The Authorised Push Payment (APP) scams reimbursement requirement comes into effect on 7 October 2024 and sets consistent minimum standards of consumer protection that will see all in-scope consumers who fall victim to APP scams reimbursed in most cases.
This is a significant change that affects all payment firms making use of Faster Payments (FPS) and requires them to take action. Firms should be engaging with Pay.UK, the Payment System Operator (PSO) of Faster Payments. In its role as PSO, Pay.UK has placed the reimbursement requirement into the FPS rules and will be monitoring and managing compliance with these rules. Payment Service Providers (PSPs) should review Pay.UK’s FPS rules and approach to compliance monitoring and consider what it means for how they operate, so that they have processes in place to handle reimbursement requests from 7 October 2024. Pay.UK will also be providing the operational systems which enable firms to communicate about APP scam claims, manage claims and report compliance data to Pay.UK.
PSPs can also find all the information relating to the PSR’s reimbursement requirement and the legal directions which give effect to the policy on our website. Firms should review all the relevant publications to ensure they fully understand the reimbursement requirement and its impact for their business and operations.
As we approach the reimbursement requirement go-live date and bedding-in period, there are some upcoming deadlines that PSPs need to meet to ensure compliance.
Deadline to register with Pay.UK deadline: 20 August 2024
As stated in a previous letter to participants, Pay.UK has procured a reimbursement claim management system (RCMS) which will enable firms to communicate with each other, to manage APP scam claims and to report data to Pay.UK so it can monitor firms’ compliance with the FPS reimbursement rules.
Pay.UK has developed operational systems:
· RCMS core – this will allow firms to access a directory to support communication between firms and to report compliance data to Pay.UK. Pay.UK are requiring that firms use RCMS Core to report data to them.
· RCMS core + claim management – this will allow firms to access the claims management system, to file new claims under the FPS APP Scams Reimbursement scheme, to manage those claims to completion and to collect and report data on their actions.
In the July policy statement PS24/3 FPS APP scams reimbursement compliance and monitoring we confirmed the requirement for all in-scope PSPs to register with Pay.UK by 20 August 2024 to be included in the directory and to identify themselves to Pay.UK as in or out of scope of the reimbursement requirement . It is vital that both direct and indirect participants register with Pay.UK at the earliest opportunity and no later than 20 August. All PSPs which provide indirect access to FPS should engage with their indirect customers to help raise awareness of the requirements.
By registering, directed PSPs will have notified Pay.UK that they have identified themselves as in-scope of the policy and will provide their contact details and account ranges they provide. Registration will enable the creation of a directory through which the sending PSP will be able to find contact details for the receiving PSP. This will enable them to communicate in respect of FPS APP scam claims and to provide the reporting standard A data to Pay.UK, as required by Specific Direction 20 (SD20). Firms can register with Pay.UK through their website.
We consider it critical that all firms are registered by the August 20 deadline and will consider enforcement action against those who fail to comply.
At this stage we are not mandating PSPs to use the RCMS for FPS APP scam claim assessment, communication and data reporting. However, it remains our view that a single system used by all in-scope PSPs and run by Pay.UK is the most effective way to facilitate inter-PSP communication, claim management and data reporting and we will reconsult on this proposal in late 2024.
You can find additional information about the registration and the RCMS system in the dedicated page on the Pay.UK website. We encourage in-scope PSPs to engage with Pay.UK should they have any questions about the process or what is required of them at this address: CBDO@wearepay.uk
Implementation deadline: 7 October 2024
The reimbursement requirement comes into effect on 7 October 2024. From this date, in-scope PSPs will need to assess claims within the parameters of the policy and apportion the liability between sending and receiving PSPs equally.
SD20 requires all directed PSPs which are capable of being sending PSPs to inform their existing customers of their rights under the FPS reimbursement requirement by 7 October 2024 at the latest.
Reporting deadlines: 6 January 2025
The Faster Payments APP Scams Compliance Data Reporting Standard (CDRS) contains the Faster Payments APP scams data and information that directed PSPs are required to collate and retain for Pay.UK to effectively monitor compliance with the FPS reimbursement rules.
Reporting standard A will be in place from 7 October 2024. Sending PSPs must comply and report the required data to Pay.UK using the method specified by Pay.UK in its rules. We have also made provision for Pay.UK to specify a reasonable alternative reporting method, where necessary.
Sending PSPs must submit the first report under reporting standard A to Pay.UK by 6 January 2025. The first report must cover the period 7 October to 30 November 2024. All subsequent reports must be submitted monthly and cover claims closed in the previous calendar month. Sending PSPs must notify Pay.UK if they have not received any FPS APP scam claims in scope for reporting, in the relevant reporting period.
Amendment to terms and conditions deadline: 9 April 2025
As required by SD20, all directed PSPs which are capable of being sending PSPs must amend the terms and conditions of their relevant contracts to provide that they will reimburse their consumers as and when required by the FPS reimbursement requirement and FPS reimbursement rules. They should do so at the earliest practicable opportunity, including by reference to contractual amendment cycles. The deadline for updating contracts is 9 April 2025.
Indirect access providers list: ongoing obligation
In SD20 we placed an obligation on indirect access providers (IAPs), whether they are direct or indirect members of Faster Payments, to send us a complete list of all the indirect PSPs to which they provide access to Faster Payments for the previous calendar year by 31 March each year. Firms that still haven’t done so, must report this information to us as soon as possible. To help simplify the process, we have published a template, which IAPs may choose to use.
By 30 April 2024, and monthly thereafter, they must send us an update containing any changes to the list they provide. They do not need to provide a report for months where there are no changes since the previous report.
Next steps
We have been working with the Bank of England to establish equivalent protections for CHAPS and will publish our final position in September.
We intend to consult on proposals to require all PSPs to use a single system for FPS APP scam claim management, communication and data reporting, and a potential shift to reporting standard B. We intend to issue this consultation in autumn 2024, and after 7 October 2024, once the reimbursement requirement has come into effect, as we want to ensure that all directed PSPs remain focused on implementation in the first instance.
We look forward to continuing to engage with stakeholders in the lead up to 7 October 2024, to ensure readiness, so that the policy is effective for consumers from the start date.