Achieving widespread coverage of Confirmation of Payee - a PSR consultation
Issue 337 | 6 June 2022
In late May the Payment Systems Regulator (PSR) published a consultation that sets out how the regulator will achieve widespread coverage of the UK’s name-checking service, Confirmation of Payee (CoP).
In this edition of Payments:Unpacked Extra! we provide a quick summary of the consultation together with relevant links to the PSR’s website.
In summary
The PSR are seeking views on their plans that will see around 400 more financial firms provide CoP.
The PSR state that adoption of CoP by around 400 more firms will increase coverage from 92% of transactions made via Faster Payments (FPS) and CHAPS to 99% worth approximately £2.5 trillion.
The consultation sets out the regulators plans to direct approximately 400 financial firms - proposing that this will happen in two groups:
Group 1: The first group (about 50 PSPs) will be prioritised based on the complexity and size of the institution and/or firms where the adoption of CoP could have the biggest impact in preventing APP scams. This first group would see an increase of CoP coverage from 92% of transactions made via Faster Payments to 99%. This group would need to have implemented CoP by 30 June 2023.
Group 2: The second group (in excess of 350 PSPs) includes all other firms which use either unique sort codes, or that are building societies using a Secondary Reference Data (SRD) reference type. This group would need to have implemented CoP by 30 June 2024.
The consultation closes on 8 July, and the PSR plan to set out their final position later in the year. The consultation document can be accessed here: Achieving widespread coverage of CoP.
Background
The UK’s CoP journey started when the PSR issued Specific Direction 10 (SD10) in August 2019 to the six largest banking groups, requiring them to send and respond to CoP requests. This latest (and possibly final?) regulatory development represents the regulators ambition to see the widespread adoption of CoP by more PSPs and a greater number of payment system users benefitting from the protection of CoP.
CoP was designed to help stop some types of authorised push payment (APP) fraud and accidentally misdirected payments by checking whether the name of a payee’s account matches the name and account details provided by a payer.
The new Specific Direction will require approximately 400 payment service providers (PSPs) to implement a system to offer Confirmation of Payee (CoP) to their customers (both as payers and payees).
The original directed banks (SD10 August 2019) covered around 90% of transactions made via Faster Payments and CHAPS. The PSR’s rationale for not going further at that time and directing more PSPs was to ensure CoP was established quickly. Since 2019, a number of non-directed PSPs have voluntarily joined the service, so that there are now a total of 33 PSPs offering the CoP service.
Here at Payments:Unpacked we are pleased to work with some of the very best people in the payments eco-system, with Confirmation of Payee it is our privilege to partner with SurePay.
SurePay’s Confirmation of Payee (CoP) service is an innovative, real-time name checking solution that gives UK payers greater assurance that their payments are going to the intended recipient.
Visit SurePay: Payments made personal, easy and more secure.
Consultation key points
There is, of course, no better solution than to read the full consultation document (especially if you plan to respond) but if time is against you and a high level briefing is sufficient then here are the key consolation points you need to know.
The PSR’s consultation document can be found here: Confirmation of Payee: Requirements for further participation.
Achieving service ubiquity
The PSR are concerned that not all PSP’s that they expected to join the CoP service have done so - stating reasons such as: cost, complexity, reliance on additional information over and above a Sort Code / Account Number and due to the fact that CoP was not a regulatory requirement.
The PSR are concerned about the rise in APP fraud being received by non-CoP PSPs.
The PSR believe that CoP should be implemented widely for Faster Payments and CHAPS and that it should represent a priority for any PSP who has yet to implement.
Customers of PSPs who have yet to implement CoP want to use CoP but some have not got the confidence that their PSP will offer the service.
The PSR are proposing to issue a Specific Direction to require participants to implement CoP to “to achieve our objective for wider adoption of CoP in the UK, and ensure more consumers and businesses are better protected when making electronic payments.”
Group 1 distinguishes PSPs that are larger, more complex and/or are PSPs where the adoption of CoP is likely to have the biggest impact with preventing APP scams and misdirected payments. Group 2 are the remaining PSPs.
The PSR are proposing to direct PSPs to implement both sending and responding capability for CoP requests in respect of setting up payees that can make Faster Payments or CHAPS payments. They are also proposing to require each directed PSP to report to data on losses suffered by its customers as a result of APP scams or misdirected payments, in the 12-month period preceding the implementation of CoP, and for each 12-month period subsequent to its implementation.
There are circa 380 firms listed in the Extended Industry Sort Code Database (EISCD). Of the 380, 33 have delivered CoP which leaves 350 unique Sort Codes plus circa 50 building societies - therefore the proposed Specific Direction will impact circa 400 PSPs who will be mandated to implement CoP.
Some Sort Codes may not meet the PSP criterial in relation to CHAPS and Faster Payments so the numbers may reduce - such PSPs will need to seek an exemption from the PSR if they do not wish to implement CoP.
Addressing complexities
To join the CoP service, a PSP will need to make the technical changes and/or procure a third-party supplier (check out Payments:Unpacked’s CoP partner - SurePay), and Pay.UK and existing CoP participants must ensure they have the resource capability to establish connections with new participants so that they can send and respond to CoP messages to each other.
The PSR state that the on-boarding of the original Phase 1 and Phase 2 participants has not been as fast and effortless as they had wished and state that they “…expect the industry and Pay.UK to work together and understand how processes can be streamlined to ensure PSPs can implement CoP at a more rapid pace. This will ensure that more consumers can be protected from certain types of APP scams and misdirected payments much sooner than existing industry capacity allows.”
The PSR understand that the time required to implement CoP can be significantly reduced if a PSP uses a vendor with an existing live product instead of building a bespoke connection and service. The PSR expect that more IAPs will consider providing CoP product to indirect PSPs in the future.
The PSR expect all directed PSPs to establish and prioritise plans to deliver and use CoP by the respective deadlines set in the direction. If any directed party fails to meet the requirements by the relevant deadline, the PSR state that they will consider appropriate enforcement action, in accordance with their administrative priority framework. In deciding what, if any, enforcement action to take, the PSR may take account of what evidence PSPs can provide on the steps they have taken to plan for and prioritise the implementation of CoP from the date on which the requirement is imposed.
Given the number of PSPs involved, this will require coordination and management of the onboarding process to prevent any sequencing issues or bottlenecks that may arise. The PSR state that they will work with Pay.UK to ensure that PSPs are prioritised appropriately to implement a CoP system.
From Clear Junction to Bank of America (Group 1)
There are a few nuances to PSPs that have been categorised as Group 1 by the PSR. These nuances include a Northern Ireland criteria and if the PSRs analysis indicates that the PSP are vulnerable to receipts of fraudulent activity. PSPs will be included if they fall into one of the following categories:
Direct participants of the Faster Payments system: Faster Payment transactions are carried out either by or through direct Faster Payments participants. As such, we think all Faster Payments direct participants implementing CoP is an important step to reach near ubiquity. Currently there are 40 direct participants of Faster Payments, of which approximately half have not yet implemented CoP.
Indirect and direct PSPs in Faster Payments or CHAPS with a high proportion of fraud: Where our analysis indicates that PSPs receive a disproportionately high level of fraudulent payments compared with the share of FPS transactions they make, this would indicate that these PSPs have been targeted by fraudsters.
‘Large’ indirect Faster Payment participants: as we want to capture larger complex indirect PSPs, we have taken the average of the five smallest PSPs18 that offer CoP in Phase 1 as a benchmark. Any indirect participant that has a higher volume of payments than that threshold has been included.
CHAPS Direct ‘retail’ participants: When we consulted on SD10, we included participants undertaking retail CHAPS payments because CHAPS is used for high- value payments. In this proposal, we have selected based on the value and volume of CHAPS MT10319 customer payments to indicate that a participant undertakes retail transactions – for example, on behalf of customers and not solely wholesale transactions based on financial institutions.
The Northern Ireland banks have been selected as they service a high percentage of the Northern Ireland community.
Group 1 will cover 99% of the Faster Payments transactions by volume and the PSR expect to see a reduction in APP fraud.
Banks assigned to Group 1 by the PSR are listed in Annex 1 of the consultation. From Clear Junction to Bank of America the list includes a diverse but important range of PSPs.
An important point almost lost in the text….
The PSRs analysis has shown that, in terms of volumes, PSPs that have not adopted CoP have seen a rise in fraud being sent to them.
Group 2
The second group is for all other PSPs that have a unique sort code or are building societies. This means that under Group 2, the PSR are proposing to direct all PSPs listed on the EISCD which have not adopted CoP and have not been directed under Group 1, or are authorised building societies.
The PSR state that in view that ahead of Group 2 implementation, alternative solutions, such as the vendor model and more IAPs offering CoP solutions to indirect customers, will result in a significant uplift in the industry’s capacity to implement CoP. Given these anticipated enhancements, the PSR consider one additional year from the Group 1 delivery date will give the remainder of industry the time to implement CoP.
Out of scope PSPs
Whilst the PSR are proposing a specific direction on named individual PSPs meeting the conditions for either Group 1 or Group 2, there are other Head Office Collection Accounts (HOCA) PSPs that the PSR will not direct at this stage. In total there could be more than 1,000 institutions that have indirect access using a HOCA arrangement. The majority of these are small and/or overseas institutions. Some of these will not be using their HOCA arrangement for customer or business payments.
The PSR are not proposing to direct HOCA PSPs beyond building societies at this stage, because the volume of their transactions is small in comparison with those they are proposing to direct. The PSR do not think the industry and vendors would have capacity to onboard that level of PSPs over the period being considered. The regulator could consider further directions after 2024, should evidence indicate that fraud has migrated to specific HOCA institutions, or if these institutions have become larger and more complex.
The PSR are also not intending to direct PISPs as part of this proposed direction, as there is not currently a direct CoP model for PISPs. The PSR state that the Open Banking Implementation Entity (OBIE) has analysed the business case for PISPs developing CoP and that many PISP models would not be consistent with CoP implementation.
Phase 1 PSPs that already have delivered CoP and undertake a number of CoP checks on a daily basis (more than 1 million per day) on behalf of their customers. As such, the PSR are not proposing to put any new regulatory requirements on either the SD10 banking groups or other voluntary Phase 1 PSPs to continue to undertake CoP checks. However the PSR state that the operator of Faster Payments, and potentially CHAPS, may look to include a requirement to undertake CoP checks as part of their participation in those systems.
Third party providers and indirect access providers
The PSR are comfortable that there is now sufficient vendor supply in the market to satisfy the need of PSPs directed to implement CoP.
The PSR states that PSPs will need to avoid a ‘bunched up’ late implementation to fully avoid the potential pressures on the cost of supply.
The PSR has also seen the emergence of IAPs providing CoP products directly to their indirect customers, either by partnering with a third-party supplier or building the functionality themselves. The PSR anticipates that more IAPs will consider implementing a CoP product to indirect PSPs as a commercial offering in the future.
An established feature of the payments journey
Once the directed PSPs have implemented the CoP system and are using it to make checks on behalf of their customers, the PSR believe that, CoP will become an established feature of the payments journey, as it has done so for the SD10 banks.
The PSR expects that once CoP has been established, these PSPs will continue to provide it, without requiring an ongoing regulatory requirement.
The PSR also expect over time that the requirement to do a CoP check becomes part of participation in the relevant systems.
Ensuring the future of CoP
As CoP adoption becomes more widespread with both Faster Payments and CHAPS, the PSR considers that, the operator of Faster Payments, Pay.UK, may wish to consider introducing a rule that requires direct participants in Faster Payments to undertake a CoP check in respect to any new recipients of a Faster Payment.
The PSR also suggests that the Bank of England, as the operator of CHAPS, may also want to consider a rule for retail members of CHAPS. The introduction of such a rule will ensure that PSPs who were once mandated to adopt CoP continue to offer the service and new direct participants will have to offer CoP checking as an access criteria.
Cost benefit analysis
The PSR lists the following benefits of the intended CoP Specific Direction:
Reduction in the level of APP Scam frauds.
Reduction in the level of accidentally misdirected payments.
Reduction in psychological costs to victims.
Competition between PSPs.
The consultation considers the following costs:
Cost of introducing CoP.
Level playing field.
Equality impact assessment
Whilst it is easy to skim over equality impact assessments at the bottom of a regulatory consultation, the PSR’s consultation does cover some interesting aspects of this topic:
Payers
The PSR believe that CoP introduces an appropriate and necessary level of friction for those making payments, because they will need to consider the CoP result. It believes that there is a higher risk of poor outcomes for some people with protected characteristics, including some elderly people and people with certain physical or mental health disabilities.
CoP will make the authorisation of transactions more involved for a payer because they will need to enter the payee’s name correctly. Payers will also need to consider the response to the CoP check, and if there is no match or a close match the payer will need to decide whether to proceed with the transaction at their own risk.
This additional complexity is more likely to affect people with certain attributes linked to protected characteristics. This includes people with cognitive impairment, and those who do not speak English as a first language.
As the provision of CoP broadens because of our proposed direction, these impacts are likely to arise in relation to more people who share these attributes.
Additional benefits include a greater number of consumers relying on CoP warnings, abandoning potentially fraudulent transactions, and strengthening consumer confidence in digital payments.
The PSR conclude that the benefits of expanding CoP to a greater number of consumers outweigh any negative impacts. This includes any that could disproportionately affect people with certain protected characteristics.
Payees
Pay.UK’s CoP rules and standards provide guidance on the categories of vulnerable customer that PSPs may consider opting out. The PSR state that PSPs are expected to follow this guidance.
There are difficulties with complex first and last names – for example, their name may have been rendered from a different alphabet into the Latin alphabet. Under the CoP process, a payer will need to know a payee’s name and how to spell it. Pay.UK’s rules and standards for Phase 2 of CoP specify that, in the case of a close match, the actual name associated with the proposed payee’s account will be returned to the payer. The PSR continue to consider this an appropriate way to deal with close matches and encourage PSPs to ensure their approach to identifying close matches accounts for this issue.
Next steps
The PSR’s consultation document can be found here: Confirmation of Payee: Requirements for further participation. Responses need to be submitted to the PSR by the 8 July 2022.
The PSR will consider all responses to this consultation in deciding next steps. If they decide to proceed with giving the proposed direction, they plan to do so around eight to ten weeks after the deadline.
Want to know more?
Here at Payments:Unpacked we are pleased to work with some of the very best people in the payments eco-system, with Confirmation of Payee it is our privilege to partner with SurePay.
SurePay’s Confirmation of Payee (CoP) service is an innovative, real-time name checking solution that gives UK payers greater assurance that their payments are going to the intended recipient. Visit SurePay: Payments made personal, easy and more secure.
Previous CoP blogs
Northey Point has published a number of blogs on the subject of CoP - here are a selection:
Or search for Confirmation of Payee on our blog: more about CoP.
Help grow Payments:Unpacked’s audience
Grow
If you enjoy reading Payments:Unpacked please share the word with your friends and colleagues - sharing the newsletter makes such a difference to growing the newsletters audience.
Don’t miss out
Avoid FOMO by subscribing to Payments:Unpacked: Unpacking the UK’s payments landscape.
Create your profile
Only paid subscribers can comment on this post
Check your email
For your security, we need to re-authenticate you.
Click the link we sent to , or click here to sign in.