PSR's recent publications setting out priority areas for mandatory reimbursement for APP fraud

Last month the PSR published two letters highlighting the importance for PSPs to now expedite their implementation process for the upcoming 7 October deadline for the new reimbursement requirements for APP fraud.

The first letter, which was published on 22 May 2024 and addressed to the House of Commons Treasury Select Committee, provided a progress update on the implementation of the PSR's measures relating to APP fraud and set out some of the key steps the PSR expects firms to be taking ahead of the 7 October implementation date. The second letter, which was published on 24 May 2024, was sent to PSPs setting out the areas for them to focus on in their preparations for the mandatory reimbursement requirements.

So what?

These are important communication from the PSR which firms should be referring to in understanding their next steps and the PSR's expectations in implementing the reimbursement process and to provide consumer protection from the ‘go live’ date of 7 October.

Some of the key steps that PSPs should be taking and the areas that they should be focusing on over the coming months to ensure effective and timely implementation by 7 October are:  

• Doing more to prevent scams by investing in systems and processes to detect and prevent scams, and making use of available data and technology;
• Reassessing their fraud risk management processes to make sure they are fit for purpose. For example, by considering whether transaction limits for different channels remain within their risk appetite;
• Taking proactive steps to notify consumers of the protections available under the new policy. Providing transparent information to customers on how they can report fraud, and to make the process as simple and accessible as possible, taking into account the needs of vulnerable consumers;
• Understanding how the requirements apply to them and engaging with the PSR on any concerns; and
• Registering with Pay.UK by 20 August 2024 to be part of the reimbursement claim management system (RCMS) and to ensure they are onboarded in time ready to meet their obligations from the policy start date. 

PSR consultation on CHAPS APP scam reimbursement requirement

On 8 May 2024, the PSR published a consultation CP24/8: CHAPS APP Scam reimbursement requirement: Supporting the Bank of England in enhancing fraud prevention in CHAPS.

The PSR is proposing to direct banks and other payment firms participating in CHAPS to reimburse their customers who have been victims of APP scams. The direction will underpin the Bank of England’s new CHAPS reimbursement rules, which the BoE will be implementing as an Annex to the CHAPS Reference Manual. The PSR has published a draft version of the BoE's CHAPS reimbursement rules along with this consultation.

The consultation closed on 31 May 2024. The PSR intends to finalise and publish the specific direction in September 2024, with a go-live date of 7 October 2024, along with the FPS reimbursement policy.  

So what?

Extending the reimbursement requirements to CHAPS payments will make it consistent with the reimbursement approach and protections in relation to FPS. These proposals mean that consumers will benefit from consistent protection across two major UK payment systems which has the intention of encouraging payment firms to tackle scams consistently and therefore reducing the likelihood of criminals switching from FPS to CHAPS due to differences in firms’ defences.

The proposed specific direction will apply as follows:

• Both direct and indirect CHAPS PSPs will be required to follow the BoE's CHAPS reimbursement rules and reimburse victims of APP scams from 7 October 2024.
• Both direct and indirect CHAPS PSPs will need to inform consumers of their rights under the CHAPS reimbursement requirement. This may involve amending their contractual terms and conditions with the consumer to include provisions on the relevant rights and obligations.
• There will be a requirement to register with a dispute resolution process which will ensure PSPs are detailed in a contact directory which other PSPs will be able to use to support the management of CHAPS APP scam reimbursement claims.
• There will be a requirement to report CHAPS APP scam metrics to the Bank, in accordance the CHAPS Compliance Data Reporting Standard (CCDRS).
• In addition, Indirect access providers will need to inform the PSR of any indirect PSP customer they provide CHAPS access to.

Although some of these requirements have been de-duplicated for the PSPs who are also in scope of the PSR's Specific Direction 20 (SD20) to comply with the FPS reimbursement rules, there are still a substantial number of changes to make to their systems, customer contracts and processes to comply with the proposed requirements for CHAPS. This is especially in the context of the short deadline for the 'go live' date of 7 October for compliance.