PS23/3: Fighting authorised push payment fraud: a new reimbursement requirement

Why we are publishing this document

We are introducing a new reimbursement requirement for Authorised Push Payment (APP) fraud within the Faster Payments system. APP fraud happens a when fraudster tricks someone into sending a payment to an account outside of their control.  APP fraud has quickly become one of the most significant types of payment fraud globally.

For the first time, our new reimbursement requirement will introduce consistent minimum standards to reimburse victims of APP fraud. The new reimbursement requirement is underpinned by several key policies. Essentially it will:

• Require payment firms to reimburse all in-scope customers who fall victim to APP fraud in most cases
• Share the cost of reimbursing victims 50:50 between sending and receiving payment firms
• Provide additional protections for vulnerable customers

We are increasing protections within Faster Payments because currently the majority of APP fraud is enacted with a Faster Payment. The new reimbursement requirement will apply to all Payment Service Providers (PSPs) within the scope of the policy, this includes high-street banks and building societies but also smaller payment firms.

The new reimbursement requirement will come into force in 2024. We will consult on a specific start date alongside our draft legal instruments in early Q3 2023. We expect industry to start work now to implement the new reimbursement requirement.

What this document contains

This policy statement explains our decision to require all PSPs to make reimbursements available to all in-scope customers who become victims of APP scams. It confirms that we will implement this by issuing directions under Sections 54 and 55 of the Financial Services (Banking Reform) Act 2013.

It also sets out:

• Which customers are to be considered as being within scope of the requirement;
• How the cost of reimbursement will be shared between sending and receiving Payment Service Providers in each case;
• The exceptions for when reimbursement does not have to be issued;
• The time limit for Payment Service Providers to reimburse eligible cases;
• Our intention to permit sending Payment Service Providers to charge a claim excess, and our intention to consult on what level that excess should be set at;
• That we will no longer require a minimum threshold for claims to be valid;
• That we will introduce a maximum level of reimbursement for APP fraud claims, by value, and that we intend to consult on the appropriate maximum level;
• The time limits within which in-scope customers must make a claim for reimbursement;
• Special protections for customers deemed vulnerable; and
• Our proposed approach to multi-step fraud cases.

We have also published our cost benefit analysis and the responses to our consultation, along with our views to those responses.

Who should read this document

This document is relevant to the payments industry, consumer groups, payment service providers, and prospective qualifying customers who use Authorised Push Payments to send money and will be within scope of the policy, once implemented.

What happens next

We will engage in a series of workshops with interested parties in June and July in order to gather preliminary views and aid understanding.

We will then consult on:

• The allowable claim excess that Payment Service Providers can charge (August 2023);
• The maximum cap on reimbursement (August 2023);
• The production of guidance on how to interpret the customer standard of caution of ‘gross negligence’(August 2023); and
• A timeline for the reimbursement requirement to come fully into effect;
• Draft Directions for Pay.UK (July 2023); and
• A Draft Direction for Payment Service Providers (October 2023).