PSR to give final legal instruments to Pay.UK

The Payment Systems Regulator (PSR) will give the final legal instruments to Pay.UK in October 2023, alongside a further consultation on the legal instrument to be given to payment service providers (PSPs), under the timetable set out for mandatory reimbursement of authorised push payment (APP) fraud¹.

The rules will require all PSPs using Faster Payments to meet minimum standards for reimbursement, applying to over 1,500 PSPs, described as a big step up from the 10 banks and building societies currently signed up to the voluntary CRM Code¹. The PSR will require payment firms to reimburse all in-scope customers who fall victim to APP fraud in most cases, share the cost of reimbursing victims 50:50 between sending and receiving payment firms, and provide additional protections for vulnerable customers¹. Sending PSPs must reimburse customers within five business days, and firms can reject fraud claims submitted more than 13 months after the final payment to the fraudster¹. The PSR has removed plans to introduce a £100 minimum threshold¹.

Firms will not reimburse customers who have acted fraudulently, known as first-party fraud, or with gross negligence, which is described as a high bar with the burden of proof on the PSP; customers deemed vulnerable to a specific type of APP fraud are not subject to the gross negligence test or claim excess¹. The PSR has said it intends to consult further on the allowable claim excess that payment providers can charge victims and the maximum cap on reimbursement¹.

The reimbursement requirement does not currently apply to international payments, payments across other payment systems such as card payments, cryptocurrency transfers and CHAPS transactions, or "on us" payments where the fraudster uses an account provided by the victim's own PSP¹. The PSR said work is underway to consider whether the new reimbursement requirement, or equivalent protections, should apply to other payment systems, and that firms should reimburse APP fraud in the same way as Faster Payments¹.

Why it matters for households

APP fraud is where individuals or businesses are tricked into sending money to an account controlled by a fraudster. Industry figures show victims lost £485.2m to APP fraud in 2022, and in that year only 59% of APP fraud losses were returned to victims, either through direct refunds or recovery by the receiving bank¹. Under the new rules all fraud losses will be reimbursed, other than in exceptional circumstances¹.

The change affects customers of the more than 1,500 PSPs using Faster Payments, rather than the 10 banks and building societies signed up to the voluntary CRM Code¹. The voluntary code requirements are expected to stay in place until the new reimbursement requirement comes into force, though there is nothing to stop PSPs from voluntarily reimbursing victims of APP fraud now¹. The PSR will be able to direct firms to reimburse fraud victims under the Financial Services and Markets Bill, which is expected to receive Royal Assent in 2023¹.

Gaps remain: a Which? survey of over 1,000 fraud victims found that 20% of authorised fraud victims used a cryptocurrency app or website, 19% sent money to a foreign bank account and 17% used a digital wallet such as Apple Pay or Google Pay¹. The Payment Systems Regulator sets the rules for the payment systems covered by the scheme, and the timetable sits within the wider financial regulation framework.

What happens next

The PSR is due to give the final legal instruments to Pay.UK in October 2023, with a further consultation on the legal instrument for PSPs¹. By the end of 2023 it will publish the claim excess and maximum level of reimbursement, additional guidance on the customer standard of caution (gross negligence) and all legal instruments¹. The new reimbursement requirement comes into force in 2024¹. The Government has said it is also looking at how to enable banks to identify and pause suspicious payments in flight where appropriate¹.