APP fraud reimbursement requirement: were industry's concerns justified?

The Payment Systems Regulator (PSR) commissioned an independent evaluation of the APP fraud reimbursement requirement which was published in July 2026. In this article, we explore what that evaluation tells us about the policy's performance in its first year and how its findings measure up against the concerns stakeholders raised before the rules took effect.

APP scams occur when a fraudster, posing as a genuine payee, tricks someone into authorising a payment to their account. Before October 2024, victims relied on a voluntary code (the Contingent Reimbursement Model) that left protection patchy across the market. But from 7 October 2024, Payment Service Providers (PSPs) using Faster Payments and CHAPS had to reimburse eligible victims, with liability split equally between sending and receiving PSPs.

The PSR commissioned an independent evaluation of the performance of this policy to see whether it changed PSP incentives and behaviour and whether this affected the incidence of fraud and consumer outcomes. 

The evaluation's headline finding is that short term quantifiable benefits have outweighed costs in the policy's first year. APP fraud fell by 21%, equivalent to £73m annually, while reimbursement rates climbed from 54% to 65%. This represents a net benefit to the market of £17m to £29m in year one alone. The long term impacts on service quality, innovation and economic growth remain uncertain and there is limited evidence to address stakeholder concerns regarding barriers to entry, competition and reduced service provision amongst some customer segments. The evaluation also looked at the impact of performance data publication and found it increased transparency and helped PSP internal benchmarking. However, there is limited evidence that it directly changed PSP fraud prevention activity or reimbursement behaviour. 

In contrast, UK Finance, a banking and finance trade organisation, reported a 19% rise in APP fraud in 2025. This gap was driven by the different measurement choices. The evaluation counted scams by the date they occurred; UK Finance counted by the date a claim closed. Long-running scams, such as romance and investment fraud, take months or years to surface and tend to be higher-value. Thus, the evaluation may exclude such long-term scams since data on these may not be available in the first year after policy implementation.

APP fraud reimbursement: what the PSR set out to do, and key concerns from industry

Four outcomes sat behind the PSR's policies: reducing APP fraud, improving victim protection, creating effective incentives for payment firms, and increasing confidence in Faster Payments. The evaluation was designed to assess the extent to which these outcomes had been achieved. The reimbursement requirement aimed to ensure victims are repaid, split costs evenly between sending and receiving firms, and protect vulnerable customers. Performance data publication aimed to increase transparency and sharpen firms' incentives to act.

During consultation, PSPs and trade bodies raised concerns across several fronts. The PSR promptly acted on some. The proposed 48-hour reimbursement window became five business days after industry warned it was unworkable for firms without round-the-clock operations. The separate minimum claim threshold was scrapped entirely, folded into the optional claims excess to avoid confusing customers with two figures. And a maximum reimbursement cap, set at £415,000 in December 2023, was revised to £85,000, aligning with existing protections like the Financial Services Compensation Scheme. The PSR estimated that cutting the cap would reduce mandatory reimbursement coverage by around £30 million a year. The evaluation finds the actual figure is far lower. Of the £5.3 million not voluntarily reimbursed above £85,000, £4.9 million sat below the once-proposed £415,000 limit, so would have been reimbursed under the higher cap. That said, longer-lag scams like investment fraud aren't yet in the data, and those are exactly the higher-value cases where the cap bites. The gap could narrow as more data comes through.

Other themes raised by stakeholders are set out below.

Bankruptcy risk for smaller firms: Several PSPs argued the policy could threaten their financial viability, particularly those with high fraud exposure and thin margins. The PSR pressed ahead, judging that consumer protection outweighed this risk.  The quantitative analysis in the evaluation does not suggest that there is immediate threat to firm viability and the evaluation found no clear evidence that the policies have caused material market harm to date. However, findings from stakeholder interviews and PSP survey consistently suggested that the financial impact is more acute for smaller or growing PSPs, with some evidence smaller firms are seeing a material impact on margins.

No focus on where scams originate: Industry argued most APP fraud starts outside the payment system, on social media, tech platforms, and telecoms. According to the PSR’s own research, Meta platforms were linked to 54% of 2023 scam incidents and 18% of losses. Telecoms, meanwhile, were linked to just 12% of cases but 31.5% of losses. Yet the reimbursement requirement only reaches the payment leg of the fraud chain. The PSR has called on tech, telecoms, and social media firms to help close these gaps, but has no powers to compel their cooperation.

Moral hazard: Industry argued reimbursement would make customers less careful, and could tempt some to file fraudulent claims themselves. Consumer groups pushed back, pointing to firms that already reimbursed without seeing this effect. The evaluation found no evidence either had happened at scale.

What the APP fraud evaluation answers, and what it leaves open

The evaluation noted that the policy had a positive impact. David Geale, the PSR's managing director, put it plainly: "The evidence is clear – APP reimbursement is working. Payment fraud losses are down, more victims are being reimbursed, and firms are investing in prevention." Additionally, the evaluation found that the policy strengthened incentives for PSPs to invest in fraud prevention, with the largest fraud reductions among firms that previously had the highest fraud rates.

However, notable variation persists in the reimbursement rates and non-reimbursement costs incurred by PSPs. Reimbursement rates following the policy ranged from 21% to 94% between PSPs, a spread the evaluation attributes partly to genuine differences in practice, rather than reporting inconsistency alone. This divergence isn't limited to headline reimbursement rates. The evaluation found firms applying the consumer standard of caution exception very differently: one firm applied it to over a quarter of cases by value, while others didn't apply it at all. Treatment of the optional excess, vulnerability assessments, and reimbursement above the cap was similarly inconsistent across firms.

The headline figures highlight that estimated total annualised reimbursement paid by PSPs market-wide has not changed since the implementation of the reimbursement requirement as the increase in reimbursement rates is offset by the overall reduction in fraud. However, the evaluation found that changes in reimbursement costs varied sharply by firm, ranging from a reduction of £14m to an increase of £18m in one year. Therefore, the cost of this policy has not been felt equally across the market. Most firms saw reimbursement costs fall or rise by less than 0.5% of revenue, but three firms saw materially larger increases, including one equivalent to 2.6% of revenue. Although the market, as a whole, appears to have absorbed the cost in the first year, some firms have been materially affected, and this may have implications for viability over the longer term. The significant level of variation observed suggests any future risk may be concentrated in specific market segments.

A related but separate concern is displacement. The evaluation states that international APP fraud losses rose by £39m between 2023 and 2025, and losses to crypto exchanges increased more than two-and-a-half times over the same period, from approximately £59m to £153m. Displacement may occur as the reimbursement requirement strengthens firms' incentives to tighten controls on the payment rails it covers, but it doesn't directly deter fraudsters from operating at all. Channels outside its scope, cross-border payments and crypto exchanges among them, may be an easier target, so fraud may be shifting rather than being prevented. There is some evidence that smaller PSPs may have had to divert investments from out-of-scope fraud prevention to actions focused on reducing in-scope fraud. This speaks to industry's argument that most APP fraud starts outside the payment ecosystem. The scam-type breakdown discussed earlier, reinforces why it remains live: romance, purchase and investment scams are typically initiated through telecoms, tech platforms, and personal connections. Although the evaluation does not directly attribute the changes in out of scope fraud to the introduction of the reimbursement policy, it does note that this is plausible for the increase in international APP fraud. If this activity is classified as displacement, then the net impact of the policy in the first year would be negative. 

This warrants an important caveat: the evaluation is short-term by design and heavily qualified throughout. It covers only the first twelve months of the policy's implementation. It measures fraud by transaction date rather than claim date, which structurally under-represents slower-emerging scams. The evaluator acknowledges this limitation directly: unreported cases could add a further £18m annually to the fraud-reduction estimate once fully captured, while additional international fraud displacement could add a further £39m a year in costs. Taken together, these two adjustments imply a net benefit of -£4m to £8m, rather than the £17m to £29m headline figure.

Against the three concerns raised in consultation, the evaluation gives a mixed picture. On bankruptcy risk for smaller firms, the cost impact was concentrated in a few firms and material for at least one, so the risk has not been ruled out. Throughout the evaluation, stakeholders continued to raise concerns that higher fixed costs and liability exposure may create barriers to entry and favour larger incumbents with stronger capital buffers and highlighted that the policies may have opportunity costs for non-fraud prevention innovation. To date, there is no evidence to support these concerns, however the longer term impacts will only become evident over time. On the focus of where scams originate, the evaluation supports industry's concern: most fraud still starts outside the payment ecosystem, and the PSR cannot compel other sectors to act. The bigger concern to emerge, though, is displacement rather than origination: fraud is shifting into channels the policy does not reach at all, with losses to international payments and crypto exchanges both rising sharply since 2023. On moral hazard, the evaluation found no evidence of it at scale.

The APP fraud policy review: your window to influence the rules

Beyond delivering its short-term objectives, the evaluation leaves several themes for the PSR to address going forward. The most prominent is the reimbursement requirement's narrow scope: it places responsibility on PSPs while most fraud originates on platforms and telecoms channels outside the financial sector. Consistency of outcomes across firms also remains unresolved, with reimbursement rates and application of exceptions still varying materially by PSP. Displacement of fraud into international payments and crypto exchanges is a live risk to the policy's net benefit, though its scale can't yet be quantified, and the evaluation did not directly measure whether confidence in Faster Payments has improved. Longer-term effects on competition, innovation and market structure are also flagged as untested, since the evaluation covers only the first year. 

This independent evaluation was a starting point, with the PSR confirming the scope of its planned work for a formal policy review.

This review is structured across four stages: the PSR's response and the start of stakeholder engagement in July 2026; continued engagement with industry and consumer representatives running through the summer and into August; a formal consultation opening in December 2026, covering policy parameters, data requirements, and consumer outcome consistency; and a decision with revised legal directions in May 2027, with implementation due within six months of that.

Source: PSR APP Scams Policy Roadmap

The PSR has already delineated specific topics to receive feedback from the stakeholders. Three areas are explicitly in scope for the December consultation

1. how claims that drag past 35 business days should be treated
2. how "returns from investment" are handled under the policy, a point aimed squarely at investment scams
3. greater consistency on the consumer standard of caution, civil disputes, and me-to-me transactions.

Of these, only the consumer standard of caution is an area where the evaluation found firms applying the rules inconsistently; civil disputes and me-to-me transactions are areas the PSR has flagged for further clarity, rather than ones the evaluation showed being applied unevenly.

Separately, the PSR intends to consult on new annual reporting requirements covering the platforms and services that fraudsters use to reach victims, extending its data-transparency approach beyond payment firms and into the wider ecosystem.

This matters most for the concerns that weren’t fully resolved in the evaluation. Cost proportionality for smaller firms, consistent treatment of vulnerable customers, and accountability for fraud originating outside the payment system are all still live.

Where firms should prioritise:

• Firms carrying disproportionate reimbursement costs, or with a view on how "returns from investment" should be defined, have a concrete and timely opportunity to make that case directly – not as a general grievance, but against a specific, published question the PSR is asking.
• Firms with a view on how claims, costs, or scope should evolve should use the PSR's stakeholder engagement period, running through summer 2026, to make their case directly, before the December consultation is drafted rather than after.

If you’d like to discuss any of these topics further, please get in touch with Tom Middleton.