Five areas for firms to be focusing on now

Some suggested areas of priority focus for in-scope PSPs in the coming weeks are:

Terms and conditions

• In its July 2024 policy statement on compliance and monitoring under the Faster Payments APP fraud mandatory reimbursement requirement, the PSR introduced some leeway on timing for PSPs to comply with the requirement to amend their T&Cs to inform customers of their rights under the policy. T&Cs should be changed as soon as is practical and by no later than 9 April 2025 to include a provision that a PSP will reimburse their consumers in line with the reimbursement requirement and rules.

• PSPs should already have notified existing customers of their rights under the reimbursement requirement and rules, and of the upcoming contractual changes, as the deadline for this was the policy go-live date of 7 October 2024. PSPs also had until 7 October to put arrangements in place to inform new customers of their rights, at the latest by the time those new customers are serviced. However, given the last-minute confirmation of the change to the maximum reimbursement level, the PSR has said that it will adopt a ‘pragmatic and proportionate approach’ to directed PSPs’ compliance with their customer notification obligations. It expects firms to ‘take reasonable steps to become compliant as soon as practicable’, the nature of which will vary on a case-by-case basis. The PSR will consider - as with any potential non-compliance - a range of factors and circumstances when deciding on whether to intervene. It nonetheless emphasises the importance of consumers who are submitting a claim being given appropriate information and support through the process.

FOS complaints

• The PSR expects the change in the maximum reimbursement level from £415,000 to £85,000 to impact the volume and complexity of cases the FOS anticipates receiving. On this, firms should note that a new PSR webpage aimed at consumers actually points out that where more than £85,000 is lost and not reimbursed, consumers can lodge a claim with the FOS - and that the FOS’ compensation limit is £430,000.

• In the October 2024 policy statement the PSR also points out that, while awards will turn on the specifics of a consumer’s complaint, it is ‘theoretically possible’ for there to be an award up to £85,000 against the sending PSP for any failure to reimburse under the Faster Payments reimbursement requirement and for the FOS to make an award (up to the statutory limit of £430,000) for any unrecovered losses if it considers that the sending firm was at fault in some way when making the payments, meaning that it would be fair and reasonable for the sending firm to compensate the consumer for their unrecovered losses. It goes on to mention that the FOS can also make an award against the receiving PSP (if it would be fair and reasonable), meaning consumers could in theory recover loss up to £945,000.

• In what is likely to be small comfort to in-scope firms, the PSR plans to continue to engage closely with the FOS and will consider the volume of cases referred to the FOS, and the impact, as part of its 12-month evaluation of the policy. In the meantime, firms will need to factor in the additional liability risk when developing their internal policies on the approach to handling APP scam claims under the new regime.

Scam warnings

• In its Dear CEO letters to banks and building societies and payment and e-money institutions (PIs and EMIs) (dated 7 October 2024) on its expectations in relation to APP fraud reimbursement, the FCA cites inadequate processes to design, test, tailor and monitor the effectiveness of scam warning messages presented to customers as an example of foreseeable harm under the Consumer Duty.

• It’s also worth bearing in mind that the PSR's Consumer standard of caution exception guidance (December 2023) makes it clear that any intervention* for the purpose of the exception should be:

  • bespoke;

  • consumer, scam, and transaction specific; and

  • actively brought to the attention of the consumer.

*The wording was changed by the PSR from 'warnings' to the wider 'interventions' to clarify that in addition to making consumers aware of the risk of proceeding with a payment, PSPs could pause and potentially reject a payment instruction where appropriate (see the December 2023 PSR policy statement).

‘On us’ fraud and Consumer Duty

• The two FCA Dear CEO letters also include an expectation that PSPs will ensure their approach to ‘on us’ APP fraud meets their Consumer Duty obligations to deliver good consumer outcomes. Therefore it asks that if PSPs are planning to provide a lower level of protection to ‘on us’ APP fraud reimbursement compared to payments made through Faster Payments and CHAPS, they contact the FCA to provide an explanation of the steps taken to meet those obligations.

• This suggests that – if they have not already done so for operational ease - PSPs will need to consider aligning their approach to ‘on us’ APP fraud with that for fraud committed via Faster Payments and CHAPS – unless they are able to provide strong, Consumer Duty compliant justification for any difference.

Prudential impact for PIs and EMIs

• The FCA’s Dear CEO letter to PIs and EMIs sets out an expectation that they will review and adjust their business models and transactions to mitigate against any risk of prudential impact that may result from potential APP fraud reimbursement liabilities.

Key APP fraud publications: Quick reference guide

June 2023 PSR policy statement on APP reimbursement requirement for Faster Payments

In June 2023, the PSR published a policy statement confirming its new reimbursement requirement to fight APP fraud. The new reimbursement requirement is built on ten key policies, as set out in the long-form briefing note linked to our Engage article ‘APP fraud: UK PSR confirms introduction of ‘world first’ reimbursement requirement’.

December 2023 PSR policy statement

In December 2023, the PSR published a policy statement containing its final position on the APP fraud reimbursement requirement. The policy statement also confirmed the policy start date of 7 October 2024. For more, see our Engage article ‘APP fraud mandatory reimbursement: UK PSR publishes final policy for 7 October 2024 go live date’.

PSR Specific Directions 19 and 20 and Specific Requirement 1

Also in December 2023, the PSR published the three legal instruments that give effect to the new mandatory reimbursement policy, which were subsequently amended in July 2024 to incorporate certain changes (see below ‘July 2024 PSR policy statement on compliance and monitoring under Faster Payments reimbursement requirement’) – the following links are to the July 2024 versions:

• Specific Requirement 1 - imposed on Pay.UK and requiring it to create the reimbursement rules through amending the Faster Payment rules;

• Specific Direction 19 - addressed to Pay.UK and relating to compliance monitoring and data;

• Specific Direction 20 - addressed to all in-scope PSPs and setting out the reimbursement requirement, its scope, the obligation on all directed PSPs to comply with the reimbursement rules, and a requirement on indirect access providers (IAPs) to provide information about their indirect PSP customers.

For more, see our Engage articles ‘APP fraud mandatory reimbursement: UK PSR publishes final policy for 7 October 2024 go live date’ and ‘APP fraud: UK PSR compliance / monitoring requirements and consumer comms guidance for October 2024’.

PSR Consumer standard of caution exception: Notice and Guidance

A final Consumer standard of caution exception notice and associated Consumer standard of caution exception guidance were published alongside the December 2023 PSR policy statement (and legal instruments) which confirmed that the consumer standard of caution exception consists of:

• The requirement to have regard to interventions: ie tailored, specific interventions made either by the consumer's sending PSP, or by a competent national authority, where they communicate clearly their assessment of the probability that an intended payment is an APP scam payment.

• The prompt reporting requirement: that consumers must promptly report to their PSP once they learn or suspect that they have fallen for an APP scam (and not more than 13 months after the last relevant payment was authorised).

• The information sharing requirement: that consumers should respond to any reasonable and proportionate requests made by their PSP in assessing a reimbursement claim, including under the 'stop the clock' rules.

• The police reporting requirement: that consumers should, after making a reimbursement claim, and on request by their PSP, consent to the PSP reporting to the police on the consumer’s behalf or request the consumer report directly the details of an APP scam to a competent national authority.

For more, see our Engage article ‘APP fraud mandatory reimbursement: UK PSR publishes final policy for 7 October 2024 go live date’.

Pay.UK Faster Payments reimbursement rules and compliance monitoring regime

In September 2024, Pay.UK published its final Faster Payments reimbursement rules as required under Specific Requirement 1. Also in September 2024, it published its final Faster Payments reimbursement rules: compliance monitoring regime as required under Specific Direction 19.

July 2024 PSR policy statement on compliance and monitoring under Faster Payments reimbursement requirement

In July 2024, the PSR published a policy statement on compliance and monitoring under the Faster Payments APP fraud mandatory reimbursement requirement in which it rowed back on some of the requirements that it had previously wanted in place by the policy start date of 7 October, and introduced some flexibility in other areas. For example, changes to T&Cs to inform customers of their rights under the policy must be made by no later than 9 April 2025.

The PSR also published the final Compliance Data Reporting Standard (CDRS) and flagged that, in light of consultation feedback, it was not confirming two further requirements on which it had consulted:

• its proposal to require all in-scope PSPs to comply with Pay.UK’s Faster Payments rule to use the reimbursement claim management system (RCMS); and

• whether and when reporting standard B (part of the CDRS) may come into effect, although it did confirm the data contained within reporting standard B in the CDRS (​so that it’s clear to in-scope PSPs what standard B will contain, should it be brought into effect).

Instead, the PSR intends to consult on these in late 2024. Following consultation, should the PSR require use of the RCMS, it may be possible to bring this requirement into effect by 1 May 2025 (the date by which all direct PSPs are required to comply with Pay.UK’s Faster Payments rule requiring use of the RCMS).​ The PSR will keep timings under review and remains open to considering all available options through this future consultation.​

For more, see our Engage article ‘APP fraud: UK PSR compliance / monitoring requirements and consumer comms guidance for October 2024’.

Information on consumer communications for PSPs

In August 2024, the PSR published Information on consumer communications for PSPs. In July, it had published an amended Specific Direction 20 (SD20) (see above) in which it included the requirement for sending PSPs to inform existing consumers of their rights under the Faster Payments reimbursement requirement and reimbursement rules. The purpose of the August document is to facilitate compliance with SD20. The PSR is not prescribing how firms should communicate to their consumers, but states that they should continue to have regard to FCA Consumer Duty requirements and any other relevant regulatory obligations.

For more, see our Engage article ‘APP fraud: UK PSR compliance / monitoring requirements and consumer comms guidance for October 2024’.

September 2024 PSR policy statement and Specific Direction 21 on CHAPS APP fraud reimbursement requirement

In September 2024, the PSR published a policy statement and final Specific Direction 21 on the CHAPS APP fraud reimbursement requirement. The Specific Direction requires in-scope PSPs to comply with the Bank of England’s new CHAPS reimbursement rules (see below) which are intended to align – as far as possible - with the equivalent regime that the PSR has introduced for Faster Payments.

For more, see our Engage article ‘APP fraud: UK PSR final policy on CHAPS mandatory reimbursement requirement’.

CHAPS reimbursement rules

In October 2024, the Bank of England, as the operator of CHAPS, published its final rules as part of the CHAPS reimbursement requirement that has been put in place by the PSR: CHAPS reimbursement rules. The Bank explains on its CHAPS webpage that the reimbursement rules form an annex to the CHAPS Reference Manual but have been published as a separate document given the wider applicability. It has also published:

• a list of indirect participants who should consider whether they are in-scope;
• explanatory notes to the reimbursement rules, which include details of the reporting process for in-scope CHAPS participants; and
• a copy of the reporting form to be used.

PSR final guidance on distinguishing between APP scam claims and civil disputes

In September 2024, the PSR issued its final guidance to support PSPs in assessing whether an APP scam claim raised by a consumer is not reimbursable under the new Faster Payments or CHAPS reimbursement rules because it is a private civil dispute.

For more, see our Engage article ‘APP fraud: UK PSR final guidance on distinguishing between APP scam claims and civil disputes’.

October 2024 PSR policy statement on reduction in maximum reimbursement level under Faster Payments and CHAPS mandatory reimbursement regimes

In September 2024, the PSR and the Bank of England confirmed the decision to reduce the maximum level of reimbursement for both the Faster Payments and CHAPS APP fraud mandatory reimbursement requirements from £415,000 to £85,000 per scam claim. On 2 October, the PSR published a policy statement explaining the decision in more detail.

For more, see our Engage article ‘APP fraud: Final draft payments delay SI and UK PSR policy statement on maximum reimbursement level’.

Payment Services (Amendment) Regulations 2024

The Payment Services (Amendment) Regulations 2024 were made on 8 October, published and laid before Parliament on 9 October and come into force on 30 October 2024. An explanatory memorandum to the Regulations has also been published. Under the new Regulations, PSPs will be able to delay the execution of an outbound sterling payment within the UK by up to four business days from the time a payment order is received if they have reasonable grounds to suspect fraud or dishonesty by someone other than the customer.

For more, see our Engage articles ‘APP fraud: Final draft payments delay SI and UK PSR policy statement on maximum reimbursement level’ and ‘APP fraud: UK government publishes draft legislation allowing PSPs to delay payments for fraud concerns’.

FCA Approach Document changes to support new payments delay legislation

In September 2024, the FCA launched a consultation on amendments to its Payment Services and Electronic Money Approach Document to provide guidance for PSPs on how to apply the new Payment Services (Amendment) Regulations 2024 (see previous item). Following industry uncertainty about PSPs’ ability to delay inbound payments where they suspect fraud, the FCA has also proposed updates to its existing guidance on when and how PSPs should consider delaying inbound payments. The consultation closed on 4 October 2024. According to the explanatory memorandum to the Regulations, the Government expects that the final guidance will be published shortly after the Regulations come into force on 30 October 2024 (the FCA had previously said the revised Approach Document would be published by the end of the year).

For more, see our Engage article ‘APP fraud: FCA consults on Approach Document changes to support proposed payments delay legislation’.

Other useful resources

The PSR has created an APP scams publication webpage that collates links to key related publications. This includes:

• a policy clarifications webpage with the PSR’s responses to firms’ questions (to be updated on an ongoing basis); and

• a section linking to key documents on the PSR’s policy on the collection and publication of APP scams performance data.

Next steps

The October 2024 FCA Dear CEO letters state that the FCA and the PSR will work together to monitor firms’ compliance with the PSR’s reimbursement regime. They will use data arising from the reimbursement regime to monitor for conduct breaches and inadequate systems and controls and ensure the new regime is effectively protecting consumers against APP fraud without adverse impacts on the broader payments system.

In relation to monitoring PSPs’ implementation of the payments delay legislation, the regulators are also planning to gather data from PSPs on payment execution timings to assess the level of additional friction in the system, and values and volumes of delayed payments.

Note also that, as mentioned above, the PSR plans to consult in late 2024 on its proposal to require all in-scope PSPs to comply with Pay.UK’s Faster Payments rule to use the RCMS and on whether and when reporting standard B (part of the CDRS) may come into effect.

If you would like to discuss any aspect of the new APP fraud reimbursement requirements for Faster Payments and CHAPS, please get in touch with any of the people listed above or your usual Hogan Lovells contact.

Authored by Virginia Montgomery.