New APP fraud reimbursement scheme for CHAPS payments

On 8 May 2024 the Payment Systems Regulator (PSR) published a consultation paper on a proposed new specific direction to all payment service providers (PSPs) directly or indirectly participating in CHAPS to reimburse customers who have been victims of authorised push payment (APP) fraud.

At the same time the Bank of England (BoE), as the operator of CHAPS, published its draft CHAPS reimbursement rules. The PSR’s proposed specific direction will require relevant PSPs to comply with the BoE rules and to report data to the BoE.

The intention of the new requirements is to mirror the protections set to be afforded to victims of APP scams who lose money via the Faster Payments System (FPS) and to provide consistent outcomes, as well as consistent processes for firms, across both payment systems. This intention was highlighted by the BoE in its June 2023 letter, published alongside the PSR’s June 2023 policy statement.

Both the FPS and CHAPS reimbursement requirements are currently due to come into force on 7 October 2024.

Below we summarise the key points arising from the proposed new requirements in respect of CHAPS.

Legal framework

The PSR does not have the same powers under the Financial Services (Banking Reform) Act 2013 (FSBRA) in relation to the BoE as operator of CHAPS as it does in relation to Pay.UK as operator of FPS.

It does have the power under s.54 of FSBRA to issue the new specific direction to relevant CHAPS participants, requiring them to comply with the CHAPS reimbursement rules which the BoE has prepared proactively in any event.

Table 1 of the consultation paper outlines the operation of the legal instruments which together implement the reimbursement requirement into CHAPS, namely:

• BoE CHAPS reimbursement rules – covering:
  • the reimbursement requirements and its scope
  • sharing the cost of reimbursement
  • a time limit to reimburse victims
  • the ability to charge an excess
  • the maximum level of reimbursement; and
  • a time limit for victims to claim.

• PSR specific direction to CHAPS participants
  • Setting out the reimbursement requirement and to whom it applies; and
  • Directing all PSPs within the scope of the direction to reimburse APP scam victims and report data to the BoE.

• CHAPS Compliance Date Reporting Standard
  • Setting out the data that PSPs will be required to report to the BoE.

Overview of the specific direction

The text of the proposed specific direction for CHAPS is set out at Annex 1 of the consultation paper. It is intended to mirror the specific direction for FPS payments (SD20) and comprises the following:

• The reimbursement requirement

(i.e. "When a victim reports a reimbursable CHAPS APP scam payment to their sending PSP, the sending PSP must reimburse the victim in full”).

• The scope of the reimbursement requirement.
• An obligation on both direct and indirect CHAPS PSPs to comply with the BoE’s CHAPS reimbursement rules.
• An obligation on in-scope CHAPS participants to inform consumers of their rights under the CHAPS reimbursement requirement.
• An obligation on in-scope CHAPS participants to report CHAPS APP scam metrics to the BoE, in accordance with the CHAPS reimbursement rules and the CHAPS data standard. This will be broken down into two reporting standards, matching the standards the PSR proposes to add to SD20.
• An obligation on indirect access providers to inform the PSR of any indirect PSP customer they provide CHAPS access to.

In-scope PSPs

To ensure that the same types of PSPs are captured by the CHAPS reimbursement requirement as the FPS reimbursement requirement, credit unions, municipal banks and national savings banks will be out of scope of the new specific direction. The PSR also notes, for the avoidance of doubt (since they do not offer relevant CHAPS accounts) that financial market infrastructures will also be out of scope.

In-scope transactions

CHAPS payments that will be in-scope of the reimbursement requirement will be payments:

• executed with a pacs.008 message
• authorised by the PSP’s consumer
• executed by the PSP in the UK
• received in a CHAPS-relevant account in the UK that is not controlled by the consumer; and
• where the recipient is not whom the consumer intended to pay, or the payment is not for the purpose the consumer intended.

The PSR notes that the specification of pacs.008 messaging clarifies that only retail transactions initiated by consumers will be in scope of the CHAPS reimbursement requirement. The definition of consumer remains the same as in the FPS reimbursement requirement – defined as individuals, charities and microenterprises.

Limitations to reimbursement

The limitations to reimbursement in CHAPS are intended to mirror those in respect of FPS. The BoE intends to include the same claim limits in the CHAPS reimbursement rules, as follows:

• the consumer standard of caution exception (see here)
• a maximum level of excess and reimbursement (being a £100 excess and £415,000 for the maximum level of reimbursement); and
• time limits to claim for reimbursement.

Registering with the CHAPS operator

The PSR is proposing to include a requirement for PSPs to register in line with the BoE’s CHAPS reimbursement rules. Registration will enable PSP details to be included in a contact directory to support them in managing reimbursement claims. The contact directory will be handled by Pay.UK on behalf of the Bank of England.

To avoid duplication, PSPs who are in scope of both SD20 for FPS and the proposed specific direction for CHAPS will only need to register their contact details once. PSPs participating in CHAPS both directly and indirectly will be required to register (where they haven’t already).

Reporting APP scam case data

The BoE will monitor compliance with the CHAPS reimbursement rules within the scope of its contractual powers as CHAPS payment system operator. In order to do so it has developed a data reporting standard, which it has sought to keep the same as for FPS, bearing in mind that typically the same central fraud team within a PSP will handle APP claims regardless of the payment system concerned, and that the nature of the APP scam and the criteria for reimbursement will also be the same across both FPS and CHAPS.

The PSR notes that given the comparatively lower numbers of payments made via CHAPS and of APP scams originating in CHAPS as a result it does not expect that the reporting obligation will represent a significant burden on directed PSPs. Nonetheless to ensure data reporting requirements are proportionate it proposes a phased approach, with Reporting Standard A in place from the proposed go-live date of 7 October 2024, and Reporting Standard B in place from the later of 1 May 2025 or when PSPs are able to access Pay.UK’s reimbursement claim management system.

Separately, the PSR is also proposing to place an ongoing obligation on CHAPS indirect access providers to inform it of all indirect PSP customers they provide access to.

Clarifying the PSR’s expectation on a consumer’s right to reimbursement

As part of the PSR’s consultation published in April 2024 (on compliance and monitoring in relation to the FPS reimbursement scheme), it noted that it was considering amending SD20 either:

• to require PSPs to amend their T&Cs to include a provision that they will reimburse consumers in line with the FPS reimbursement requirement and rules; or
• to make it explicit within SD20 that if a sending PSP fails to reimburse a consumer as required, the consumer will have a right to enforce the requirement and rules to recover the outstanding amount in the civil courts.

In the present consultation, the PSR confirms it is considering the same two options for clarification within the context of the CHAPS requirement and rules, and asks PSPs to confirm whether they hold the same views as in relation to the FPS scheme.

What’s next?

As noted above the proposed go-live date for the CHAPS reimbursement requirement is also 7 October 2024, to coincide with the go-live date for the FPS equivalent.

Any stakeholders still wishing to provide feedback to the PSR on the proposed specific direction and/or to the BoE on the draft reimbursement rules have until this Friday, 31 May 2024, in which to do so. (The PSR’s April 2024 consultation on compliance and monitoring in relation to the FPS scheme also closes today, 28 May 2024). The PSR then expects to finalise and publish the specific direction in September 2024.

Clearly this affords relevant PSPs with a relatively short timeframe in which to consider the CHAPS proposals and prepare for implementation. While it is possible the BoE and PSR may still row back on the go-live date (which forms part of the consultation), this seems unlikely at this stage. The PSR is at pains to emphasise that it is looking to achieve consistency of protection for consumers across payments systems, that most (if not all) PSPs caught by the CHAPS provisions will also be in-scope for the FPS scheme, and that much of the preparatory work for the latter will also apply in the CHAPS context.

Affected PSPs who have yet to respond to the CHAPS proposals can do so by emailing the addresses below before 5pm on 31 May 2024:

• Comments on the BoE’s draft rules to: chapsappfraud@bankofengland.co.uk; and
• Comments on the PSR’s proposed specific direction to: appscams@psr.org.uk.If you would like to discuss either reimbursement scheme and/or APP fraud more generally, please do get in touch.

This publication is intended for general guidance and represents our understanding of the relevant law and practice as at May 2024. Specific advice should be sought for specific cases. For more information see our terms and conditions.