What are the latest developments in relation to the new mandatory reimbursement scheme for APP fraud and how does the proposed liability on payment service providers reconcile with the recent Supreme Court ruling in Philipp v Barclays Bank UK PLC?

In our September 2023 Fintech Newsletter we had discussed the consultations of the Payment System Regulator (PSR) on APP fraud reimbursement limits and consumer standard of caution.

In the present volume, we have summarised the latest developments in this area and considered how the APP fraud reimbursement requirements reconcile with the Supreme Court’s ruling in Philipp v Barclays Bank UK PLC (judgment given on 12 July 2023).

1. Overview of the new APP fraud reimbursement requirement for UK Payment Service Providers

A. Changes to legislation

The new mandatory reimbursement scheme in respect of APP fraud is provided for in the Financial Services and Markets Act 2023 (FSMA 2023). Specifically, Section 72 of FSMA 2023 amends regulation 90 of the Payment Services Regulations 2017 (PSRs) to enable liability to be imposed on payment service providers where the order is executed subsequent to fraud or dishonesty and is executed over the Faster Payments Service.

As discussed in our previous newsletter, the new reimbursement requirement will:

• require payment firms to reimburse all in-scope customers who fall victim to APP fraud in most cases;
• involve the sharing of costs for reimbursing victims 50:50 between sending and receiving payment firms; and
• provide additional protection for vulnerable customers that will see mandatory reimbursement awards to be given to vulnerable customers within 5 days.

B. Who does it apply to?

• The requirement for reimbursement for victims of APP fraud will apply to all participants in Faster Payments, including indirect PSPs as well as PSPs connected indirectly through indirect access providers (IAPs).
• The scheme is confided to consumers, charities and ‘micro-enterprises’ under the meaning of the PSRs and does not extend to larger businesses.

C. Key components of the reimbursement obligation

• Claim excess: Sending PSPs may apply a claim excess under the new reimbursement requirement. This cannot be applied to vulnerable customers.
• Minimum threshold: There is no separate minimum value threshold for APP fraud victims.
• Maximum level of reimbursement: There is a maximum level of reimbursement for APP fraud claims (by value) under the new reimbursement requirement.

D. Exceptions to the general reimbursement obligation

There will be exceptions to the general reimbursement obligation where:

1. The consumer seeking reimbursement has acted fraudulently (‘first-party fraud’); or
2. The consumer has acted with gross negligence (‘the consumer standard of caution’).

However, the consumer standard of caution would not apply to consumers who have been identified as being vulnerable to a particular scam.

2. What is the implementation date for the new APP reimbursement requirements?

The new requirements on APP reimbursement rules are likely to be introduced by virtue of a PSR’s Specific Direction on Faster Payment Services Participants. However, the implementation date for the new rules is yet to be confirmed.

In its September 2023 consultation paper on a Specific Direction for Faster Payments the PSR had proposed a go-live date of 2 April 2024 but following the reaction received by certain industry participants, this has now been pushed back to 7 October 2024 instead. It is noted that, even though, this is the target date for the implementation of the new rules, this is only a provisional date at this stage that would likely be confirmed in the PSR’s final policy rules that are expected to be published later this year (i.e., in December 2023).

The feedback previously received by industry participants had been that the April 2024 implementation date was not achievable as respondent PSPs said this did not provide them with enough space from the time of the finalised policy and updated Faster Payment Rules being published in December 2023 to operationalise. Most respondents said that they would need between 6-12 months from the publication of the final policy position (consumer standard of caution, excess, maximum level of reimbursement and legal instruments) in December 2023 to prepare themselves for implementation. They also highlighted the absence of a readily available data solution that would support data gathering.

The PSR have stated that the newly proposed implementation (go-live) date of 7 October 2024 would better balance the needs of the industry and the need to provide protection for victims of APP scams given:

• It provides Pay.UK and industry the time to develop their system capability;
• It aligns with the industry’s suggestion that it would need between six to twelve months from the publication of the new rules to prepare for the implementation (go-live) date;
• The PSR believe that by this date they will have had sufficient time from the publication of the policy statement in June 2023, the draft Faster Payments rules in September 2023 and the finalised policy elements in December 2023 to prepare operationally and develop the required systems.

Whilst the PSR understand that this will leave victims of APP scams without protection for longer, the PSR have now expressed the view that implementing the policy too soon has the potential for other negative outcomes for consumers, such as disorderly failures of PSPs and less nuanced de-risking of consumers.

3. Key dependencies and associated timelines for the implementation of the new rules

The PSR have indicated that they key dependencies for the implementation of the new rules are: (i) the development of system capability; (ii) the development of the updated Faster Payment rules; and (iii) the finalisation of the policy rules by the FCA.

We have set out below a table summarising the provisional timeline for the delivery of these key dependencies:

4. The Supreme Court’s ruling in Philipp v Barclays Bank UK PLC

The Supreme court case was focused on the ‘Quincecare duty’. Essentially, this is a duty of care owed by a bank to its customer, requiring the bank, where it has reasonable grounds for believing that a payment instruction given by an agent purportedly on behalf of the customer is an attempt to defraud the latter, to refrain from executing that payment instruction, without first making inquiries to verify the instruction has in fact been authorised by the customer.

In relation to the subject matter of APP fraud reimbursement, the Supreme Court found that the Quincecare duty does not extend to victims of APP fraud because the duty is focused on the duty of the bank to act in accordance with the customer’s instructions; and that is up to the UK Government to navigate policy on APP fraud.

In parallel to this case, and as discussed in our previous newsletter, the government and industry have been making changes to the regulatory framework to address APP fraud risks.

5. What are the practical implications of the Philipp v Barclays Bank UK PLC Supreme Court Ruling and how does this reconcile with the new mandatory reimbursement scheme for victims of APP fraud introduced in the PSRs?

The APP fraud rules coming into force do not appear to be materially affected by the Supreme Court ruling in Philipp v Barclays Bank PLC. In practical terms, the Supreme Court ruling supports the UK Government’s attempts to tackle APP fraud and the facts of the case occurred before the 2019 voluntary code introduced for Contingent Reimbursement which was adopted by only 10 payment service providers at the time.

However, the Supreme Court’s Ruling is still likely to be relevant in to banks in the following scenarios from a liability perspective:

• PSPs that are not participants in Faster Payments (e.g. BACS or SEPA participants) are not, at least in principle, bound by the 50:50 reimbursement standard between sending and receiving payment firms; and
• similarly, the PSR’s fraud reimbursement requirement would not apply in relation to international transfers/payments.

Our Fintech team will be monitoring next steps and shall keep you up-to-speed with the latest developments regarding the implementation of the UK’s APP fraud reimbursement requirements.