now to implement the new reimbursement requirement¹.

The Payment Systems Regulator sits within the wider regulation and policy landscape covering payments, fraud refunds and card fees.