Miscellaneous Liability of payment service providers for fraudulent transactions
The value and volume of "authorised push payment" (APP) scams has increased significantly in recent years. An APP scam occurs when someone is tricked into making a payment to a fraudster under false pretences, for example, where someone is deceived into authorising a payment to a person for something they believe at the time is a legitimate purchase.
	APP scams are different to unauthorised payment fraud, where money is taken from someone’s account without their knowledge or consent. Victims of unauthorised payment fraud are protected by legislation, with statutory requirements on payment service providers (for instance, a payer’s bank) to reimburse victims for the losses they incur under such circumstances.
	Although no statutory reimbursement requirement exists for APP scams, some payment service providers have made voluntary commitments to reimburse APP scam victims in certain circumstances, including by signing up to a voluntary contingent reimbursement model code that sets a framework for how liability should be apportioned when a scam occurs. The varying approaches to reimbursement by payment service providers have led to inconsistent levels of protection for APP scam victims, based on which payment service provider they use, and how the payment service provider interprets any voluntary commitments to a customer when an APP scam occurs.
	The Payment Systems Regulator (PSR) regulates designated payment systems and their participants (including banks and other payment service providers). In 2021, the PSR published a Call for Views , and subsequent Consultation , on APP scams. In these documents, the PSR proposed options to address the problem, including requiring participants in the Faster Payments Service to reimburse APP scam victims. The vast majority of APP scams occur over the Faster Payments Service, as it is the principal payment system which payers use to make instant credit transfers.
	The PSR has stated that there is at present a legislative barrier in the Payment Services Regulations 2017 preventing it from using its regulatory powers to implement mandatory reimbursement. Specifically, regulation 90(1) of the Payment Services Regulations 2017 provides that where a payment service provider (for example, a bank) has executed a payment in accordance with the unique identifier (for example, the sort code and account number) provided by the payer, then the payment is deemed to have been correctly executed, and so the payment service provider cannot be liable for defective execution.
	In November 2021, the Economic Secretary to HM Treasury made a statement that the government would legislate to address any barriers to regulatory action on this matter. In May 2022, the government published a policy statement setting out further detail on this policy approach.
	This Act amends the Payment Services Regulations to clarify that nothing in regulation 90 affects the liability of a payment service provider where the PSR has exercised its regulatory powers in relation to APP scams. This will enable the PSR to use its regulatory powers (whether in relation to payment system operators, payment service providers, or in combination), to require mandatory reimbursement by payment service providers in cases of APP scams.
	The Act also places a duty on the PSR to take regulatory action on APP scam reimbursement by participants in the Faster Payments Service, by requiring the regulator to consult on a draft regulatory requirement, and impose a regulatory requirement, within two and six months respectively of the legislation coming into force.