The Chair of the House of Commons Treasury Sub-Committee on Financial Services Regulations believes there is more work to be done before it will get approved.
Why does this proposal for APP reimbursement seem to be taking longer than expected? Let’s look at the key correspondence from/to this Sub-Committee over the past few months and unpack what is going on.
Back in January, the Treasury Sub-Committee came out with a report: Scam reimbursement: pushing for a better solution. In this report, the Sub-Committee was primarily concerned with the Payment Systems Regulator (PSR) using Section 55 of the Financial Services (Banking Reform) Act 2013 to delegate to Pay.UK the responsibility for managing the APP reimbursement program. They felt that with Pay.UK being an industry body, it could not be sufficiently independent and also Pay.UK is not a regulator. The Sub-Committee felt that the PSR, under Section 54 of the same Act, should direct this reimbursement program. This issue is still outstanding.
The Treasury Sub-Committee has identified some very important questions that will help clarify and strengthen the PSR’s reimbursement proposal. Here are some of the most important questions:
1. What steps has the Bank of England taken to ensure payment system providers are reducing levels of APP scams using the CHAPs payment system? Does the Bank (of England) intend to implement comparable measures (of reimbursement for APP scams) for the CHAPS payment system?
2. Does the FCA intend to implement comparable measures to the PSR’s reimbursement proposals for on-us fraud? And, if so, when? (Note: An ‘on-us’ APP scam is when the sending and receiving bank are the same.)
3. Is the Financial Ombudsman Service’s (FOS) current process appropriate for providing a swift resolution to disputes about APP fraud reimbursement? What steps will you (FOS) take to improve resolution times, and over what timetable?
4. What analysis did you (PSR) undertake to determine that the £100 threshold for reimbursement was the appropriate level?
5. Do you (PSR) expect Pay.UK rules to define “gross negligence”?
Before we look at the answers to these questions, let’s start with a high-level review of APP scam activity/loss by payment channel. On January 9, 2023, the PSR wrote to the Chair of this Sub-Committee and broke out APP scams across all payment channels.
Source: UK Finance 2021 APP Scam Statistics (from PSR January 9 2023 letter to Sub-Committee)
What is key is that the PSR’s current focus is on reimbursement for faster payments. Faster Payments is 86.5% (monetary losses) of all APP scams. CHAPS and BACS combined are 7.4% of the APP monetary losses. ‘On-Us’ (intrabank APP scams) is 1.3% of monetary losses. International APP scams are 4.6% of monetary losses.
We will use this information in the answers to the questions above.
What steps has the Bank of England taken to ensure payment system providers are reducing levels of APP scams using the CHAPs payment system? Does the Bank (of England) intend to implement comparable measures (of reimbursement for APP scams) for the CHAPS payment system?
The Bank of England on February 10, 2023, explained to the Sub-Committee some of the new controls for CHAPS, which the Bank of England oversees. But on APP scam reimbursement, the best the Bank of England could say was “We are committed to achieving the outcomes set out in the consultation, and are in active discussions with HMT (HM Treasury) and the PSR as to how best these can be implemented.” CHAPS has a mixture of corporate and consumer payments. The Bank of England will be focusing on the lower value consumer payments for reimbursement consideration. So, for now, CHAPS consumer transaction scam reimbursement is still an open question.
Note: Separately, BACS is owned and operated by Pay.UK. This includes mainly commercial transactions, but some consumer transactions as well. PAY.UK has not yet been asked by the Sub-committee to comment on APP scam reimbursement on consumer BACS transactions. Also, the CRM Code did not cover BACS payments.
Does the FCA intend to implement comparable measures to the PSR’s reimbursement proposals for on-us fraud? And, if so, when?
On February 13, the FCA responded to the Sub-Committee with “those payment types are included in our work to tackle APP fraud.” But later the FCA states “there is nothing in the Payment Services Regulations 2017 (the “Regulations”) which assigns statutory liability to a PSP (Payment Services Provider) for authorized push payment fraud” (on-us or otherwise). In the PSR proposal requiring reimbursement in September 2022, the PSR acknowledged “our powers do not extend to regulating on-us payments.” So, in effect, the FCA still needs to work with HM Treasury and the PSR, with a possible requirement of more legislative change to formally include ‘on-us’ transactions in the APP scam reimbursement solution.
Realistically, the UK banks may voluntarily include ‘on-us’ transactions once the current PSR proposal is approved by Parliament. This is what the PSR expects as well. But, since the high street UK banks are so large, I also think ‘on-us’ scam transactions could possibly be higher than the previously reported 1.3% (maybe as high as 5-10%). So, on-us payments do need to be formalized as part of the reimbursement program.
Is the Financial Ombudsman Service’s (FOS) current process appropriate for providing a swift resolution to disputes about APP fraud reimbursement? What steps will you (FOS) take to improve resolution times, and over what timetable?
The FOS responded on February 9, 2023, to the Sub-Committee that ‘we have reduced the median wait time from the 6.4 months reported last year to 3.7 months in Q3 of 2022/23.” They further said, “Our ultimate aim over the next two years is to get cases on an investigator’s desk within a couple of days referral and most of those resolved in a couple of weeks.” The FOS goes on to describe seven steps to reduce the median wait time. This includes having dedicated trained teams, along with intelligent automation to improve the speed and decisioning of the FOS reviews.
What analysis did you (PSR) undertake to determine that the £100 threshold for reimbursement was the appropriate level?
The PSR responded to the Sub-Committee on February 14, 2023. They had several key points: 1) lower value scams are harder to detect and the focus should be on mitigating the higher value scams, 2) consumers do need to take/own a certain ‘sufficient care’ in executing these transactions, and 3) the under £100 threshold was only 1% of all APP scam transactions. In addition, TSB Bank told the PSR that “they have not seen evidence of moral hazard or consumers taking insufficient care since launching their guarantee.”
Do you (PSR) expect Pay.UK rules to define “gross negligence”?
The PSR responded in the same February 14, 2023 letter to the Sub-Committee. The response talks about the PSR expecting Pay.UK to 1) monitor the amount of times firms are alleging customer gross negligence, 2) assess if some firms are claiming it more often than others and 3) work with the Ombudsman Service and how they see claims of gross negligence being presented by firms. The PSR further states, “We expect decisions from the FOS to help define gross negligence.” And in the planned PSR policy statement, scheduled for May 2023, the PSR will provide additional guidance on gross negligence. But, for now, there is no definition of ‘gross negligence’, so this could become an issue.
Final Thoughts
So where does all of this leave the PSR’s proposal for APP scam reimbursement? Well, first of all, kudos to the PSR for the significant work they have completed to get the proposal this far along. No other financial regulator in the world has come close to what the PSR has done so far. That being said, there are still some loose ends that need to be tied down. I think these are the key ones:
1. Who will manage the APP scams reimbursement, the PSR or Pay.UK? I think either entity will do a good job, especially when you consider the Financial Ombudsman Service will still be available to review every claim that is turned down by the bank due to alleged gross negligence or first party fraud (the two main reasons a bank can legitimately decide not to reimburse a bank customer). But FOS will need proper staffing for the increased case load (all bank reimbursement rejections) that should occur.
2. Finalizing which APP scams will be covered for reimbursement. As the PSR proposal is currently written, just the faster payments payment rail will be covered (only 86.5% of value/monetary losses will be covered). Not currently covered, but being considered for inclusion—possibly requiring additional legislation, are ‘on-us’ transactions, and maybe consumer BACS and CHAPS transactions. I think International scam transactions will be out of scope for now. I also think the fact that only 86.5% of APP scams are covered by the proposed APP scam reimbursement proposal will surprise some.
3. It would be good to have a target definition of ‘gross negligence.’ The FOS has reviewed enough cases, they should be able to craft a definition for the PSR. One example of criteria would be how many times the customer fell for an APP scam. As an example, on a romance scam, if a customer sends a payment and it alerts the bank and the bank talks to the customer about the payment being a scam. And then two weeks later, the same customer sends two more payments to the same romance fraudster. Is this gross negligence? Or is this the customer still under the ‘psychological spell’ of the fraudster? Is this an elderly victim? Should the bank have alerted on these additional payments?
I think the £100 threshold should be removed. It is only 1% of the total APP scams, and it can fall on the most vulnerable customers. This decision about removing the £100 threshold should also take into account FCA FG21/1: Guidance on the fair treatment of vulnerable customers.
I would push for the 86.5% reimbursement of APP scams (which, according to the PSR, covers consumers, micro-enterprises and charities who fall victim to APP scams over Faster Payments), while the Bank of England, the FCA and others work through the ‘on-us’, CHAPS and BACS. As I said before, the firms should voluntarily reimburse for the ‘on-us’ anyway. It is all within the same bank.
