On 8 October 2024, the Financial Conduct Authority (FCA) published two Dear CEO letters, sent to banks and building societies and to payment and e-money institutions, in which it sets out its expectations on authorised push payments (APP) fraud reimbursement. The Payment Systems Regulator’s (PSR) reimbursement requirement for APP fraud carried out through the Faster Payments System and CHAPS came into force on 7 October 2024 (the date of the Dear CEO letters).
In the letters, the FCA sets out its expectations relating to the new measures, the role of the Consumer Duty and what firms can expect from the FCA through a data-led approach to monitoring progress. In-scope firms that have not already done so are asked to ensure they have appropriate oversight, systems and controls in place to comply with these requirements.
The FCA’s expectations
In relation to anti-fraud systems and controls, both letters highlight that payment service providers (PSPs) should be working to reduce APP fraud by improving their anti-fraud systems and controls, including at onboarding and through ongoing transaction monitoring. In particular, the FCA reminds firms that PSPs should:
- Have effective governance arrangements, controls and data to detect, manage and prevent fraud.
- Regularly review their fraud prevention systems and controls to ensure that these are effective.
- Maintain appropriate customer due diligence controls at onboarding stage and on an ongoing basis to identify and prevent accounts being used to receive proceeds of fraud or financial crime.
On the Consumer Duty, the FCA reminds firms that they must:
- Avoid causing foreseeable harm – for example, a consumer becoming victim to a scam relating to a firm’s financial products due to the firm’s inadequate systems to detect and prevent scams, or inadequate processes to design, test, tailor and monitor the effectiveness of scam warning messages presented to customers.
- Where they identify that they have caused customers harm (either through action or inaction), act in good faith by taking appropriate action to rectify the situation, including considering whether remedial action such as redress is appropriate.
In relation to information, PSPs are reminded that the Payment Services Regulations 2017 require them to provide information about the availability of alternative dispute resolution procedures for payment service users and how to access them as part of their pre-contractual information. This includes informing eligible customers about the availability of the Financial Ombudsman Service.
The letter to CEOs of payment and e-money firms also flags the FCA’s expectations on capital and liquidity, noting that PSPs should recognise and manage their potential liability and the impact this may have on their capital and liquidity. The FCA expects PSPs to review and adjust their business models and transactions to mitigate against any risk of prudential impact that may result from potential APP fraud reimbursement liabilities.
The FCA also flags that it expects firms to ensure their approach to “on us” APP fraud – also known as internal book transfers or intra-firm payments – meets their obligations under the Consumer Duty. If a firm is planning to provide a lower level of protection to “on us” APP fraud reimbursement compared to payments made through FPS and CHAPS, they should contact the FCA to provide an explanation of the steps they have taken to meet those obligations.
What the FCA and PSR will do
The letters explain that the FCA and PSR will work together to monitor firms’ compliance with the reimbursement regime. They plan to use data arising from the reimbursement regime to monitor for prudential issues, conduct breaches and inadequate systems and controls and ensure that it is effectively protecting consumers against APP fraud without adverse impacts on the broader payments system.
As part of the process for monitoring PSPs’ implementation of the payment delays legislation, the FCA is also looking to gather data from PSPs on payment execution timings to assess the level of additional friction in the system, and values and volumes of delayed payments under the new statutory instrument.
Next steps
The FCA reminds CEOs of their ongoing obligations to notify it without undue delay of any material changes in their firms’ circumstances, including significant systems and controls and/ or prudential issues.