CRM Code wound down as statutory APP fraud reimbursement scheme introduced

The Contingent Reimbursement Model (CRM) Code was wound down once the Payment Systems Regulator introduced a statutory scheme for mandatory APP fraud reimbursement, the Lending Standards Board (LSB) has said in a review of its standards and codes¹. The LSB lists the code as running from 2019 to 2024¹.

The LSB says that by the code's last full year in operation it covered over 90% of APP scams, had significantly improved reimbursement rates for victims, and improved the payments sector's ability to detect and stop APP scam attempts¹. It adds that with the code in place the rate of APP scam growth slowed and then began to fall, while the amount of money lost to these scams declined 20% from its peak¹. Customers covered by the code were, in the LSB's account, less likely to be scammed, likely to lose a smaller amount if they were scammed, and more likely to be reimbursed for their losses¹.

The LSB draws one distinction between the two arrangements: unlike the CRM Code, the statutory scheme did not introduce requirements for prevention and detection¹.

The LSB also sets out the other codes it ran. The Standards of Lending Practice for Personal Customers ran from 2016 to 2025, replaced the Lending Code, and set best practice for overdraft, credit card, charge card and unsecured loan products provided to consumers¹. The Standards of Lending Practice for Business Customers ran from 2017 to 2025 and provided protections to SMEs with a consolidated turnover of up to £25m across loan, commercial mortgage, overdraft and credit card products; the LSB notes that lending to limited companies and business lending above £25,000 sits outside the FCA's regulatory perimeter¹. The Access to Banking Standard ran from 2017 to 2021, and provisions from it formed parts of the new FCA requirements on branch closures¹. The Lending Code ran from 2009 to 2016 as the successor to the Banking Code and Business Banking Code¹.

The LSB says it also developed an Access to Financial Services for Ethnic Minority-led Businesses Code, and that the code's development and launch was paused with the wind-down of the LSB¹. The LSB describes the business Standards as one of just four industry codes formally recognised by the Financial Conduct Authority¹.

Why it matters for households

The change matters to anyone who loses money to an authorised push payment scam, where they are tricked into sending a payment themselves. Under the voluntary CRM Code, signatory firms assessed claims against the code's own standards; from the point the statutory scheme took over, reimbursement is a regulatory requirement set by the Payment Systems Regulator rather than a code commitment. The LSB's account records that the statutory scheme did not carry over requirements on prevention and detection, so the obligations on firms under the two arrangements were not identical¹. The LSB does not give a date in this material for when the statutory scheme began, and the review does not set out the reimbursement rules, time limits or the maximum refund that apply under it; those details are not reported here. The distinction between authorised and unauthorised payments continues to determine which refund rules apply.

What happens next

The LSB states that the CRM Code ran to 2024 and that the Access to Financial Services for Ethnic Minority-led Businesses Code was paused with the wind-down of the LSB¹. No further dates for either are given in the material.