UK PSR Invites Industry Feedback on APP Fraud Reimbursement Rule

The UK’s Payment Systems Regulator (PSR) is conducting two consultations exploring when and how its authorized push payment (APP) requirements will apply when they come into force in 2024. 

According to Chris Hemsley, Managing Director at the PSR, “The two aspects we’re consulting on now will help to strike the right balance between encouraging people to be careful when making payments, while ensuring they have confidence in knowing they’ll be better protected if they do fall victim to fraud.” The changes also seek to encourage firms to invest in helping customers.

The PSR invites industry professionals to contribute their views by September 12, 2023 on the rule’s provisions for consumer responsibility, as well as reimbursement maximums and claim excess.

Reimbursement Rule Requirements

The reimbursement rule targets APP fraud, which tricks victims into sending funds to a fraudster posing as a legitimate recipient. This can occur through the impersonation of a legitimate financial institution or fraudulent sellers who never deliver purchased goods.

According to PSR, the rule will:

• Require firms to reimburse most customers victimized by APP fraud.
• Split reimbursement costs equally between sending and receiving payment institutions.
• Add more protections for vulnerable customers.

When the rule comes into force in 2024, it will apply to firms including payment service providers (PSPs) and focus additional consumer protections on faster payments. Among other things, the document detailing the rule explains: 

• Which customers qualify for reimbursement. 
• Exceptions when firms don’t have to issue a reimbursement – generally, when the customer has acted fraudulently or negligently.
• Time limits for the requirement. 

Approval of the Financial Services and Markets Bill, expected this year, will provide the PSR with the authority to require firms to reimburse customers.

Industry Views Sought in Consultations

Through the consultations, the PSR seeks industry feedback on: 

• The regulator’s proposed approach to consumer responsibility (the consumer standard of caution).
• Its reimbursement limit proposal.
• The best way to structure claim excess – the amount a victim would have to cover in case of a reimbursement.

Consumer Standard of Caution Consultation

According to the PSR’s proposed standard, customers must meet three basic responsibilities to be eligible for reimbursement in the case of APP fraud:

• Pay attention to warnings – If the PSP gives the customer a specific warning before a transaction occurs that the recipient is probably a fraudster, the customer must take it into account.
• Report the scam promptly – A customer victimized by APP fraud must notify their PSP promptly, and within13 months.
• Share information – The customer must comply with their PSP’s reasonable request for information to allow them to assess the situation accurately and prevent unnecessary losses.

A customer shown to have failed in this standard of care through gross negligence would forfeit their right to reimbursement. However, the burden of proof would remain with the PSP.

Maximum Reimbursement and Claim Excess Consultation

Excluding vulnerable victims, the regulator has acknowledged firms’ right to levy a claim excess as encouragement for customers to conduct responsible transactions. The consultation invites views on the excess – including deciding factors and the most effective value structure, which could be fixed or a percentage.

The PSR also requests industry feedback on the proposed reimbursement limit of £415,000, which would match the current ombudsman service limit.

How Firms Can Respond

Firms in the payments industry – especially banks and PSPs – are encouraged to study the consultations in-depth and contribute their views on the outlined proposals. This will help the PSR ensure its policy reflects industry realities. It will also help firms become familiar with the details of their upcoming reimbursement obligations to customers.

Firms may also want to review their fraud and loss prevention processes to ensure they are taking vulnerable customer groups into account. This should include robust customer education and timely warnings to customers suspected of vulnerability to a scam.