This article will focus on the recent updates relating to Authorised Push Payment (APP) fraud. This follows a chain of previous articles on APP Fraud (https://www.herrington-carmichael.com/app-fraud-common-law-roadblock-but-regulatory-redemption/ and https://www.herrington-carmichael.com/app-fraud-on-the-rise/).
The Payment Systems Regulator (PSR) is introducing a mandatory reimbursement framework for directed payment service providers (PSPs) to which the Faster Payments Scheme (FPS) APP scam reimbursement requirement applies, to reimburse victims of APP fraud under certain circumstances under a specific direction. The purpose is to incentivise the payments industry to invest in fraud prevention, increase consumer protection and tackle fraud by improving the Faster Payments Scheme (FPS) rules. The changes are set out in three published legal instruments within SR1, SD19 and SD20. The PSR has also published an updated policy statement (PS24/3) on compliance and monitoring and provided guidance on how PSPs should communicate with customers.
In summary, the new regime requires in-scope PSPs to reimburse consumers within 5 working days of a report of that consumer having fallen victim to APP fraud subject to any “stop the clock” provisions applying and provided the consumer is not party to the fraud or dishonesty. The reimbursement obligation was originally set as a maximum compensation payable of £415,000, however the PSR confirmed on 25 September 2024 that the compensation cap had after consultation been reduced to £85,000, which is aligned with the current Financial Services Compensation Scheme limit.
Firms are able to apply a maximum excess of £100 to a claim except where a consumer is vulnerable, in which case no excess may be applied.
The PSR has confirmed that these protections will be implemented from 7 October 2024.
Key dates to note:
20 August 2024:
- Directed PSPs were required to register with Pay.UK by 20 August 2024 to onboard onto Pay.UK’s reimbursement claim management system (RCMS).
7 October 2024:
- Implementation date for APP scam protections.
- Data and information requirements are being introduced in a phased manner from this deadline. The directed PSPs are required to initially collate and retain data in respect of the core compliance metrics in the Compliance Data Reporting Standard (CDRS) under reporting standard A, which will allow Pay.UK to begin monitoring compliance from 7 October 2024.
- Irrespective of which reporting standard is in place, all Directed PSPs are required to comply with their record-keeping requirements to ensure this in line with the FPS APP scams reimbursement requirement.
6 January and 31 January 2025:
- In-scope PSPS must submit the first report and then second reports under standard A to Pay.UK by this deadline.
1 May 2025:
- In scope PSPs will be required to report all data specified in the CDRS via Pay.UK’s RCMS (‘reporting standard B’), although PSPs may voluntarily make reporting standard B data available to Pay.UK before 1 May 2025.
9 April 2025:
- Directed PSPs must inform customers of their rights under the policy – should be changing T&C’s to include a clause that a PSP would reimburse their consumers in line with the reimbursement requirements and rules.
HC Comment:
We recommend that all in-scope PSPs ensure they are ready to implement the requirements as the PSR has made it clear that all firms remain responsible for determining their legal obligations. Relevant firms need to ensure they meet the registration requirement are ready for the implementation of new requirements by 7 October 2024. If a PSP has not already assessed whether or not it is in scope, this should be assessed urgently. If you have any queries in relation to or how to adapt to be compliant with the relevant requirements under the mandatory reimbursement framework, Herrington Carmichael have the skills and experience to assist you. Please contact us to speak to a member of our Commercial Team.
