APP Fraud - Mandatory Reimbursement and the FPS Reimbursement Rules

This article was first published on Reuters Regulatory Intelligence [ paywall ] 

Introduction

Section 72 of the Financial Services and Markets Act 2023 empowered the Payment Systems Regulator (“PSR”) to introduce mandatory reimbursement for the majority of APP (“Authorised Push Payment”) fraud victims (“Mandatory Reimbursement”). 

The PSR’s Policy Statement 23/4 (“PS23/4”), and supporting legal instruments, set out the “final detailed parameters” of Mandatory Reimbursement. Pay.UK, which operates the Faster Payment Scheme (“FPS”) rules, is required by the PSR to introduce Mandatory Reimbursement for Faster Payments by updating the FPS Rules. Those rules were published by Pay.UK on 7 June 2024 (the “FPS Reimbursement Rules”).

Mandatory Reimbursement must be implemented by all payment service providers (“PSPs”), both direct and indirect, for in scope transactions by 7 October 2024. The Contingent Reimbursement Model (“CRM”) Code (a voluntary reimbursement code which covers around 90% of APP fraud payments) will be withdrawn from this date.

Key features of Mandatory Reimbursement

In “most cases”, Mandatory Reimbursement will require PSPs to reimburse consumer, microenterprise and charity victims of authorised push payment (“APP”) scams, for UK payments made by Faster Payment or CHAPS. There will be a £415,000 limit and firms will be able to apply a £100 excess. 

The only exceptions to reimbursement will be for cases of first party fraud or where the customer has, with gross negligence, failed to meet one or more elements of the Consumer Standard of Caution.

A significant feature of Mandatory Reimbursement is that the cost of reimbursing scam victims will be shared 50/50 between paying and receiving firms. This model has been designed to incentivise PSPs to prevent accounts being used to receive APP fraud funds.

The FPS Reimbursement Rules

The FPS Reimbursement Rules detail the reimbursement process for Faster Payments. There are few surprises; the FPS Rules broadly follow the structure set out in PS23/4. In summary:

1. Initial timings – The default position is that the sending firm must reimburse the victim (or refuse reimbursement) by the end of the fifth business day. The sending firm must notify the receiving firm within two hours of a customer reporting a scam. The receiving firm(s) has up to three business days to provide “any information it believes to be relevant to the claim”. Unless a sending firm requires further information, they must reimburse the customer after the receiving firm(s) respond (and before the end of the fifth business day). The reimbursement decision is made by the sending firm and is binding on the receiving firm. The receiving firm must pay its 50% contribution to the sending firm within five business days.
2. Stop the clock – a sending firm can ‘stop the clock’ (past the default 5 business day period) on multiple occasions but only for specified limited reasons which go to gathering information and/or verifying the legitimacy of the claim. Receiving firms have a maximum of 25 business days to respond to an information request. Customers are only obliged to respond to “reasonable and proportionate” requests. The sending firm must make a reimbursement decision within 35 business days regardless of any outstanding information requests.
3. No retrospective effect – Only payments made from 7 October 2024 are caught. Where a scam involves payments before and after 7 October 2024, those earlier payments are out of scope.
4. Customer reporting obligation– The scam must be reported within 13 months of the final scam payment. The Consumer Standard of Caution requires customers to report scams “promptly” upon “learning or suspecting” that they have fallen victim to a scam. It is unclear what would constitute gross negligence in respect of the prompt reporting requirement.
5. Vulnerability – The excess and the Consumer Standard of Caution will not apply to vulnerable customers (adopting the FCA definition).

Comment

The Payments Association wrote to the PSR on 10 June 2024, calling for Mandatory Reimbursement to be postponed by 12 months. Concerns included the readiness of technology and systems to implement Mandatory Reimbursement and reduced competition if smaller PSPs are forced to exit the market as a result of Mandatory Reimbursement. The PSR swiftly responded, confirming the 7 October 2024 start date.

A Reimbursement Claims Management System (“RCMS”), the use of which will be mandatory, will be introduced by Pay.UK to “communicate, manage claims and report information”. However, this will not be in place by 7 October 2024 (a 1 May 2025 launch date is mentioned). Some will query the wisdom of introducing Mandatory Reimbursement when a core system is not yet live.

Another concern is that a planned amendment to the Payment Services Regulations 2017 was not passed into law before the recent dissolution of Parliament. This was tabled to enable sending firms to delay payments by up to a further three business days if they suspect their customer may be at risk of being scammed (currently payments must be executed by the end of the next business day). Whilst not directly relevant to reimbursement, the proposed legislation will be key to PSPs’ ability to prevent fraud.

The FPS Reimbursement Rules do not provide further clarity on the application of the Consumer Standard of Caution and the circumstances in which reimbursement can be refused. The Consumer Standard of Caution is narrowly cast – it requires a victim “as a result of gross negligence” to have failed to comply with one of four standards. Only one of those standards, (requiring a customer to have regard to interventions by their PSP a competent national authority (such as the police)), relates to a customer’s actions prior to the payment(s). Where a PSP has been prevented from effectively intervening because the customer has dishonestly answered questions about the payment, or where a customer has not been warned by their PSP but has ignored a warning from a professional such as a financial advisor, this exception would seemingly not be engaged. This may lead to some perverse outcomes. Post-introduction, the FOS will play a key role in determining how the exceptions are applied.

Much uncertainty remains but, with the detail of Mandatory Reimbursement confirmed in the FPS Reimbursement Rules, PSPs now know where they must get to by 7 October 2024. There is much to do and little time.