UK’s Payment Systems Regulator’s rules for Mandatory Reimbursement

Introduction

Section 72 of the Financial Services and Markets Act 2023 (“FSMA 2023”), which came into force on 30 August 2023, empowered the Payment Systems Regulator (“PSR”) to introduce Mandatory Reimbursement for the majority of APP fraud victims (“Mandatory Reimbursement”). 

The PSR has confirmed that Mandatory Reimbursement must be implemented by all payment service providers (“PSPs”), both direct and indirect, by 7 October 2024. 

Alongside PS23/4, the PSR published the legal instruments by which Mandatory Reimbursement will be implemented, and guidance on the ‘consumer standard of caution’ aspect of the reforms.

This article summarises the final structure for Mandatory Reimbursement. 

How is Mandatory Reimbursement being introduced?

The PSR has issued specific directions and specific requirements using its powers under sections 54 and 55 of the of the Financial Services (Banking Reform) Act 2013 as follows:

• specific Requirement 1 and Specific Direction 19 (“SD19”) on Pay.UK – these require Pay.UK, as the Faster Payments Scheme (“FPS”) operator, to introduce Mandatory rules for Reimbursement into the FPS rules, and to create and propose plans for an effective compliance monitoring regime
• specific Direction 20 (“SD20”) on PSPs – requiring directed PSPs (and indirect PSPs through their access providers) to comply with Mandatory Reimbursement
  
  

Summary of the Mandatory Reimbursement model

Mandatory Reimbursement will require all PSPs to reimburse consumer, microenterprise and charity victims of authorised push payment (“APP”) scams in “most cases”. 

The key features of the reimbursement scheme are as follows:

1. Mandatory reimbursement – All PSPs (including indirect participants) must reimburse victims of in-scope scams, subject to specified exceptions and limits
2. Shared liability – Liability for reimbursing victims will be split 50/50 between paying and receiving PSPs, although the reimbursement decision will sit with the sending PSP
3. Time limits – The default position is for reimbursement to take place within 5 business days (subject to a ‘stop the clock’ provision to allow PSPs more time to investigate in limited circumstances). There is a maximum time limit of 35 business days in which the sending PSP must reach its reimbursement decision. Customers will have 13 months from the last payment to bring their claim
4. Claim excess – PSPs can apply an optional claim excess of £100
5. Exceptions – Victims will only be denied reimbursement in cases of first party fraud or where they have, with gross negligence, failed to meet one or more element of the consumer standard of caution (discussed below)
6. Vulnerable customers – The gross negligence exception and the claim excess will not apply to vulnerable customers
7. Value thresholds – The maximum reimbursement limit is set in line with the FOS’ award limit, which is currently £415,000. It will not automatically change with inflation (as the FOS’s limit does). This will apply to all claims (including those from vulnerable customers)

Mandatory Reimbursement will initially be introduced only for Faster Payments (which covers 97% of bank transfers) but will be replicated for CHAPS (overseen by the Bank of England).
Payments sent internationally and card payments will be out of scope of the reforms. As will cryptocurrency investment scams, where payments are made by the victim to an account they hold with a cryptocurrency exchange, before being paid onto a scammer. This is an increasingly common fraud typology which future reforms may seek to address. 

The consumer standard of caution and the gross negligence exception

To refuse reimbursement, PSPs must prove that customers acted in a grossly negligent manner in respect of certain specific standards. The PSR has maintained that there is “no credible alternative” to gross negligence. 

The limited expectations placed on consumers will be known as the consumer standard of caution. It is described as “an express standard of care” comprising of four elements, namely:

1. a requirement to have regard to interventions – interventions will need to be from a customer’s own PSP or a competent national authority (i.e. the police or the NCA). They must be consumer, scam and transaction-specific and must “offer a clear assessment of the probability that an intended payment is an APP scam payment”. This represents a change from the PSR’s earlier proposals which would have required a warning making “clear that the intended recipient of the [scam] payment is likely to be a fraudster”. The PSR states that interventions may involve a PSP pausing or rejecting a payment instruction.
2. a prompt notification requirement – consumers must report a scam to their PSP promptly, but in any event within 13 months of the last scam payment.
3. an information sharing requirement – consumers must respond to any “reasonable and proportionate requests” from their PSP for information.
4. a police reporting requirement – upon a request from their PSP, consumers should either report the fraud directly or consent to their PSP doing so.

If a customer fails with gross negligence to meet one or more of the above standards it will be open to the sending PSP to refuse reimbursement. Gross negligence is not defined, but the PSR states it will involve “a significant degree of carelessness”.

As regards the three other standards, which relate to the consumer’s engagement with the reimbursement process after the payment has been made, it is difficult to see how these relate to consumer “caution”, or how the gross negligence standard will be applied. For example, what will constitute “a significant degree of carelessness” in respect of the prompt notification and police reporting requirements? A significant delay in notifying a scam, or a refusal to consent to the matter being reported to the police, seems to be a question of reasonableness rather than carelessness.

Claims excess

PSPs can choose to apply an excess of up to £100 per claim.

According to UK Finance data, if applied universally, a £100 excess would exclude from reimbursement c.32% of APP fraud cases by volume, but this would impact less than 1% of the total value of fraud losses.

The PSR expects the claims excess will “manage the risk of moral hazard” and will encourage consumer caution. While an excess of £100 may cause consumers to be more cautious when making low value payments, for customers instructing high value payments, the risk of losing £100 is unlikely to manage the risk of moral hazard.

As the excess will not apply to vulnerable customers it will not be possible to exclude all low value claims. An assessment of vulnerability will be necessary in each case. One vulnerability factor is financial resilience, which may mean exempting customers from the excess “where its application will lead to financial stress”.

Maximum limit 

The reimbursement limit will be £415,000 per claim. The limit is in line with the FOS’ current award limit (although it will not increase with inflation as the FOS limit does). The PSR states that it will monitor the incidence of high-value APP scams and could revisit the limit before October if there is “convincing evidence to do so”.

The PSR’s view is that there is merit in aligning the limit with the FOS’ current award limit for an individual complaint. However, as the FOS limit will increase on 1 April 2024, the limits will diverge before Mandatory Reimbursement is introduced.

Time limits

A 48-hour time limit for refunding customers was initially proposed by the PSR. It is now 5 business days. In addition:

• PSPs can ‘stop the clock’ to extend the 5 business day limit when seeking information to assess the claim. This includes requests of the customer and the receiving firm (the receiving firm must respond to requests)
• A PSP must refund or reject the claim by the end of the 35th business day

The longstop for reimbursement decisions is logical. It will clearly be challenging for PSPs to assess claims, weed out possible first party fraud and assess whether a customer has been grossly negligent in the space of 5 business days. It therefore seems inevitable that ‘stop the clock’ will be commonly relied on in complicated or high value claims. Meeting the 35 business day longstop may also prove challenging.

A PSP will be required to reach a reimbursement decision by the end of the 35 business day period even if they have not been provided with information which they have reasonably requested to determine a claim. A customer’s failure to provide reasonably requested information will not necessarily amount to gross negligence (e.g. where the customer has been hospitalised or overseas for an extended period).

Shared liability

The PSR has clarified that the assessment outcome reached by the sending PSP is the final outcome under the Mandatory Reimbursement rules. This means that a sending firm will lose the right under the rules to recover 50% from the receiving PSP if they reject a claim and a different outcome is subsequently reached (e.g. by the FOS or by a court).

This is likely to mean that sending PSPs will be very cautious about rejecting higher value claims, as they will run the risk of being solely liable if a subsequent FOS complaint is upheld.

What remains unclear?

The PSR confirms that it is setting up a clarifications process for PSPs in Q1 of 2024. It is hoped that the PSR will publish answers to common questions. Some areas which remain uncertain include:

• The treatment of customer dishonesty –The Consumer Standard of Caution Exception Guidance does not require customers to respond openly and honestly to an intervention from their PSP. Is a customer who knowingly misleads their PSP in the course of making a payment (without being socially engineered), preventing an appropriate specific and targeted intervention being provided, still entitled to reimbursement? 
• Pay.UK’s compliance monitoring role – Pay.UK’s role will include monitoring compliance with the Mandatory Reimbursement regime and taking steps to improve compliance “where it has the power to do so”. What powers will it have? Will there be any mechanism for resolving Mandatory Reimbursement disputes which arise between sending and receiving PSPs (e.g. as to whether a reimbursement claim is in scope of the regime)? 
• The future role of the FOS – Consumers unhappy with a reimbursement claim outcome are entitled to complain to the FOS. Setting the reimbursement limit at the FOS limit seems designed to minimise FOS complaints, but how will the FOS deal with complaints for losses in excess of £415,000? Will the FOS’ approach determine how the consumer standard of caution and gross negligence standard is applied?

Next steps

• Pay.UK to submit compliance monitoring proposals by 5 April 2024
• A consultation on Pay.UK’s compliance monitoring and data reporting roles – Spring 2024
• Compliance monitoring regime and final Faster Payments scheme rules to be published by 7 June 2024
• Mandatory reimbursement to be introduced by 7 October 2024
• There will be a post-implementation review by the PSR in 2026, two years after ‘day one’
  
  

Comment

The updates in PS23/4 provide some welcome clarity as to the form of Mandatory Reimbursement, but questions and concerns remain. PSPs will have to move at speed to design new Mandatory Reimbursement systems and processes. By the time the final rules are published in June they will have just four months until implementation.   

PSPs will remain frustrated that other sectors, such as the tech and telecoms sectors, are not being required to contribute to the cost of reimbursing customer losses, despite data demonstrating that a large proportion of APP fraud originates online or over the phone¹. There will also be concerns that the PSR’s regime does little to incentivise those most directly impacted by APP fraud (i.e. consumers) to protect themselves

1. According to UK Finance data from its 2023 Annual Fraud report, 78% originates online and 18% from telecoms.