Independent review of APP reimbursement policy to begin

The Payment Systems Regulator will begin an independent review of the effectiveness of its mandatory reimbursement policy for authorised push payment (APP) fraud in October 2025, according to Which?¹. The review is intended to let the regulator "take stock of where we are after the policy has been in place for a year"¹.

The policy took effect on 7 October 2024, requiring firms to reimburse victims within five business days in all but exceptional cases¹. It applies to any provider using Faster Payments, more than 1,000 firms, and requires both the sending and receiving firms to share the cost of reimbursing victims¹. The amount is capped at £85,000 per claim, split equally between the two firms, and firms can choose to ask customers, excluding those considered vulnerable, to pay a £100 excess¹. Nationwide, TSB and Virgin Money have said they will not apply the excess, while Starling has said it may apply a £50 excess in some cases¹.

The PSR said 86% of money lost to APP scams, totalling around £27m, was returned to victims, with 14% of claims made by consumers with a vulnerability, equating to £7m¹. Reimbursement in 2023 was 68%, though the figures are not directly comparable because of methodology changes¹. The data covers UK payments made over Faster Payments from 7 October 2024 to the end of 2024¹.

The volume of claims, around 46,000, was lower than an equivalent period in 2023, when an average three-month period equated to 56,000 cases, and only 2% of total claims were rejected because the consumer standard of caution was not met¹. Some 84% of claims were closed within five business days, and 86% were reported by the sending firm to the receiving firm within two business hours of the consumer raising the claim¹.

Before the mandatory scheme, the voluntary Contingent Reimbursement Model Code, launched in 2019, was signed by eight banking groups: Barclays, HSBC, Lloyds, Metro Bank, Nationwide, NatWest, Santander and Starling Bank, with the Co-operative Bank and Virgin Money joining later¹. Both the voluntary code and the mandatory scheme apply to UK bank transfers only, not international transfers or other payment systems such as debit or credit payments¹.

Why it matters for households

People who lose money to an APP scam on a UK bank transfer are covered by the mandatory scheme, which requires reimbursement within five business days of reporting the fraud, down from 15 days under the CRM Code¹. Claims must be submitted no more than 13 months after the final payment to the fraudster¹. A claim can be rejected only where a failure of the consumer standard of caution amounts to gross negligence, and the burden of proof falls on firms¹. Consumers who were vulnerable because their personal circumstances made them especially susceptible to harm should not be subject to the consumer standard of caution or the £100 excess¹. The scheme does not cover international transfers or payments by debit or credit card¹.

What happens next

The independent review of the policy's effectiveness begins in October 2025¹. The PSR has said the review will allow it to take stock after the policy has been in place for a year¹.