UK Publishes Draft Legislation to Combat Authorized Push Payment Fraud

The government of the United Kingdom has published draft legislation that would allow payment service providers (PSPs) to delay outbound payments processing by up to four business days when they suspect fraud. 

The delay will give PSPs more time to contact the customer or relevant third parties, such as law enforcement, HM Treasury said in a Tuesday (March 12) policy note.

This will amend the current rules, under which PSPs are required to credit the amount of the payment transaction to the payee’s PSP’s account by the end of the next business day, according to the note.

“This will be permissible only where there are reasonable grounds to suspect a payment order from a payer has been placed subsequent to fraud or dishonesty perpetrated by someone else (excluding the payer) and those grounds are established by no later than the end of the next business day following receipt of the payment order,” the policy note said. 

PSPs will be required to inform their customer of any delays, except in cases covered by anti-money laundering or economic crime law, and will be liable for any interest or charges resulting from the delay, according to the note.

The option to delay payment processing is being proposed to combat authorized push-payment (APP) fraud, in which victims are tricked into sending money to fraudsters, per the note. The U.K. has seen an increase in this form of fraud over the last several years.

“APP fraud has increased both in value and volume, with many individuals suffering significant financial and emotional harm,” the policy note said.

The draft legislation will be open to public comment until April 12 and will then be submitted to Parliament in the summer, according to the note.

HM Treasury aims to have the proposed rules be implemented on Oct. 7, the same day that the Payment Systems Regulator’s new rules on mandatory reimbursement for APP fraud take effect, per the note.

The Payment Systems Regulator said in December that the rule to be implemented Oct. 7 will require banks and other payment firms to reimburse victims of authorized push payment fraud up to 415,000 pounds ($529,671) per incident.

Authorized push payment fraud losses in the U.K. totaled 485.2 million pounds ($619.3 million) in 2022, UK Finance reported in May.