9 things you should know about the PSR's latest work

Issue 508 | 6 July 2023

9 things you should know about the PSR’s latest work

In this edition we cover nine things you should know about the Payment Systems Regulator’s (PSR) latest work.

You’ll find all the detail over on the PSR’s website but if you are short of time here’s a quick summary of what the PSR have been upto recently…..

---

#1: Fighting APP fraud: A new reimbursement requirement

The PSR are introducing a new reimbursement requirement for Authorised Push Payment (APP) fraud within the Faster Payments system. APP fraud happens a when fraudster tricks someone into sending a payment to an account outside of their control.  APP fraud has quickly become one of the most significant types of payment fraud globally.

The PSR’s new reimbursement requirement will introduce consistent minimum standards to reimburse victims of APP fraud.

The new reimbursement requirement is underpinned by several key policies - essentially it will:

• Require payment firms to reimburse all in-scope customers who fall victim to APP fraud in most cases

• Share the cost of reimbursing victims 50:50 between sending and receiving payment firms

• Provide additional protections for vulnerable customers.

The PSR are increasing protections within Faster Payments because currently the majority of APP fraud is enacted with a Faster Payment. The new reimbursement requirement will apply to all Payment Service Providers (PSPs) within the scope of the policy, this includes high-street banks and building societies but also smaller payment firms.

Once implemented, our changes will deliver a major shift from the status quo, giving everyone across the payments ecosystem a reason to act to prevent fraud from happening in the first place. That means everybody who makes payments can do so with much greater confidence, knowing that they will be better protected against fraudsters.

And by confirming these changes now, it means we will be ready to act once new laws come into effect. We will continue to work with Pay.UK, industry, consumers and organisations beyond the payments sphere to drive effective intervention and start to turn the tide against APP fraud.

Chris Hemsley, Managing Director, PSR

You’ll find the PSR’s policy statement here: fighting authorised push payment fraud: a new reimbursement requirement.

The PSR have also published slides used during recent webinars which provide a high level overview of the new APP fraud policy - this includes a useful overview of the key policies:

Source: PSR

Earlier this year the PSR issued a policy statement on the collection and publication of performance data. The PSR believe that this is a crucial step towards greater transparency in the fight against fraud. Firms across the whole payments industry (on both the sending and receiving end of a payment) will be accountable for their performance and encouraged to do more to prevent fraud and look after victims.

The PSR will direct 14 of the largest UK payment service providers (PSP) groups to collect and provide data to the regulator which will cover 95% of transactions.

The reporting requirement will see the following data being published:

• the proportion of victims of APP scams who do not get reimbursed 

• the rates of APP scams happening at sending payment firms

• the rates of APP scams happening at receiving payment firms

The 14 directed groups were required to provide the PSR with the first set of data by May 2023. The regulator then expects to publish this data in October 2023, and on a six-monthly basis thereafter. The PSR state this requirement may adapt over time to reflect new changes or data that should be presented.

Next steps:

• In July the PSR will consult on the draft legal instruments to put reimbursement requirements in place

• In August the PSR will consult on the maximum level of reimbursement and claim excess and additional guidance on the customer standard of caution (gross negligence)

• In October the PSR will give the final legal instruments to Pay.UK and a further consultation on the legal instrument to be given to PSPs

• By the end of 2023 the PSR will publish the claim excess and maximum level of reimbursement, additional guidance on the customer standard of caution (gross negligence) and publication of all legal instruments

• In 2024 the new reimbursement requirement will come into force.

More:

• Chris Hemsley: Speech on fighting authorised push payment fraud: a new reimbursement requirement.

• Governance: PSR board agreement to Authorised Push Payment scams reimbursement proposals. The PSR Board minutes of the 15 March 2023 provide evidence of agreement to other aspects of this update including: JROC paper on Open Banking developments, PSR 2023/24 annual plan and budget and PSR fees.

---

#2: PSR responds to the Financial Services and Markets Bill receiving Royal Assent

The new Financial Services and Markets Act 2023 (FSM Act 23) ushers into law an enhanced regulatory framework which all financial regulators will work within. The new law includes provisions that will enhance the PSR’s regulatory scope and ability to improve payment services for consumers and businesses.

From the perspective of the PSR the provisions include:

• Greater protection for victims of APP scams by allowing the PSR to impose reimbursement requirements on participants which operate across the Faster Payments Scheme. This will give consumers greater protections and certainty about how they will be treated if they fall victim to an APP scam.

• Confirms the FCA’s new leading role on access to cash. The PSR will continue its important work in regulating the LINK ATM network, as well as supporting the FCA in its new role.

• Clarifies the PSR’s power to regulate “digital settlement assets”, which are new payment methods, such as firms which operate using distributed ledger technology (including the Sterling Fnality Payment System).

• Repeals retained EU law, enabling the government and regulators to replace it with rules tailored to UK markets. This will provide more effective and efficient regulations and ensure the PSR’s regulatory framework is fit for the future.

This new act marks an important step in the development of the UK’s payment systems and the way we can regulate those systems.

We now have greater scope to make essential changes that will see increased protections for people against the threat of APP scams, open up access to new products and services and encourage innovative new solutions in our increasingly digital world.

Chris Hemsley, Managing Director, PSR

---

#3: Principles for commercial frameworks for premium APIs

The Joint Regulatory Oversight Committee has published a joint paper setting out five high-level principles for banks and registered third parties to follow when agreeing a premium Application Programming Interface (API) commercial model:

• Principle 1: Broadly reflect relevant long-run costs of providing premium APIs

• Principle 2: Incentivise investment and innovation in premium APIs

• Principle 3: Incentivise take-up of open banking by consumers and businesses and make use of network effects

• Principle 4: Treat TPPs fairly

• Principle 5: Transparent fees and charges

---

#4: What counts as a POS terminal?