What claims can PSPs expect following the introduction of the APP fraud compulsory reimbursement requirement?

Claims for reimbursement

PSPs that were previously not signatories to the Contingent Reimbursement Model will now face a major shift in the regulatory landscape, as they are required to reimburse customers who fall victim to APP fraud.

The default position is that PSPs must reimburse losses in nearly all circumstances, except in specific, limited cases such as where the claim relates to a civil dispute between the payer and payee (for further information see our previous article: When is an app scam not an app scam. The reimbursement limit is £85,000 per claim, with an administration fee of £100 allowed for each claim submitted (save in those cases where customers are considered to be vulnerable).

Once a claim is made, PSPs have just five days to investigate and determine whether the claim is legitimate and falls within the scope of the reimbursement rules. This is a short timeframe for conducting a thorough investigation. However, “Stop the Clock” provisions allow PSPs to pause the five-day requirement for up to 35 days in certain situations.

One of the reasons for invoking the “Stop the Clock” provisions is the suspicion of fraud. As with any new scheme, there is a risk of manipulation by fraudsters seeking financial gain, and these provisions are no exception. It is anticipated that fraudsters may collude with consumers to make fraudulent claims, exploiting the limited time for investigation and the presumption of reimbursement.

To mitigate these risks, PSPs will need robust policies and procedures in place  to investigate reimbursement requests swiftly and effectively. Only through that consistent approach will they ensure that fraudulent claims are identified. Effective communication channels with consumers, along with a dedicated team to manage investigations, will be essential. Additionally, there will likely need to be significant investment in technology to assist in detecting fraudulent claims.

Furthermore, HM Treasury has announced new powers allowing PSPs to delay suspicious payments for up to four business days, an increase from the current 24-hour window. This extended period will provide PSPs with more time to verify the legitimacy of a payment with the consumer before APP fraud occurs. We discuss this change further below.

It is also expected that there will be an increase in claims being rejected when consumers fail to meet the “consumer standard of caution.” These rejected claims are likely to be escalated to the Financial Ombudsman Service (the “FOS”) for further review. It is worth noting that while the new reimbursement limit is set at £85,000, the FOS compensation limit is significantly higher, at £415,000. This discrepancy may create tension between the two limits. PSPs may opt to settle larger claims early to avoid the risk of the FOS ordering a payment that exceeds the £85,000 reimbursement cap.

PSP’s will need to adapt quickly, either by improving their fraud prevention capabilities, reporting to recipient banks as well as face potentially adjusting their business models to cope with the new demands.

Disputes between sending and receiving PSPs

Pay.UK is managing the implementation of the new reimbursement requirement and has developed the Reimbursement Claims Management System (“RCMS”). The RCMS provides a portal for communication between the sending and receiving PSPs, allowing for a straightforward, seamless process by which the sending PSP can recover 50% of the funds from the receiving PSP.  The RCMS is designed to automate the process, saving time and resources while ensuring a more efficient workflow.

In practice, the sending PSP must notify the receiving PSP within two business hours of a reimbursement request being made. This notification should include enough information for the receiving PSP to identify the account and the amount that was paid into it. Additionally, the sending PSP must provide any evidence it has regarding the perpetration of the fraud (which will range from information about IP addresses, onboarding information about intended use of an account compared to the transaction in question, assessment of the customer’s historic behaviours, information of concern about the counter parties in the transaction who bank with the recipient bank, to name but a few).

Once the notification is received, the receiving PSP is expected, where possible, to reimburse 50% of the amount within five business days. The sending PSP cannot reimburse the customer until it has allowed the receiving PSP time to respond.

The receiving PSP has the opportunity to respond to the notification within a maximum of three business days, providing any information it deems relevant to the claim. This is a very limited timeframe for receiving PSPs to interrogate their systems and establish whether any fraud indicators exist, and it will be labour intensive. Smaller PSPs, due to economies of scale, may decide not to dispute APP fraud claims below a certain threshold, effectively a blanket business decision not to contest smaller claims.

What happens if there is a dispute between the sending and receiving PSP regarding the validity of the claim? In its June 2023 policy statement, the PSR[1] stated that PSPs are best positioned to resolve such disputes. This guidance is somewhat vague and unhelpful. There is a suggestion that independent arbitration can be used and that Pay.UK may introduce a dispute resolution process if deemed appropriate. The PSR has confirmed that this issue will be reviewed in the post-implementation phase, but until then, the process remains ambiguous.

There is also no provision in the current rules suggesting that reimbursement should be suspended while disputes are resolved.  This leaves the sending PSP with three options:

1. Make the decision to reimburse the customer in the knowledge they are unlikely to get a contribution from the sending PSP.
2. Reject the request for reimbursement and wait for the customer to escalate the matter to the FOS, which can review the claim in more detail and make a finding that either the sending or receiving PSP has to pay or split the reimbursement between them in a percentage appropriate to the particular facts of that case.
3. Reimburse the customer and then seek independent adjudication to determine whether the receiving PSP should have contributed to the reimbursement.

Currently, there is no formal process to challenge the 50% contribution, aside from refusing to pay and leaving the sending PSP to decide whether to move forward with the reimbursement or reject it, as outlined earlier. Consistently refusing to reimburse a sending PSP is likely to attract regulatory scrutiny, making this a delicate balance for receiving PSPs to manage.

As the regulatory landscape becomes more complex, we may see increased mergers and acquisitions within the payments sector. Smaller PSPs, unable to absorb the risks and costs associated with the new requirements, could be acquired by larger, more established players with better resources to manage these challenges.

Breach of mandate claims

Currently, the Payment Services Regulations 2017 (the “PSRs”) require that once an outbound payment order is received, the amount of the payment transaction is credited to the payee’s payment service provider’s account by the end of the next business day from receiving the payment order.

In March 2024, the Sunak Government issued a Policy Note[2] proposing to bring in amendments to the PSRs[3] to delay payment processing by up to 4 business days when there are reasonable grounds to suspect fraud or dishonesty. The intention was for the amendments to be introduced alongside the new reimbursement requirements, however, the proposed Payment Services (Amendment) Regulations 2024 did not make it through the parliamentary process before the General Election and for a time it was unclear whether the new Labour Government would carry these proposals forward.

However, on 3 October 2024, the Government published a final draft of the Payment Services (Amendment) Regulations 2024[4] indicating that the legislation will be laid before parliament shortly after its return from conference recess. It is unlikely that the amendments will pass before the commencement of the reimbursement rules on 7 October 2024.

The amendments are welcome as the current status does leave PSPs in an unenviable position. On the one hand, they are obliged to process payments by the next business day following receipt of the payment order. Failure to do so could open PSPs up to potential claims of breach of mandate for any losses incurred as a result of the delayed payment. On the other, by processing payments at speed, PSPs may miss opportunities to investigate potentially fraudulent transactions, and ultimately stop such payments being made. From 7 October this leaves them open to claims under the APP fraud reimbursement rules.  The 4-day delay will give PSPs time to investigate suspicious payments and communicate with the payer, payment initiation service provider or other relevant parties (such as law enforcement agencies).

There is a Financial Conduct Authority (the “FCA”) consultation on the proposals which closes on 4 October 2024[5]. The purpose of the consultation is to ensure that the FCA’s accompanying guidance provides industry with sufficient clarity for the amended regulations to work as intended.

A decision to delay a payment will have the effect of placing a hold on the funds. If the payer incurs interest and charges as a result of the payment delay, the PSP will be liable for them and will be obliged, under the terms of the legislation, to reimburse the payer whether or not the payment order is ultimately made. That provision is narrowly constructed to apply only to interest and charges directly, and not to wider losses that a customer may experience from a payment delay, for example the loss of opportunity from an investment that the customer was unable to make in a timely way due to a payment delay being applied.

A PSP may still refuse to make a payment and is therefore still at risk of breach of mandate claims where a PSP wrongly refuses to make a payment.  Where a refusal is justified under legislation the PSP will need to be able to discharge the burden of showing that it had a reasonable suspicion. In the same way, a delay to the payment must also be justified. Therefore, PSPs may be open to challenge on this issue.

The FCA draft guidance[6] suggests that suspicion is beyond mere speculation and based on some factual foundation yet falling short of knowledge. The FCA states that “reasonable grounds to suspect fraud or dishonesty” is an objective test and to show that they have met this threshold, staff within PSPs would need to be able to demonstrate that they took reasonable steps in the particular circumstances, in the context of a risk-based approach to understand:

• the nature and rationale of the transaction
• the amount involved
• the intended destination of the funds, and
• whether the payee appears to have any links with criminality.

A PSP must establish such reasonable suspicion no later than the end of the business day following the receipt of the payment order. The FCA has stated that if a PSP has not met the threshold of having reasonable grounds to suspect fraud or dishonesty by the end of the business day following the receipt of the payment order, it will need to execute the payment transaction. In addition, the delay must be no longer than necessary; this means that once the payer or other relevant party has been contacted and the PSP established that the payment is legitimate, it must execute the payment order straight away rather than waiting until the end of the 4^th business day to do so.

A PSP that delays payment under the amended Regulations must notify the payer of the delay, the reason for the delay, and any information or action needed from the payer to enable the PSP to decide whether to execute the order. Such notification must be provided later than the end of the next business day following receipt of the payment order, unless such notification would constitute a tipping off offence.

A sending PSP is encouraged to exchange information with the receiving PSP about payment transaction delays to facilitate effective investigations and mitigate risks of additional delay and duplicative investigation by the receiving PSP.

Linked transactions

As set out above, the Payment Systems Regulator (the “PSR”) has recently announced a lower limit of £85,000 (a decrease from the initial proposed limit of £415,000) for reimbursement under the new scheme. The PSR claims that 99.8% of APP claims will still be covered by this reimbursement limit.

In terms of linked transactions, the PSR has stated that the maximum limit will be applied by claim, and a claim will include all payments relevant to that case.[7] Paragraph 4.4 of the FPS Reimbursement Rules[8] explains how this will work in practice making it clear that any additional APP scam payments identified to be part of the same APP scam must be raised as a new claim, using RCMS. However, despite each claim being raised separately via RCMS, the maximum level of reimbursement will apply across all linked claims.

In its Final Decision published in December 2023[9], the PSR made it clear that whatever the limit, victims will retain their existing rights under the FCA Handbook to refer complaints to the FOS if they consider they have suffered losses because of the acts or omissions of the sending and receiving PSPs (this includes consideration of the Consumer Duty and a fault-based assessment against the FOS’ wider jurisdiction). This means they are able to make two complaints (one to each PSP) about their losses from a single payment and those complaints will be subject to separate FOS award limits (currently £415,000).

The PSR states that where a scam has resulted in the victim making multiple payments, they may be able to make several complaints against the same parties, with each complaint subject to a separate FOS award limit.

In other words, victims who have lost very large sums are already entitled to seek redress of more than £415,000 by bringing multiple complaints to the FOS and they will continue to have that right after the reimbursement rules are introduced. However, PSPs can limit their exposure to such claims by conducting their business in line with the relevant FCA guidance and Consumer Duty ensuring that actions are fully justified and communicated to customers in a clear and timely manner. In addition, prompt reimbursement, at the appropriate level, in response to a claim for reimbursement may reduce the risk of a customer making a further complaint to the FOS.

In light of the award limits, PSPs may wish to consider implementing appropriate transaction limits to mitigate their exposure. It should also be noted that PSPs may choose to voluntarily reimburse its customer any amount that falls outside of the maximum reimbursement level set by the PSR if it considers that is the best outcome for its customer in the circumstances. This may also reduce the risk of a complaint being made to the FOS.

EMIs

The new reimbursement rules will have a profound impact on the banking industry, but some PSPs may feel the consequences of the changes more than others. There has been a concern that the reimbursement requirement could send some smaller PSPs into insolvency threatening competition in the marketplace. Additionally, if you are an EMI with a business model based on using an agent bank, agents and distributors, there is an added layer of complexity to implementing the new rules.

Assessing who is liable to fund the reimbursement is not straightforward, however given the time constraints (5-days in a simple claim), it is likely that EMI principals will be left to reimburse the customer, and then seek payment from its agent or distributor. It is important that distribution agreements contain the appropriate warranties and indemnities and make clear the agent/distributor’s obligations under the new rules.

Conclusion

As with all new legislation, the reimbursement rules will inevitably take some getting used to and will potentially expose PSPs to new claims. The key to managing these risks will be ensuring that staff are trained and ready to implement the changes, acting within the relevant rules and industry guidance, and ensuring that all actions are justified and clearly communicated. Ultimately, the key aim behind the new rules is to encourage fraud protection and detection measures. Those PSPs who invest in such measures are likely to come out on top.

If you would like to discuss your current arrangements for dealing with disputes arising from APP or are concerned about the implementation of the new reimbursement rules and how they will affect your business, then please do not hesitate to get in touch by contacting one of the authors on the details below.

Our team would be happy to arrange an initial meeting to better understand your business and explore how we can offer support moving forward.

For more information about this article please contact:

Esther Phillips, Rebecca Craig, Arun Chauhan

[1] psr.org.uk

[2] https://assets.publishing.service.gov.uk/media/65eed7233649a26deded630f/Policy_note.pdf

[3] The Payment Services (Amendment) Regulations 2024 

[4] https://assets.publishing.service.gov.uk/media/66fd6cf9e84ae1fd8592ed0c/20241002_FINAL_Publishing_Version-The_Payment_Services__Amendment__Regulations_2024.pdf

[5] fca.org.uk

[6] fca.org.uk (page 20)

[7] psr.org.uk

[8] wearepay.uk

[9] psr.org.uk