To address the impact of authorised push payment (APP) fraud, the UK is introducing a new reimbursement requirement on payment service providers (PSPs).
APP fraud is a form of fraud in which victims are manipulated into authorising real-time payments to fraudsters. Historically, PSPs did not have a strict legal obligation to reimburse customers who were victims of APP fraud, though a number of larger PSPs signed up to the voluntary contingent reimbursement model — or CRM — code. In fact, payments regulation has been perceived as an obstacle to imposing a regulatory obligation on PSPs to reimburse these customers.
Under the UK’s Payment Services Regulations 2017, a payment order is deemed to have been correctly executed if it was executed in accordance with the unique identifier for the recipient of the payment — i.e. the information that identifies the account of the payee.
However, this is set to change with the introduction of the new APP fraud reimbursement requirement. PSPs will be required to reimburse victims of APP fraud, subject to certain limitations, even where the payment is executed by the PSP in accordance with the instructions it was given.
In the lead up to the implementation of the new requirement, the UK Payment Systems Regulator (PSR) published two new consultations to seek views on the maximum level of reimbursement and claim excess, and the consumer standard of caution.
It is proposed that PSPs will only be required to reimburse customers who are victims of APP fraud up to the maximum level of reimbursement (potentially subject to a claim excess), and if the customer met a standard of care when executing APPs.
Claim excess and reimbursement level
On August 15, 2023, the PSR published a consultation paper on the value of the excess and maximum reimbursement level for payments made using the Faster Payments Service. The consultation also asks questions on the topic of a maximum reimbursement level for a separate payment scheme, the Clearing House Automated Payment System (CHAPS), on behalf of the Bank of England.
The consultation proposes that a claim for APP fraud reimbursement should be subject to an excess. The PSR considers that an appropriate excess level will encourage customer caution at the point of payment, as the customer may not recover the full amount of their funds.
Additionally, the PSR proposes that the sending PSP should have the option to determine how much the excess will be on a claim, up to the maximum claim excess level. If the sending PSP chooses to apply the maximum claim excess, the receiving PSP will only be liable for 50% of an in-scope claim — minus the maximum claim excess. PSPs will not be able to apply an excess on claims from vulnerable customers.
Further, PSPs will only need to reimburse customers who are victims of APP fraud up to the maximum reimbursement level. In determining the maximum reimbursement level, the PSR will consider the level of PSP liability, the ability of the cap to cover the majority of cases, and the appropriate coverage of all fraud types to incentivise PSPs to adopt anti-fraud measures.
Currently, the PSR proposes to match the maximum reimbursement level to the Financial Ombudsman Service limit of £415,000, as it is “a well understood limit and is sufficiently high that most victims, approximately 99.98%, will be unaffected by it, and even those who are will still be reimbursed a significant amount”. The same cap is proposed by the Bank of England for the CHAPS system.
For larger PSPs, alignment with the Financial Ombudsman Service limit will likely make sense, and they should have the financial resources to meet multiple claims up to that limit. However, for smaller PSPs, a large single claim could have significant financial implications. It will necessarily require those smaller PSPs to look at the risk of a claim and may require further capitalisation or access to liquidity facilities to ensure they can meet claims.
Consumer standard of caution
The PSR also published a second consultation paper on the consumer standard of caution, and the consumer standard of caution guidance for PSPs.
PSPs will not be required to reimburse their customers in circumstances where the customer seeking the reimbursement has acted fraudulently, or with gross negligence. In relation to the latter, the PSR proposes that customers should be expected to meet an express standard of care when executing authorised payments.
This standard of care will require customers to have regard to warnings, give prompt notifications, and share relevant information with their PSPs. If a customer, through gross negligence, has not met one or more of these standards, their PSP will not be required to offer reimbursement for an APP executed subsequent to fraud or dishonesty.
More on APP fraud
The burden of proof will rest on the PSP to demonstrate that its customer has not met the standard of care through gross negligence, and vulnerable customers will not be subject to this standard of caution. Only time will tell if PSPs will be able to demonstrate that customers have acted with gross negligence such that a claim will not have to be met.
Both consultations closed on September 12, 2023. We expect the incoming rules to result in a shift in the way PSPs interact with their customers. In particular, PSPs will be incentivised to pre-emptively identify and prevent APP fraud and promote customer awareness of APP fraud patterns.
It is also likely that further friction will be inserted into the payment journey, particularly in the short term, as PSPs come to grips with the new requirements.
Andrew Barber is a partner and Ann Zheng is an associate at law firm Pinsent Masons.
