Mandatory reimbursement for APP fraud

The controversial new requirement for all in-scope Payment Service Providers (“PSPs”) to reimburse victims of Authorised Push Payment (“APP”) fraud are due to be introduced from 7 October 2024. This is a significant change for all payment firms and has not been universally welcomed. Amongst the concerns raised are whether the new regime is consistent with the requirement that regulators advance the competitiveness of the UK. Most recently, HM Treasury has been reported as expressing discomfort with the maximum reimbursement level of £415,000. It is possible that the regime may not come into effect on 7 October 2024, although the Payments Service Regulator (“PSR”) appear committed to this date and so preparations for the new regime should continue to be implemented.

Authors

Andrew Tuson

Tegan Schultz

Samantha Paul

Published date

20 Aug 2024

Print

Preparing for 7 October 2024

We recommend that PSPs consider the following threshold points as they prepare for implementation:

The policies and procedures to be introduced to determine whether repayments are required to be made to customers within five business days of a customer reporting that they have been the victim of APP fraud.
The circumstances in which the PSP that has paid over money said to be subject to APP fraud will decline to make payment, and the risk of Financial Ombudsman Service (“FOS”) complaints being made as a result.
Consideration be given to whether reserves should be established in connection with anticipated payments where PSPs receive monies that are then said to have been involved in APP fraud. Under the proposed regime, PSPs that receive monies paid subject to APP fraud will be required to repay 50% of the monies returned by a paying PSP to the customer.
Where a PSP uses another PSP to clear transactions, consideration should be given to the terms entered into with the clearing PSP, so it is clear which PSP will be deemed to have received funds that are said to be used in a APP fraud. For example, where Bank A has a customer relationship and arranges a transfer of funds to Bank C, if the transfer is made through Bank B, Bank A should be clear whether it will ask Bank C to reimburse 50% of the sums paid to repay a customer who is the victim of APP fraud. The guidance currently is silent on how such clearing bank relationships should be treated.
The new regime does not apply to international payments. Most of the claims we have defended, acting for banks and PSPs, have been where APP frauds have involved international payments. We consider it likely therefore, that claims will continue to be made against banks and other PSPs where APP frauds have taken place.

The new mandatory reimbursement regime rules

We published a blog on the new regime at the start of the year. Since then, on the direction of the PSR, Pay.UK has published the final version of the Faster Payment System (“FPS“) reimbursement rules (the “Rules”). This includes the requirement that by 20 August 2024 all direct and indirect PSPs are to register with Pay.UK. The next key date is 20 September 2024, being the date by which all directed PSPs must be onboarded to the Reimbursement Claims Management System Core (“RCMS”), the system introduced to facilitate the management of claims under the APP fraud reimbursement policy.

Under the Rules, where a customer submits a claim for APP fraud within 13 months from the date of their last payment, the sending PSP must, within five business days of the victim making the APP fraud claim, reimburse the victim in full. The only exceptions to this rule are where:

the customer seeking reimbursement acted fraudulently; or
the customer acted with gross negligence, i.e. outside the consumer standard of caution, although this exception does not apply to vulnerable customers where the vulnerability had a material impact on the customer’s ability to protect themselves from the fraud.

The sending PSP may pause the five business days for a maximum of 35 days to allow for an investigation into the alleged APP fraud. Whilst the Rules provide a maximum reimbursement level of £415,000, the sending PSP is at liberty to reimburse a value which exceeds such an amount.

Once a sending PSP pays the reimbursable amount as required by the Rules, it will be required to update the FPS APP scam claim record via the RCMS. Thereafter, the receiving PSP will have five business days following a notification from the sending PSP to pay the reimbursable contribution amount, unless the sending PSP voluntarily chose to reimburse the customer for the APP fraud scam, in which case the receiving PSP will be off the hook. The reimbursable contribution amount is calculated by the sending PSP as a proportion of 50% of the reimbursable amount.

For context, the PSR’s latest APP scams performance report for 2023 reported a total of 252,626 cases of APP scams totalling almost £341m.

Importantly, PSPs are required to notify consumers of their rights under the reimbursement requirement by 7 October 2024, and to amend their contractual terms and conditions by 9 April 2025 to include a provision that a PSP will reimburse their consumers in line with the Rules. The PSR’s non-binding information sheet contains suggestions of the type of information PSPs should consider providing in relation to the reimbursement requirement and rules.

Information reporting requirements

The PSR has also published PS24/3 which, among other things, confirms that in scope PSPs will be required to provide their first report to Pay.UK by 6 January 2025. This report must include:

Total volume of FPS APP scam claims that are deemed ‘in scope’ for assessment;
Total volume of FPS APP scam claims that are reimbursable;
Total volume of FPS APP scam claims closed (from consumer reporting of the FPS APP scam claim to consumer reimbursement or claim rejection) within the five business days;
Total volume of FPS APP scam claims where the sending PSP informed the receiving PSP of the claim within the notification period as defined in the FPS reimbursement rules;
Total volume of FPS APP scam claims rejected as the consumer standard of caution exception was applied;
Total volume of FPS APP scam claims where the consumer was identified as vulnerable;
Total volume of FPS APP scam claims that are reimbursed to the consumer; and
Total volume of FPS APP scam claims where the sending PSP received the reimbursable contribution amount within the timeframe specified.

Although the PSR has confirmed that certain limits will be placed on Pay.UK in respect of the use and disclosure of the compliance data it receives (see PS24/3), ultimately, the data received from PSPs will inform the data published by the PSR, which PSPs will in turn be required to publish themselves. Policy statement PS24/2 confirms that:

In scope PSPs will need to publish the data received from the PSR by no later than 28 working days from the date of the PSR’s publication. The PSR has said that it will not send directed PSPs any data in advance of their publication date due to the sensitivities of the data collected.
The PSR’s publication will retain the percentage change of a PSPs year on year change in performance, on the basis that this information gives consumers a relative indication of whether the performance of a PSP has improved or declined.
The PSR will publish aggregate absolute APP scams data but will not identify the absolute APP scams data at an individual PSP level.

What about CHAPS payments?

On 8 May 2024, the PSR published CP24/8 which confirmed that all PSPs participating directly or indirectly in CHAPS will be required to reimburse their customers who have been victims of APP fraud. Similarly, the Bank of England (“BoE”) also published its draft CHAPS reimbursement rules, with the intention of providing a consistent outcome for victims of APP scams across CHAPS and FPS and consistent processes for CHAPS and FPS participants.

We expect the PSR to publish the final rules on CHAPS payments in September 2024 and that these will similarly come into effect on 7 October 2024 (assuming the Rules come into force then).

Identification of APP scams and civil disputes

Back in June 2023, the PSR confirmed that it was not proceeding with the creation of an actionable right for the consumer to enforce their rights under the mandatory reimbursement requirements through the civil courts. In reality, where payments are not refunded by PSPs, it is likely that complaints would be made to the FOS.

On 18 July 2024, the PSR published CP24/10 with draft guidance to support PSPs in their assessment of whether an APP scam claim raised by a consumer is not reimbursable under the reimbursement requirement because it is a private civil dispute.

When assessing, in light of the facts available, whether a claim solely relates to a civil dispute and does not therefore fall within the requirements to reimburse, the guidance, although only indicative, sets out the factors that PSPs should consider. In its current draft form, the guidance suggests categorising the factors into the following five key areas:

The communication and relationship between the consumer and the alleged scammer;
The trading status of the alleged scammer;
The alleged scammer’s capability to deliver the goods and services related to the claim;
The extent to which the alleged scammer deceived the consumer as to the purpose of the payment; and
Information held by the receiving PSP about the relevant account/s.

Responses to CP24/10 closed on 8 August 2024, so we expect to see the final guidance in mid-September.

Conclusion

We regularly defend claims against banks where sophisticated frauds have been perpetrated on customers and customers then claim redress. Current claims are particularly arising where there are joint mandates and one customer asserts that a transaction was entered into without their consent.

The authors would like to thank Trainee Solicitor, Rhea Ava Patel, for her assistance with this article.