APP fraud: UK PSR consults on implementing instruments for mandatory reimbursement requirement

Recap of implementation policy for mandatory reimbursement requirement

Following concerns of the Treasury Sub-Committee on Financial Services Regulations about the role of Pay.UK as an industry body rather than a regulator, the reimbursement requirement for victims of APP fraud within Faster Payments will now be implemented via the following:

1. Specific requirement for Pay.UK to amend Faster Payments rules. As originally proposed, the PSR will require Pay.UK, as the operator of Faster Payments, to add an APP scam reimbursement requirement into the scheme rules.
2. Specific direction to Pay.UK to establish a compliance monitoring regime. This will monitor whether PSPs are following the reimbursement requirement.
3. General direction to all Faster Payments participants. Additionally, the PSR will issue a general direction to all payment service providers (PSPs), requiring them to comply with the scheme rules established by Pay.UK.

Details can be found in the PSR’s June 2023 policy statement (PS23/3). For more on the policy statement, take a look at our Engage article: 'APP fraud: UK PSR confirms introduction of ‘world first’ reimbursement requirement'.

What’s in the consultation paper?

The PSR explains in the consultation paper (CP23/4) (which should be read alongside the June policy statement) that it is seeking views on the overall package of the three legal instruments as set out above. It is also inviting views on the specific detail of items 1 and 2 above. The draft legal instruments are contained in Annexes 1-3 of the consultation paper.

The PSR is planning a further consultation on the general direction to all PSPs in October 2023 so that the consultation will have the benefit of Pay.UK’s draft rules for PSPs’ obligations.

The consultation paper provides an overview of the legal instruments and their intended uses. There is also a summary of the supplementary materials that the PSR will issue, namely:

• Guidance on the consumer standard of caution (gross negligence);

• Publications (eg online notices) covering:

  • maximum level of claim excess;

  • maximum level of reimbursement; and
  • consumer standard of caution.

The PSR expects that its approach to implementation will evolve over time as Pay.UK introduces changes aimed at reaching participants and enforcing requirements.

1. Specific requirement for Pay.UK to amend Faster Payments rules

The PSR will issue a specific requirement under section 55 of the Financial Services (Banking Reform) Act 2013 (FSBRA), to require Pay.UK to amend Faster Payments rules to cover: the reimbursement requirement; claim excess; maximum level of reimbursement; time limit to claim; notifying the receiving PSP; sharing the cost of reimbursement; time limit to reimburse; and repatriation.

On the reimbursement requirement, the draft specific requirement includes the need for the rules to stipulate that ‘PSPs will not be required to reimburse any APP scam payments where the consumer standard of care exception applies, unless the victim was a vulnerable consumer at the time the reimbursable APP scam payments were made’. The June policy statement confirmed this exception to the consumer standard of caution exception (ie the gross negligence exception). However, in the policy statement the PSR clarified that ‘PSPs should evaluate each customer’s circumstances on a case-by-case basis to help determine the extent to which their characteristics of vulnerability, whether temporary or enduring, led them to be defrauded, and therefore whether they meet the definition of vulnerability set out in [the FCA’s existing guidance on the fair treatment of vulnerable customers]’. The PSR described the vulnerable customer exception to the gross negligence exception as ‘not a blanket exception for all customers who exhibit any characteristics of vulnerability’. It is not clear whether the position in the specific requirement on which the Faster Payments rules will be based reflects a departure from the position in the policy statement. However, we note the policy statement stated that the planned further PSR guidance on the gross negligence exception (consultation due in Q3 2023) will reinforce the PSR’s expectation that ‘PSPs must reimburse APP fraud victims in most cases’ which might suggest that in practice there wouldn’t be much debate on the degree of vulnerability point.

Responsibility for reviewing and changing the new rules will fall into three categories:

• Category 1 - Regulatory requirements set by PSR: The PSR will take responsibility for the reimbursement requirement and the scope of the reimbursement requirement for the foreseeable future.  Pay.UK will embed these in the rules and impose them on Faster Payments participants. However, Pay.UK is not expected to propose changes to any rules that fall within Category 1.
• Category 2 - Requirements retained by PSR initially, with potential to become Faster Payments rules in future: Some aspects of the regime will transition to Pay.UK when the PSR deems it has sufficient capability to manage and enforce them. These are the maximum claim excess and the maximum level of reimbursement; the consumer standard of caution; and the consumer standard of caution exception.
• Category 3 - Requirements Pay.UK will be responsible for from day one: Pay.UK will take responsibility for ensuring all remaining rules function effectively from day one,  keeping them under review just as it does with other Faster Payments rules. The PSR will be responsible for: 50:50 cost allocation of reimbursement between sending and receiving PSPs; an option for PSPs to refuse claims submitted after 13 months; the five-business-day deadline for reimbursing customers; and the ‘stop the clock’ provision.

Pay.UK will be required to notify the PSR of any proposed changes to the Category 3 reimbursement rules. Where these could affect the policy outcomes of the reimbursement requirements, the PSR would expect to be closely involved in the assessment of those changes.

The PSR provides more information on how this will work in practice in Chapter 5 of the June policy statement.

2. Specific direction to Pay.UK on compliance monitoring regime

The PSR will issue a specific direction under section 54 of FSBRA to require Pay.UK to create and implement effective monitoring of PSPs in line with the specific requirement and general direction. The PSR acknowledges that Pay.UK is best positioned to assess the most effective and efficient monitoring mechanism (in conjunction with industry). The PSR will work with Pay.UK to agree a high-level approach and principles for how it will monitor compliance.

The specific direction also outlines the high-level areas that the PSR expects Pay.UK to gather and analyse data on, including the number of APP scam claims reported by consumers, the number of APP scam claims rejected by PSPs (and reasons), the time taken to reimburse APP scam victims, and the use of exceptions by PSPs. PSPs will be required  to provide data to Pay.UK via the general direction issued to PSPs (see further below ‘General direction to all Faster Payments participants’).

3. General direction to all Faster Payments participants

The PSR will issue a general direction to participating PSPs under section 54 of FSBRA. The PSR is not seeking comments on the detail of this general direction as it intends to consult on it separately in October 2023. However, as an important part of the PSR’s overall approach to implementation it may impact respondents’ views on the other legal instruments.

This direction will require all in-scope PSPs (including indirect participants) to comply with the relevant Faster Payments rules and report data to Pay.UK. The general direction will cover:

• the reimbursement requirement;
• the scope of the reimbursement requirement;
• an obligation on Faster Payments participants to comply with Faster Payments scheme rules created under the PSR’s section 55 specific requirement;
• an obligation on all Faster Payments participants to report APP scam case data to Pay.UK as the payment system operator for Faster Payments; and
• an obligation on direct Faster Payments participants to inform indirect participants of their obligations under the new reimbursement rules.

The PSR intends to remove the requirement to comply with scheme rules and report data once it is satisfied they are no longer necessary to support Pay.UK’s implementation and oversight of the reimbursement requirement.

CHAPS reimbursement requirement in the pipeline

The Bank of England has also announced its intention that similar reimbursement requirements should apply to the Clearing House Automated Payment System (CHAPS).

The Bank will undertake its own process to draft the relevant scheme rules, which will be as close as possible to those implemented in Faster Payments with some potential differences to account for differences in the characteristics and users of the two systems. In terms of timing, the rules for CHAPS are likely to be drafted over the summer along the same timetable as Pay.UK for Faster Payments.

The PSR will then give a similar direction to direct and indirect CHAPS participants requiring compliance with the relevant rules. It has not yet drafted this direction, but plans to replicate the approach it has taken for the direction for Faster Payment participants as far as possible, and it is seeking initial views on both at this stage. It then intends to consult on the CHAPS direction alongside the one for Faster Payments PSPs in October 2023.

The Bank intends to follow broadly the same timetable as the PSR’s work on the Faster Payments requirements.

Next steps

The consultation closes at 5pm on 25 August 2023.

There will be a separate consultation on the general direction to PSPs in October 2023.

The PSR intends to finalise and publish all three legal instruments in December 2023 to reduce the risk of any changes to the general direction following its October consultation giving rise to incompatibilities with the specific requirement and specific direction.

To ensure the new requirements are in place for consumers as soon as possible, the PSR is proposing an implementation, or ‘go live’, date of 2 April 2024. It recognises that this is ‘likely to be a challenging target for firms’, and welcome views on what is required for operational readiness. However, it makes it clear that it would not expect implementation to be any later than Q2 2024. It plans to confirm the implementation date for the new requirements in the autumn, alongside the consultation on the general direction. To ensure consistency of outcome for consumers, and consistency of implementation by PSPs, the PSR will require compliance with the two directions to start on the same date as the rules.

Authored by Charles Elliott and Virginia Montgomery.