Practical insights for consumers and firms, based on what we've seen over the past year 

Today, 7 October, marks the first anniversary of our authorised push payment (APP) scam reimbursement requirements coming into effect. 

These have helped protect victims of APP fraud, incentivised firms to prioritise fraud prevention, and helped foster trust in financial institutions, helping support the wider UK economy.

The reimbursement regime applies to all qualifying APP transactions, including those made via CHAPS. 

Over the past year, our Supervision and Compliance Monitoring team has worked with firms and Pay.UK to ensure the regime delivers. We thank all firms for their efforts in submitting data promptly and resolving cases efficiently. 

Here we highlight where the industry has made real progress, where challenges remain, and what firms and consumers can do to help ensure our policy continues to deliver positive outcomes. 

Deb Jones, Deputy Managing Director, says:

“The APP scam reimbursement requirements have helped shift the dial on confidence and trust in payments. One year in, we’re seeing real progress, but we’re not standing still. 

“We’ll continue working with firms and Pay.UK to make sure victims are treated fairly and consistently, that fraud prevention remains a priority, and that there is a whole system approach to promote trust in digital payments.”

Information for consumers

If you’re not happy with the outcome of your claim: First complain to your bank or payment service provider (PSP). If still dissatisfied, escalate to the Financial Ombudsman Service via its ‘how to complain’ page.  

Fairness and progress: The APP scam reimbursement requirements have improved fairness for consumers. More victims get reimbursed: data from firms shows that 84% of claims by volume are resolved within five business days, and nearly all are resolved within 35 business days, when additional investigation is required. This marks a substantial improvement in both the speed and consistency of outcomes compared to previous years. Crucially, this means victims are no longer left waiting for extended periods to get their money back. 

As we move into the second year of the policy, our focus remains on ensuring victims are treated fairly, firms maintain high standards of compliance, and trust continues to grow.

Information for firms

Operational standards 

The data firms submit to Pay.UK shows that industry is working well to assess and close claims within the time. Where firms use the full 35-business day timescale, nearly all by volume (97%) are closed within that period. However, it’s important to note that our data reflects only closed cases, so a small number of more complex ones that take longer to resolve may not be included.

The majority of firms (95%) submit accurate data on time. This supports an effective compliance monitoring regime. In line with their Specific Direction 20 obligations, all firms must provide data by the reporting deadline. We are monitoring outliers and ask that all firms regularly review their processes to maintain and improve this performance.

RCA performance

The Reimbursable Contribution Amount (RCA) is the 50% share of the cost of reimbursement that the receiving bank must pay to the sending bank. This is an important part of the regulation. It recognises that it’s fair that the bank that the fraudsters’ account is with should share the responsibility of repaying victims. It also incentivises those firms to make it more difficult for fraudsters to continue holding accounts with them, encouraging firms to invest in fraud detection and prevention. It’s therefore vital that when requested to do so, firms pay their contribution within the timescales. Over £74 million was reimbursed to sending firms between October 2024 and June 2025. 

However, over this period only 67% of receiving firms paid the reimbursement contribution to sending firms within the five-day limit. There are several possible reasons for this: some firms told us that it’s because of difficulties paying within five days rather than non-payment, or that they find it difficult to reconcile the contributions received, as the receiving firms do not always use the correct reference numbers. 

We continue to work with Pay.UK and industry to understand the reasons for the apparently low RCA figures, and whether this is due to late or non-payment of RCAs by some firms. Improving compliance with this part of the regulation remains a priority.  

We reiterate that receiving firms should ensure they pay their RCA within the five-day time limit and firms should ensure they accurately report the contributions they have received.

Reporting requirements

Sending firms must notify receiving firms within two hours and close claims in five business days, if the “stop-the-clock" mechanism (which pauses the time limits for resolving claims under specific conditions) has not been used. If you use a third party for these interactions, ensure you have an alternative in place to remain compliant with SD20 and the reimbursement rules in case the provider fails. SD20 requires PSPs to ensure timely and effective communication, notification, and resolution of claims. It also sets out PSPs’ data, information and reporting requirements.

Our compliance work

We have worked closely with Pay.UK to monitor firms’ compliance with SD20, including reviewing individual firm performance under the consequence management process detailed in the Compliance Monitoring Regime. This has included working directly with firms referred to us under the Regime by Pay.UK.

We have agreed remediation plans with firms, including the introduction of terms and conditions by regulated firms, amended liability provisions for PSPs that receive indirect access, and supported firms to determine their own scope of the requirements. We have also worked with firms and the Financial Ombudsman Service to help them understand the policy.  
 
For support with RCAs or other compliance topics, please contact Pay.UK at enquiries@wearepay.uk. If you wish to contact our Supervision and Compliance Monitoring team, use compliancemonitoring@psr.org.uk. We welcome your queries and feedback.