FCA Expectations on APP Fraud Reimbursement Requirement

In this Dear CEO letter, the FCA confirms its expectation that PSPs should be working to reduce APP fraud by improving their anti-fraud systems and controls (noting also that this is also the best way for PSPs to limit their own potential liability). The FCA highlights that such systems and controls, including at onboarding and through ongoing transaction monitoring, help to (i) prevent customers from falling victim to APP fraud, and (ii) identify fraudsters and prevent them from receiving payments. With reference to its good practice publication, the FCA notes that PSPs should:

• have effective governance arrangements, controls and data to detect, manage and prevent fraud;
• regularly review their fraud prevention systems and controls to ensure that these are effective; and
• maintain appropriate customer due diligence controls at onboarding stage and on an ongoing basis to identify and prevent accounts being used to receive proceeds of fraud or financial crime.

In its letter the FCA emphasises that firms will be in breach of the Consumer Duty to avoid causing foreseeable harm where a consumer falls victim to APP fraud because of inadequate systems to detect and prevent scams, or where a firm has inadequate processes to design, test, tailor and monitor the effectiveness of scam warning messages presented to customers. Where a firm identifies that it has caused harm, it must take appropriate action to rectify the situation.

Further, the FCA reminds PSPs of their obligation under the Payment Services Regulations 2017 to provide information about the availability of alternative dispute resolution procedures for payment service users and how to access them as part of their pre-contractual information (which includes informing eligible customers about the availability of the Financial Ombudsman Service).

The new reimbursement rules apply only to payments routed through FPS and CHAPS, meaning that ‘on us’ payments (i.e. payments where both the sending and receiving accounts are held with the same PSP or group) may fall outside of their scope (for example, where payment is executed via an internal channel). In its letter the FCA sets out its expectation that where a PSP intends to apply lower levels of protection to ‘on us’ payments versus payments made via FPS and CHAPS, the FCA be contacted and provided with an explanation of the steps that have been taken to ensure that the PSPs obligations under the Consumer Duty have nevertheless been complied with.

Finally, the FCA sets out that it will be working with the Payment Systems Regulator to monitor for conduct breaches and inadequate systems and controls. In the light of the proposed PSRs 2024, it also intends in due course to gather data from PSPs on payment execution timings.