In October 2024, new rules took effect in the U.K. requiring banks to reimburse victims of authorized push payment (APP) fraud up to £85,000. What makes this regulation particularly significant is not just the mandate for near-universal reimbursement, but the introduction of shared liability between the sending and receiving banks. This shift fundamentally changed fraud prevention, holding parties at both ends of a transaction accountable and forcing a more coordinated, system-wide response to scams.

The U.K.’s move quickly captured global attention. Regulators and policymakers across multiple regions are now evaluating similar approaches. In the European Union, for example, liability for scam-related losses is addressed in the latest draft of the Payment Services Directive 3 (PSD3), which is expected to be adopted into law this year, with an 18-month implementation period to follow.

The direction of travel is unmistakable. For fraud and risk leaders, PSD3 represents a forced structural reset, not just another regulatory update.

Below, we break down what you need to know about emerging liability rules and how they could impact your organization. 

Key takeaways:

• PSD3 signals a system-wide shift: The EU is moving toward shared liability, creating a more coordinated approach to fraud accountability across the payment ecosystem.
• Liability becomes shared and complex: PSD3 and PSR move beyond single-party responsibility, creating a web of accountability across banks, PISPs, and other actors, raising new questions around who bears the cost when scams succeed.
• Behavioral intelligence becomes critical: Real-time assessment of customer intent helps distinguish genuine victims from false claims while strengthening fraud defenses and data quality across the ecosystem.

Resources:

• Payment Services Directive: What is PSD3 and PSR?
• White paper: Winning under PSD3: How banks can turn compliance into competitive advantage
• Blog: If PSD3 is a board-level risk, why is ownership still fragmented — and who is accountable?
• Blog: PSD3: What’s new and what’s next?
• Blog: PSD3 at year-end: The deal is done