PSR update: APP fraud reimbursement requirement

On 12 July 2024 the Payment Services Regulator (PSR) published new documents relating to its work in tacking Authorised Push Payment (APP)scams, including:

• Its Compliance and Monitoring policy statement and amended legal instruments.
• A Faster Payments APP Scams Compliance Data Reporting (CDRS) document.
• Its APP scams measure 1 cycle 2 data publication consultation response and policy statement.

The publication of these documents comes just a few months before the introduction of the new reimbursement requirement for APP fraud, which is due to come into force on 7 October of this year. The new requirement will introduce consistent minimum standards to reimburse victims of APP fraud within the Faster Payments System (FPS), providing significantly wider coverage in comparison to the Contingent Model Reimbursement Code. 

Compliance and Monitoring Policy Statement and Amended Legal Instruments

In the Compliance and Monitoring policy statement the PSR confirms that, upon the introduction of the new reimbursement requirement, PSPs will be afforded flexibility in how they communicate in respect of FPS APP scam claims, as well as in respect of how they manage these claims. However, this is not a full departure from the proposal to adopt a single system approach (ie. the Reimbursement Claim Management System (RCMS), as the PSR still intends to consult on the use of the RCMS later in the year (and once it has had sufficient opportunity to undertake a full assessment of the costs, benefits and impact of using the RCMS).

The PSR also confirms:

1. The requirement for all in-scope payment services providers (PSPs) to register with Pay.UK by 20 August 2024 (with the registration window now being open).
2. The data under reporting standard A that in-scope sending PSPs will be required to report on.
3. The limits being placed on Pay.UK in respect of the use and disclosure of compliance data it receives.
4. The PSRs approach to requiring PSPs to inform consumers of their rights in the light of the introduction of the new requirement.

Data Reporting

The date by which in-scope PSPs must submit the first report to Pay.UK has been amended to 6 January 2025, and the report must cover the period 7 October to 30 November 2024 (with subsequent reports to be submitted monthly). The content of that report must also reflect the information specified under reporting standard A, as detailed in the CDRS (see below for further details) and be retained by PSPs for a period of at least 5 years.

Pay.UK Usage Limits

The PSR confirms that data received by Pay.UK must only be used by it to fulfil its functions under specific direction 19 (which imposes certain obligations on Pay.UK in respect of the new reimbursement requirement rules), the final version of which has been published alongside the policy statement.

The PSR has also confirmed amendments to onwards sharing limitations as follows:

• Where a PSPs confidential data is proposed for disclosure, where possible and practicable a PSP should first be given the opportunity to provide this information to the relevant party themselves.
• Pay.UK may set a timeframe within which the person to whom the confidential information relates must disclose (or not) the information (and that the timeframe must be reasonable, having regard to the specific circumstances).
• Where Pay.UK does disclose any confidential information, they must notify the PSP(s) that they have done so.

The limits on Pay.UK in respect of the disclosure of confidential information do not prevent it from disclosing the information that PSPs provide as part of the registration process.

Policy Clarifications

The PSR has confirmed its proposed amendments to specific direction 20 (which directs in-scope PSPs to comply with the new reimbursement rules) to:

• Require sending PSPs to amend their contractual terms and conditions by 9 April 2025 to include a provision that a PSP would reimburse their consumers in line with the reimbursement requirement and rules.
• Require PSPs to notify consumers of their rights under the reimbursement requirement, and of upcoming contractual changes by 7 October 2024.
• Clarify that the reimbursement requirement applies to all reimbursable FPS APP scam payments executed on or after the 7 October 2024.

It has also confirmed amendments to specific requirement 1 (which requires Pay.UK to create the reimbursement rules) to make clear:

• That reimbursement in accordance with the new requirement is part of the provision of the service of executing in-scope payments over the FPS to consumers by PSPs.
• That Pay.UK is only required to notify the PSR of changes to the new rules, the FPS RCMS rule, or any rule included in the FPS rules as a result of part 6 of SR1 (which clarifies the status of the reimbursement requirement and rules).
• How the maximum claim excess amount is to be shared in any FPS APP scam claim featuring multiple receiving-PSPs.
• When an FPS APP scam claim may be closed.

Importantly, the PSR is not proceeding with the creation of an actionable right for consumers to enforce their rights under the new requirement in the civil courts.

Sharing the Claim Excess

Where there are multiple receiving PSPs within a single FPS APP scam claim (e.g. where multiple FPS APP scam payments made to different PSPs are added to the same scam claim but the consumer), those receiving PSPs may share between them the value of 50% of the maximum claim excess amount (subject to the below). This is to ensure that each PSP does not individually deduct the full 50% of the maximum claim excess amount from their specified amount.

The share that each receiving PSP may choose to deduct from their specified amount shall be in proportion to their overall liability for the reimbursable portion of the APP scam claim in question.

Closing an APP Scam Claim

A sending PSP may only close an FPS APP scam claim having undertaken an assessment as to whether it includes any reimbursable FPS APP scam payments (even where it has issued advance reimbursement to a consumer). This to allow for a fair distribution of reimbursement liability between sending and receiving PSPs; and to provide the basis for reliable, consistent, and comparable datasets on the performance of PSPs.

CDRS

The CDRS sets out the data and information that PSPs are required to collate and retain pursuant to the two different reporting standards, namely reporting standard A (which is to apply until 30 April 2025) and reporting standard B.

APP Scams Measure 1 Cycle 2 Data Publication Consultation Response and Policy Statement

The PSR has also issued its latest publication guidance for PSPs and the response and policy statement following its earlier consultation. These documents confirm that PSPs must publish, within 28 days of publication by the PSR, four sets of data on their personal banking homepages, including the:

1. Percentage of APP scams losses that directed PSPs have reimbursed (by value).
2. Value of APP scams sent by directed PSPs per million pounds of transactions.
3. Value of APP scams received by directed PSPs per million pounds of transactions.
4. Value of APP scams received by non-directed PSPs per million pounds of transactions.

Next Steps

It is important that all in-scope PSPs familiarise themselves fully with the Faster Payment Scheme Reimbursement Rules and Compliance Monitoring Regime in advance of the new reimbursement requirement coming into force on 7 October 2024, and take any necessary actions before that time (including notifying consumers of their rights under the reimbursement requirement, and of upcoming contractual changes). All directed PSPs must also ensure that they are registered with Pay.UK for the purposes of reporting data and compliance monitoring and management from 20 August 2024.

Further, whilst the publication of these additional documents by the PSR does provide more clarity around the intended operation of the new requirement and the obligations on in-scope PSPs, they should remain alive and sensitive to further rule changes (noting that Pay.UK still has until 31 July 2024 to make and implement any necessary rule changes), as well as the proposed extension of the reimbursement requirement to payments made within the CHAPS payment system (in relation to which a further specific direction is expected to be published in September 2024).

If you would like to discuss the issues discussed in this article, or the consequences of the introduction of the new reimbursement requirement, in more detail please contact a member of our Fraud team.