CRM Code stops applying to bank transfer scam transactions

The Contingent Reimbursement Model Code (CRM Code) applied to bank transfer scam transactions made from 28 May 2019 to 6 October 2024, Citizens Advice says¹. From 7 October 2024 new rules apply to banks and payment service providers¹.

The CRM Code was a voluntary code. Santander, which signed up to it, says transactions made between 28 May 2019 and 6 October 2024 were assessed under it, and that transactions from 7 October 2024 onwards are assessed under mandatory reimbursement regulations set by the Payment Systems Regulator².

Under the CRM Code, Santander says it reimbursed customers in certain circumstances. The code applied to individuals' personal accounts, micro-enterprises, charities with an annual income of less than £1 million, and payments made within the UK. It did not cover payments sent overseas².

For transactions from 7 October 2024, Citizens Advice says a bank or payment service provider should usually refund a customer who sent money to a UK account by Faster Payments or CHAPS. It says they do not have to refund if another payment method such as BACS or Swift was used, or if the money was sent abroad¹. Santander says eligible claims are refunded up to a maximum of £85,000, and that a claim must be raised within 13 months of the final payment made to a fraudster as part of the same scam².

The two sources describe the £100 fee differently. Citizens Advice says the bank or payment provider might charge a fee of £100, which it will take off the refund¹. Santander says it applies a £100 excess from the total refund, a fixed amount for each claim, giving the example of a £1,000 claim producing a £900 refund, and says the excess also applies to claims under £100².

Why it matters for households

The date of the transaction decides which set of rules a scam claim falls under. Someone who sent money to a fraudster on or before 6 October 2024 has their claim considered under the CRM Code, and only if their bank or building society was registered under it¹. Someone who sent money on or after 7 October 2024 has their claim considered under the mandatory rules, which cover UK Faster Payments and CHAPS transfers from personal accounts, micro-enterprises and some charities¹.

The refund ceiling, the £100 deduction and the timescales for a decision all attach to the newer rules. Under those rules a bank must refund up to £85,000, with money usually returned within 5 working days but possibly taking up to 35 working days¹. Santander says a claim must be raised within 13 months of the final payment made to a fraudster as part of the same scam².

Both sets of rules allow a bank to refuse a refund in some circumstances. Citizens Advice says a customer might not get a refund if the bank or payment service provider can prove they were not careful enough when making the payment, or did not help or give information asked for while the claim was looked at¹. Santander refers to this as the Consumer Standard of Caution, and lists paying attention to warnings, reporting a scam promptly, providing information and reporting to the police, or allowing the bank to report on the customer's behalf².

What happens next

If a claim is refused and the customer thinks the decision is unfair, Citizens Advice says to follow the bank's official complaints process, and that a case can go to the Financial Ombudsman if it is not sorted out in 8 weeks or a final response letter is received¹. Santander says it will change account terms and conditions soon to reflect the changes². It also says all authorised push payment fraud claims will be reviewed case by case, even if they are not covered by the CRM Code or the Payment Systems Regulator rules².

The CRM Code is the voluntary scheme that applied before October 2024. The rules now in force are covered in authorised push payment reimbursement, and complaining to your bank sets out the route when a claim is refused. More on scams and fraud.