PSR Consultation Paper ‘Authorised push payment scams’ (CP21/10)  Innovate Finance response

About Innovate Finance

Innovate Finance is the independent industry body that represents and advances the global FinTech community in the UK. Innovate Finance’s mission is to accelerate the UK's leading role in the financial services sector by directly supporting the next generation of technology-led innovators.

The UK FinTech sector encompasses businesses from seed-stage start-ups to global financial institutions, illustrating the change that is occurring across the financial services industry. Since its inception in the era following the Global Financial Crisis of 2008, FinTech has been synonymous with delivering transparency, innovation and inclusivity to financial services. As well as creating new businesses and new jobs, it has fundamentally changed the way in which consumers and businesses are able to access finance.

Introduction

Innovate Finance welcomes the opportunity to respond to the Payment Systems Regulator’s (“PSR”) Consultation Paper ("CP21/10") regarding Authorised Push Payment (“APP”) scams. Innovate Finance recognises both the growing challenge that APP scams pose for the industry, and the importance of there being a comprehensive approach to tackling these scams which result in financial detriment to consumers. Combatting economic crime, and online scams in particular, is critical to building the trust and safety on which innovation flourishes and adoption amongst consumers and businesses depends. Innovate Finance members are therefore deeply committed to tackling scams.

In reviewing the consultation paper and producing our response, we have consulted with a range of Innovate Finance members that provide payment services, including established and new neobanks, and others who are indirectly impacted or may fall within scope in future.

While Innovate Finance is supportive of the PSR's intended aims of preventing APP scams from taking place, and ensuring victims who have exercised sufficient caution have their money returned, we do not agree that the PSR's proposals will drive these outcomes. Innovate Finance is concerned that the proposals drive a number of unintended consequences, which we set out below and explore in our response.

We strongly urge the PSR to act in concert with other financial services regulators, government, law enforcement and industry to develop a strategic approach to APP scam prevention 1. Innovate Finance considers this is the only way in which to truly tackle the issue at source. As such, we would strongly encourage the PSR not to act in isolation and to reconsider the introduction of the proposals in CP21/10.

Innovate Finance would be pleased to discuss this response in more detail with the PSR and/or facilitate discussions directly with our members.

Prevention of APP scams requires an ecosystem-wide approach with joined-up efforts across financial services regulators, government, law enforcement and industry

Prevention of APP scams is one of the main policy outcomes the PSR intends to advance through its proposals; however, Innovate Finance considers that the proposals only broadly address the downstream consequences of these scams.

Innovate Finance is concerned that making Payment Service Providers (“PSPs”) solely responsible for compensating victims of APP fraud distorts incentives. The onus should be on all players in the APP scams ecosystem — including technology and telecoms firms — to stop scams at source before they adversely impact consumers.  UK Finance analysis has shown that 70% of authorised push payment scams originated on an online platform including fraudulent advertising through search engines and social media, and fake websites. We welcome the inclusion of measures to combat user-generated fraud in the Online Safety Bill and we strongly support the parliamentary pre-legislative scrutiny Joint Committee’s recommendations to include paid for digital advertising within the scope of the Draft Bill and ensure the public are properly protected from this illegal activity.  Innovate Finance are members of a coalition of consumer groups, charities and industry bodies which has called for the Bill to include measures on fraud via paid-for digital adverts. The FCA, Bank of England, City of London Police, Work and Pensions Committee and Treasury Committee, have all also called for the Online Safety Bill to include fraud carried out via online advertising. Even with the inclusion of paid digital adverts in the Online Safety Bill,  it will be a number of years before we can determine if it has led to an impactful reduction in the number of APP scams originating on these platforms. The economic burden should not be solely borne by PSPs, in the interim.

Further action is also needed to improve intelligence sharing, where the principle barrier is the current legislative framework (e.g. PSPs are constrained from intelligence sharing due to concerns over client contract and confidentiality duties as well as data protection law), and legislative amendments are needed from the government to better allow firms to share intelligence about fraud (in addition to information about money laundering). A further barrier to intelligence sharing identified by smaller members in the FinTech ecosystem is the limits on participation in the Joint Money Laundering Intelligence Taskforce — which is a matter for the National Economic Crime Centre ("NECC"). As part of our calls for a joined-up approach to addressing economic crime prevention, we would encourage the PSR to collaborate with the other agencies that form part of the NECC.

Tackling this very serious criminal activity, which creates significant harm to citizens, calls for  a more comprehensive and strategic approach across government, regulators, technology platforms, telecoms firms, and law enforcement agencies. The downstream ‘sticking plaster’ set out in the PSR proposals will not combat the criminals or clamp down on this criminal activity. Innovate Finance calls on the PSR to collaborate with other regulators, law enforcement, government and industry to develop and publicly share a long-term and strategic approach to addressing the prevention of APP scams.

Proposals create barriers to entry, and lessen the attractiveness and international competitiveness of the UK market

There is no evidence in the cost-benefit analysis that the impacts on the start-up and scale-up ecosystem have been fully considered. The PSR’s proposals translate to significant increases in operational costs for PSPs and while incumbents may be able to absorb the costs associated with data reporting, mandatory reimbursement and an uptick in Financial Ombudsman Service (“FOS”) cases, through cross-subsidisation or other means, they pose a real barrier to prospective market entrants.

Mandatory reimbursement proposals in particular represent a significant risk to early stage, venture capitalist funded and pre-profit businesses that do not have the financial resiliency to reimburse significant sums. Mandatory reimbursement costs are estimated to be the equivalent of wiping — at minimum — a tenth of PSPs' revenue, according to data points drawn from our members and the wider FinTech ecosystem.

The ramifications of these proposals for the FinTech ecosystem cannot be underestimated: they pose a material barrier to entry and adversely impact existing start-ups and scale ups' ability to remain economically viable in the UK market. In this respect, Innovate Finance considers that the proposals do not promote innovation or competition in the payments sector. Further, the proposals also lessen the attractiveness and international competitiveness of the UK financial services sector, which goes against the recommendations articulated in the Kalifa Review.

Proposals have a detrimental impact on investment in FinTech in the UK

If implemented, the UK will be the only country in the world that has mandatory reimbursement for APP scams. This will have a direct and detrimental impact on investment in FinTech in the UK. International investors will be disincentivized from investing in UK neobanks and other payment services providers if they know that a sizeable portion of their investment will potentially be lost on reimbursements that they will not suffer in any other territory.

Proposals create the potential for more financial exclusion

There is a risk that the data metrics and associated reputational impacts, as well as mandatory reimbursement proposals, could incentivise some PSPs to apply increasingly stringent criteria when deciding whether or not to allow a customer to open a current account. Firms may also be less likely to continue to provide services to those at high risk of falling victim to scams — particularly those who may have characteristics of vulnerability. This would be a patently unacceptable outcome, at odds with UK financial services regulators and government's efforts to boost financial inclusion.

Proposals will negatively impact consumers' user experience and diminish the benefits of the Faster Payments Service

Innovate Finance is concerned that the PSR has not fully assessed the operational impacts and realities of the reimbursement proposals, as our members consider that the proposals incentivise a slowing of all customer payments. PSPs are mindful of the existing levels of friction in the payments journey, and if PSPs had to reimburse every UK-based APP scam, then there would be an incentive for PSPs (particularly those which operate globally, where the UK makes up a small proportion of the customer base and revenue) to significantly slow payments for all customer payments in order to take additional steps to detect and investigate potential fraud.

This naturally gives rise to poor user experience, and slowed payments also negate the benefits of Faster Payments that Innovate Finance members and the UK government champion. We would reiterate the Economic Secretary to the Treasury's comments (See response to Q430) that consumers do not wish to see slower payments, and the focus should be on prevention.

Proposals may inadvertently increase the total amount of fraud and attractiveness of the UK as a market of choice for scammers

The PSR's mandatory reimbursement proposals set the UK apart from other global jurisdictions. The UK would be the only country in the world with mandatory reimbursement, and if proposals take effect then our members anticipate more organised criminal gangs will be attracted to the UK and its consumers, creating an uptick in APP fraud levels.

Innovate Finance members' experience shows that the UK is already the jurisdiction of choice for international scammers — for example, the UK is c. 20% of one member's customer base but has 60% of total fraud cases — this is due to a variety of reasons, including the English language, high adoption of technology (e.g. e-commerce, social media use, etc), faster payments and high rates of mobile banking.

Innovate Finance  members' experience has also indicated that organised gangs are exploiting the FOS' approach to money mule cases and are actively targeting UK-based PSPs. And data from CIFAS points to the majority of all money mule cases originating via online platforms.

As well as organised criminal gangs taking advantage of the UK's approach, mandatory reimbursement proposals may also lead to an increase in first-party fraud, particularly if purchase scams remain within scope.

It is unclear what shape the evidential framework for mandatory reimbursement will take, as well as the threshold for triggering reimbursement from PSPs — if the PSR is minded to proceed, we would call on the PSR to convene an Evidential Standards Working Group to explore these issues to ensure consistency of approach amongst PSPs, and mitigate the risks of first-party fraud.

1. Do you have comments on our proposed data metrics?

Innovate Finance considers that the only way in which to deliver fully the intended policy outcome of prevention of APP scams is for regulators, government and law enforcement to develop a strategic, ecosystem-wide approach to tackling the issue. The onus should be on all players in the APP scams ecosystem — including technology and telecoms firms (c.70% of APP fraud originates via tech and telecoms) — to stop scams at source before they adversely impact consumers. In this respect, Innovate Finance remains concerned that the PSR's data reporting proposals will not address the issue at source, and may have unintended consequences.

If the PSR is minded to proceed with these proposals, we would call on the regulator to:

• pilot and closely monitor the impact of data reporting;
• drop the requirement that Metric C data be published;
• exclude purchase scams from the scope of reportable data metrics;
• adapt reportable data metrics to include a breakdown by scam typology; and
• partner with the industry to develop detailed guidance and technical standards to ensure the reported data is robust.

We unpack each recommendation in turn, below.

Pilot and closely monitor the impact of reporting

Innovate Finance is extremely concerned that the reported metrics will highlight to fraudsters any weaknesses in controls across the industry. We are unconvinced of the PSR's view that, due to the delay in publication of metrics, firms will have sufficient time to remediate any weaknesses in their controls.

It is already commonplace for scammers to simultaneously and intensively target one or two firms in the payments ecosystem for months at a time. The scammers learn the firms' controls, and use this to tailor their social engineering, which often leads to a cluster of victims from one or two PSPs who have all fallen victim to similar scams. The publication of Measure 1 data creates a risk that this kind of pack mentality on the part of fraudsters is exacerbated and could drive a material uptick in the occurrence of APP scams.

If the PSR is to proceed to give effect to these proposals, Innovate Finance strongly recommends that the PSR collaborate with industry to pilot the data reporting measures and robustly analyse the impacts before mandatory reimbursement requirements come into play. A pilot would allow the regulator and industry time to spot any adverse effects, and pause the data sharing (or consider alternative approaches, such as aggregated data sharing) to remediate the unintended consequences of placing this data in the public domain.

The PSR should not put itself in a position where it feels unable to pivot away from this kind of intervention — ultimately, the proposal is the first of its kind (firms are not required to publicly highlight their money laundering weaknesses, for example) and the proposals should be given appropriate time to be tested before becoming a standard requirement for all PSPs.

Drop the requirement that Metric C data be reported

Innovate Finance urges the PSR to drop the requirement that Metric C data be reported. Innovate Finance does not consider that the publication of recipient PSP data is helpful for consumers: it does not affect the service they receive from their PSP. The only rationale for the publication of this data would be to ‘name and shame’ participants with high rates of money muling, while introducing a clear risk that scammers will exploit this data. Even now, scammers are sophisticated enough to identify PSPs that are easier to dupe into receiving scam transactions — with Metric C data in their hands, it will be even easier for scammers to coalesce around and target one or two PSPs that are perceived to be weaker than their peers.

While we understand that the risks related to the publication for Metrics A and B may be justified through close monitoring of any spikes in scam levels for the participants deemed the weakest, as consumers may benefit from this data, Innovate Finance struggles to see the rationale for the publication of Metric C data.

The PSR should be satisfied that it can intervene to improve money muling controls. This ‘incentive’ is a blunt tool, and PSPs may lean on increasingly stringent requirements to access bank accounts, exacerbating financial exclusion.

Exclude purchase scams from the scope of reportable data metrics

In response to Question 18, Innovate Finance outlines the reasons why we strongly consider that purchase scams must be excluded from mandatory reimbursement. There is enough evidence to warrant that purchase scams be excluded from the scope, and a separate proposal developed for tackling these scams as part of the wider consumer protection work the PSR is proposing, in conjunction with the regulator responsible for implementing the new framework introduced under the Online Safety Bill.

Innovate Finance recommends that as purchase scams should not be included in mandatory reimbursement, the data metrics reported should be limited to the scam types for which industry is able to provide protection i.e. scams involving life changing sums of money that cross industry initiatives and PSPs are developing significant and effective controls to tackle.

Adapt data metrics to include a breakdown by APP scam typology

The APP scam landscape is complex and there are many different types of scams. Both the PSR and Lending Standards Board (“LSB”) agree that there are eight types of APP scams. Each type of APP scam has different characteristics, typologies and refund rates. For example, the proportion of customer losses reimbursed for police or bank impersonation fraud is nearly double that for advance fee fraud, despite the average gross loss being within the same scam value band (£1000 - £5000).

Furthermore, PSPs are likely to have different relative volumes of scam types due to different use patterns and varying customer demographics. For example, PSPs which are used as secondary discretionary spending accounts will likely have a larger proportion of purchase scams than PSPs which are primary accounts, who will have a larger proportion of investment scams.

Therefore, a customer would be unable to accurately compare the ‘performance’ of PSPs based on the proposed metrics (scam value bands) alone. As such, Innovate Finance recommends that the proposed data metrics are adapted so that the metrics are broken down by scam type as well as scam value bands. Innovate Finance suggests that the PSR uses the definitions and scam typologies which are reported by UK Finance.

Partner with industry to develop detailed guidance and technical data standards

From an operational perspective, Innovate Finance recommends that the PSR works in partnership with industry to develop detailed guidance and technical data standards to ensure that the reported data is robust. For example, without clear technical standards and guidance there is a risk of multiple PSPs reporting on the same case(s) of APP fraud (given multiple actors, accounts and transactions may be involved), creating data which is not accurately representative.

Regulatory technology

Additionally, from an operational perspective, Innovate Finance recommends that the PSR works in partnership with industry to explore technology-led ways in which to comply with any reporting requirements. Technical data standards should allow for model-driven, machine-readable collation and reporting.

1. Do you have comments on the proposed scope of payments included in Measure 1?

Innovate Finance understands the rationale for the scope of payments included in Measure 1 to be focused on authorised push payments to UK recipients made by Faster Payments.

1. Do you have views on the scam value bands for Metric A data? Innovate Finance has no objections to the proposed value bands.

1. Do you have any comments on the draft direction at Annex 3?Innovate Finance members are concerned with the mechanisms for communication between directed PSPs and specific receiving PSPs in regard to Metric C.Paragraph 7.4.d.1 of the draft direction allows a specified receiving PSP to provide comments to the directed PSP on the receiving-PSP information, if submitted ten working days after receipt.Paragraph 7.4.b allows a specified receiving PSP to request further information it reasonably requires from the directed PSP within five working days after receipt of the receiving-PSP information.Paragraph 7.5.a requires a directed PSP to "promptly respond” to a request from a specified receiving PSP made under paragraph 7.4.b.It is unclear why directed PSPs only have an obligation to respond “promptly” to a specified receiving PSP, rather than a fixed timeframe (such as a fixed number of working days - as is the case of specified receiving PSPs). If either party is to have greater flexibility with deadlines it should be receiving PSPs, as they are smaller firms with significantly lower headcounts and bandwidth than directed PSPs. Innovate Finance urges the PSR to amend paragraph 7.4.b to require directed PSPs to respond to specified receiving PSPs within a fixed number of working days.Furthermore, Innovate Finance is unclear why the total time frame for commenting on receiving PSP information is 10 working days. Given the expected high volume and complexity of cases that receiving PSPs will be sent, Innovate Finance strongly urges the PSR to extend this timeframe. It is essential that receiving PSPs have adequate time to be able to analyse and comment on cases given the significant (negative) reputational impact that the PSR expects the metrics to have on receiving PSPs.Innovate Finance recommends that the PSR works with a number of specified receiving PSPs at a technical level to develop a reasonable timeframe for the commenting process, based on real world evidence.
2. Do you have comments on our proposal for which PSPs should initially be required to report and publish Measure 1 data?Innovate Finance has no comments on this proposal.
3. Do you have views on how long it will take directed PSPs to put in place the necessary reporting systems?We refer to our response to question one.
4. Do you have comments on our proposal to allow PSPs to be voluntarily included in published data comparisons?Innovate Finance supports the proposal to allow PSPs to be voluntarily included in published data comparisons. We call on the PSR to ensure that these ‘voluntary reporters’ are included in any further consultations and / or working groups which are established. This will ensure that the perspective of smaller, challenger PSPs is taken into consideration during the design of the metrics.
5. Do you have comments on how and where data comparisons between PSPs are published, including our proposals to compare PSPs at PSP group level?The PSR has not yet published a draft template for the comparison of PSPs’ data; it would be helpful to have sight of this template in order to provide substantive feedback. Innovate Finance would encourage the PSR to take on board lessons learned from the design of other consumer-facing disclosures and also trial the ‘scorecard’ design with consumers (based on synthetic data) to obtain end-user feedback before implementation.
6. Do you have views on the basis we use for determining which receiving PSPs are included in published Metric C comparisons?Innovate Finance would welcome additional detail on the de minimis threshold that will be applied by the PSR in relation to publication of Metric C comparisons.

Innovate Finance calls on the PSR to provide more information on its proposed method of deciding which receiving PSPs should be included in a reporting cycle. The consultation document only sets out a broad framework for how the PSR will make such decisions.

Receiving PSPs will need to commit significant resources to respond and comment on information received by directed PSPs. In order to ensure that a receiving PSP has sufficient capacity and capabilities (for example, increasing headcounts in appropriate teams), it is essential for PSPs to have certainty as to whether they will be included in Metric C over the medium term.

Therefore, Innovate Finance recommends that the PSR publishes, and consults on, a detailed draft methodology for determining which receiving PSPs are included in published Metric C comparisons. Furthermore, we recommend that this methodology should remain stable for a number of reporting cycles to give certainty to businesses over the medium term.

• Do you have comments on our proposal for the preparation and validation of information about receiving PSPs?With reference to our response to question four, Innovate Finance considers that the mechanism and timeframe allocated for the preparation and validation of information regarding receiving PSPs places new entrants and scale-ups at a significant disadvantage — particularly given the reputational ramifications of the scorecard — in comparison with larger players with greater resources in the payments sector. For new entrants and scale-up receiving PSPs, it introduces burdensome compliance and administrative costs — and there is currently insufficient guidance as to how directed PSPs should adjust data in light of comments received.We would reiterate our call for the PSR to work with a number of specified receiving PSPs at a technical level to develop a reasonable timeframe for the commenting process, based on real world evidence.As noted above, we would also recommend PSR explore the degree to which RegTech solutions may assist with analysis and reporting by PSPs.We would also welcome greater detail on the extent of the impact assessment undertaken, including the proportion of start-up and scale-up non-directed PSPs with whom Lucerna Partners consulted. We understand that none of the non-directed PSPs within our membership base were consulted.
• Do you have comments on how we specify where PSPs must publish the data on their websites?The current phrasing of the publication requirement in the draft direction is extremely prescriptive and may have unintended consequences. For example, the draft direction states that PSPs must display the information on their “personal banking homepage”. Many PSPs are regulated as electronic money institutions rather than banks in the UK and therefore do not have “personal banking homepages”.To avoid unintended consequences, Innovate Finance recommends that the language in the direction replicates the UK Government’s Gender Pay Gap Reporting Regulations. The UK Government’s requirement is for firms to “publish their gender pay gap information…in a prominent place on their… public-facing website”.
  
• Do you have comments on the proposed reporting period and timing for publication of data comparisons?Innovate Finance has no objections to the proposed reporting period and timing for publication.
• Do you have comments on the proposed timetable for reporting data to the PSR?Innovate Finance has no comments on the proposed timetable.
• Do you have comments on the proposed approach to quality assurance of the data?We reiterate our responses to questions four and ten.
• Do you have comments on our proposals for trialling and reviewing Measure 1?Innovate Finance is supportive of the PSR’s intention to trial and review Measure 1, and we would strongly encourage the PSR to ensure the trial cohort is sufficiently diverse by including both directed and receiving PSPs, as well as FinTechs, challenger firms and non-banks.

The purpose of the trial should not only be to allow PSPs to refine internal processes, but for the PSR to pause and reflect on any feedback received regarding the impact of these measures and make necessary adjustments. To that end, Innovate Finance does not agree with the PSR that this trialling process should operate in parallel to this consultation. It is essential that the PSR takes appropriate time to review responses to this consultation before it launches a trial. Otherwise, the PSR could be trialling a system which subsequently undergoes significant revisions and a second trial would then need to be conducted. Innovate Finance recommends that the trial be delayed until such time as the PSR has responded to this consultation.

• Do you have comments on our CBA for Measure 1?Innovate Finance considers there is insufficient evidence that a robust cost-benefit analysis has been undertaken with respect to the impact of the proposals for start-up and scale-up PSPs — for example, no detailed analysis regarding the cost of Metric C is provided at sections 1.14 - 1.18, despite the PSR conceding at section 1.9 that, “some of these impacts, potentially the largest costs, may occur immediately and materialise mostly in the beginning of the policy, such as the cost to some smaller PSPs of creating the required mechanisms of reporting.” Given the impact on smaller players, there is also a lack of evidence that the PSR has undertaken an assessment of Measure 1 and the interplay with its statutory objectives to advance competition and innovation.

Moreover, while Innovate Finance welcomes that the PSR publicly shared Lucerna Partners’ report on Measure 1 (which informed the regulator's thinking on the design of proposals set out in CP21/10), we are concerned that the report’s recommendations appear to have been made on the basis of interviews with an unrepresentative sample of PSPs. The PSR stated that Lucerna Partners conducted detailed interviews with a range of stakeholders, and with reference to Measure 1, it would be helpful to understand the rationale why firms whose data may be published under Metric C (i.e. a non-directed PSP) were not consulted as part of this process.

Furthermore, no cost-benefit analysis has been conducted at all on the proposals for mandatory reimbursement.

For these reasons we consider the cost-benefit analysis to be severely flawed and inadequate; a further, more comprehensive cost-benefit analysis should be conducted and consulted upon before any new regulatory requirements are implemented.

• Do you agree with our position on improving intelligence against fraud? We welcome any further comments from stakeholders about this work.Innovate Finance strongly supports industry-wide efforts to improve intelligence and deter, detect and disrupt fraud. Our members have identified that the key barrier to improving intelligence sharing is the current legislative framework — which is a matter for government. For example, PSPs are constrained from intelligence sharing due to concerns over client contract and confidentiality duties as well as data protection law.The Home Office is currently working on legislative proposals to remove barriers to intelligence sharing; however, Innovate Finance understands that this is only in the context of money laundering.Innovate Finance strongly urges the PSR to engage with the government to ensure that any new legislation allows firms to share intelligence about fraud (in addition to information about money laundering). Additionally, Innovate Finance recommends that any activity undertaken by the PSR to improve intelligence sharing is aligned with existing industry and Home Office work streams and programmes.Innovate Finance would be pleased to discuss the specific legislative barriers to intelligence sharing about fraud in more detail with the PSR.A further barrier to intelligence sharing identified by smaller members in the FinTech ecosystem is the limits on participation in the Joint Money Laundering Intelligence Taskforce — which is a matter for the NECC. As part of our calls for a joined-up approach to addressing economic crime prevention, we would encourage the PSR to collaborate with the other agencies that form part of the NECC.As a secondary point, Innovate Finance encourages the Joint Working Group and regulators to leverage technology-led solutions to assist with intelligence sharing and fraud prevention. Recent FCA TechSprints with an anti-money laundering and financial crime focus demonstrated proofs of concepts including, for example, the development of a shared database of ‘bad actors’, secured and distributed using distributed ledger technology. The database allowed financial institutions to query whether a new customer had been rejected by another financial institution due to financial crime activities or concerns. However, the benefits of technology-led solutions cannot be fully realised until the legislative barriers to intelligence sharing are addressed.
• Do you have any comments on our thinking on how the roles of the bodies currently involved in the CRM Code would differ between the two options under Measure 3?Innovate Finance remains concerned that making PSPs solely responsible for compensating victims of APP fraud distorts incentives. The onus should be on all players in the APP scams ecosystem — including technology and telecoms firms (c.70% of APP fraud originates via tech and telecoms) — to stop scams at source before they adversely impact consumers. While the draft Online Safety Bill is a welcome move, it will be a number of years before we can determine if it has led to an impactful reduction in the number of APP scams originating on these platforms. The economic burden should not be solely borne by PSPs, in the interim.As they currently stand, the PSR's mandatory reimbursement proposals address only the downstream consequences of APP scams, and Innovate Finance strongly recommends that policy interventions should focus on prevention rather than cure. The only way in which to effectively tackle APP scam prevention is for the PSR, other financial services regulators, government, and law enforcement to develop a joined-up and strategic approach in partnership with industry. As such, we would strongly encourage the PSR not to act in isolation and to reconsider the introduction of mandatory reimbursement proposals.In addition to the distortion of incentives for actors in the APP fraud ecosystem, the proposals give rise to a number of additional unintended consequences, which we set out in more detail below. Innovate Finance would call out in particular our concerns on the impact to start-ups and scale-ups in the UK — the proposals cause a material barrier to entry, which is not in line with the PSR's statutory objectives to promote competition and innovation in the UK payments sector.Should the PSR be minded to take forward mandatory reimbursement proposals, we would call on the PSR to:

• pilot the data reporting metrics and robustly analyse the impact of Measure 1 before introducing mandatory reimbursement requirements for industry (please see the response to Question 1 for more detail);
• exclude purchase scams from any mandatory reimbursement requirements; and
• convene an Evidential Standards Working Group and work with industry to shape the evidential framework for mandatory reimbursement, including the threshold for triggering reimbursement.
  Mandatory reimbursement proposals create barriers to entry and do not promote effective competition and innovation in the payments sector
• The PSR has itself acknowledged that reimbursement costs under either of the two proposed options could be "significant" for smaller PSPs. These costs represent a significant risk to early stage, venture capitalist funded and pre-profit businesses that do not have the financial resiliency to reimburse significant sums. Mandatory reimbursement costs are estimated to be the equivalent of wiping — at minimum — a tenth of PSPs' revenue, according to data points drawn from our members and the wider FinTech ecosystem.The ramifications of these proposals for the FinTech ecosystem cannot be underestimated: the proposals pose a material barrier to entry; adversely impact existing start-ups’ ability to remain economically viable in the UK market; and lessens the attractiveness and international competitiveness of the UK financial services sector.We would call on the PSR to share the detailed CBA analysis for the mandatory reimbursement proposals, and share the extent to which start-up and scale-up PSPs were consulted during the policy design phase. Innovate Finance would be pleased to facilitate discussion with our members and the wider FinTech ecosystem, should the PSR wish to further explore the impact of mandatory reimbursement.

  The proposals will negatively impact consumers' user experience and diminish the benefits of the Faster Payments Service
  The PSR is of the view that proposals "might result in PSPs delaying a small proportion of payment", and the regulator believes that a "small amount of ‘friction’ being added to payments would be proportionate for increased detection of APP scams and resulting protection from this fraud".Innovate Finance is concerned that the PSR has not fully assessed the operational impacts of the reimbursement proposals, as our members consider that the proposals incentivise a slowing of all customer payments. PSPs  are mindful of the existing levels of friction in the payments journey, and if PSPs had to reimburse every UK-based APP scam, then there would be an incentive for PSPs (particularly those which operate globally, where the UK makes up a small proportion of the customer base and revenue) to significantly slow payments for all customer payments in order to take additional steps to detect and investigate potential fraud.

Additionally, from an equality impact standpoint, the proposals may also incentivise PSPs to slow the payments made by those at higher risk of falling victim to APP scams — e.g. customers with characteristics of vulnerability and/or other protected characteristics — versus those perceived to be less susceptible to this fraud.

This naturally gives rise to poor user experience, and Innovate Finance would call on the PSR to discuss the operational realities of the proposals with industry. Members would also welcome the PSR and relevant stakeholders to articulate what they consider ‘bad’ looks like in terms of the consumer experience.

As well as poor customer experience, slowed payments negate the benefits of Faster Payments that Innovate Finance members and the UK government champion. We would reiterate the Economic Secretary to the Treasury's comments (See responses to Q430.) that consumers do not wish to see slower payments, and the focus should be on prevention.

Mandatory reimbursement proposals may increase financial exclusion

If firms have to reimburse every APP scam transaction, it may incentivise PSPs to apply increasingly stringent criteria when deciding whether or not to allow a customer to open a current account. Firms may also be less likely to continue to provide services to those at high risk of continued fraud or those who are unable to be reasonably accommodated.

The proposals may inadvertently increase the total amount of fraud and attractiveness of the UK as a market of choice for scammers

Innovate Finance members' experience shows that the UK is already the jurisdiction of choice for international scammers — for example, the UK is c. 20% of one member's customer base but has 60% of total fraud cases — this is due to a variety of reasons, including the English language, high adoption of technology (e.g. e-commerce, social media use, etc), faster payments and high rates of mobile banking.

Members' experience has also indicated that organised gangs are exploiting the FOS' approach to money mule cases and actively target UK-based PSPs. Traditionally, criminals targeted younger customers: according to CIFAS, in 2017, UK PSPs identified 8,500 money mule accounts owned by people under the age of twenty one, with some belonging to teenagers as young as fourteen. While criminals continue to target younger consumers, evidence from the National Fraud Database reveals a 34% increase in the number of mule accounts belonging to forty- to sixty-year-olds bearing the hallmarks of money mule activity since 2017. The data indicates that both younger and more mature customers are being targeted through social media and tech platforms.

As well as organised criminal gangs taking advantage of the UK's approach, mandatory reimbursement proposals may also lead to an increase in first-party fraud, particularly if purchase scams remain within scope. It is unclear what shape the evidential framework for mandatory reimbursement will take, as well as the threshold for triggering reimbursement from PSPs — if the PSR is minded to proceed, we would call on the PSR to convene an Evidential Standards Working Group to explore these issues to ensure consistency amongst PSPs, and mitigate the risks of first-party fraud.

The PSR's mandatory reimbursement proposals set the UK apart from other global jurisdictions, and if proposals take effect then members anticipate more organised criminal gangs will be attracted to the UK and its consumers, creating an uptick in APP fraud levels. Innovate Finance reiterates the need for the PSR to act in concert with other regulators, government and law enforcement, to create policy-driven incentives for all actors in the APP fraud landscape to take preventative action — not only PSPs.

Low-value purchase scams should not be within scope of reimbursement proposals: it is extremely challenging for PSPs to readily prevent and detect this sub-category of APP scams, and the proposals create moral hazard

Innovate Finance is concerned that the mandatory reimbursement proposals essentially mandate all PSPs in the UK to offer a low level of purchase protection for UK consumers paying for products and/or services from another individual via faster payments.

This is an incredibly costly and disproportionate requirement to impose on PSPs (and links with our comments on barriers to market entry and the stifling of competition and innovation, above) as the infrastructure to prevent purchase scams does not currently exist for faster payments. The infrastructure for faster payments is not like that of card payments, for example, where a merchant or sole trader has to sign up with an acquirer and undergo due diligence to access the scheme. The acquirer can manage their risk either by charging the merchant or holding collateral in case the merchant does not deliver the goods.

The likelihood is that this will impact FinTechs to a greater degree than incumbents in two ways. Firstly, the customer demographics for new entrants and scale-up, challenger PSPs point to a majority of young, digital natives. As such, our members see a disproportionate number of purchase scams originating via social media. FinTechs cannot replicate the risk management used by card schemes to support consumer protection for goods and services not provided, and an unfortunate unintended consequence of the PSR's proposals is to essentially require FinTechs to 'underwrite' purchases driven by large, multinational social media firms.

Secondly, FinTechs create innovative solutions to meet consumer demand, so it is incredibly easy to make a low value transaction in comparison with the incumbent banks. FinTechs allow for bill splitting and settling up low level debts with friends quickly and easily. This is significantly different to user experience with many incumbents, some of whom still require card readers, for example, to make a basic bank transfer. FinTechs' offerings deliver real value for consumers in the UK and allow for convenient money management. However, the nature of purchase scams, which are often low value, means it is extremely challenging to differentiate the scams from these genuine, day-to-day low value transactions.

Sharing data points that are helpful in identifying higher value scams (such as age of account, activity, etc) are not as relevant, and the information sharing facilitated by the card scheme to allow providers to manage the risk of offering this protection does not exist (at present) and would be difficult to achieve. Additionally, FinTechs' in-house machine learning models have typically been built to flag high-value, sophisticated scams — this does not trigger in the case of purchase scams as they look like genuine transactions. This speaks to the need for the prevention of purchase scams to be the focus of joined-up efforts on the part of regulators, government, law enforcement and industry.

Lastly, Innovate Finance considers that the inclusion of purchase scams within mandatory reimbursement proposals creates moral hazard. From a behavioural design standpoint, consumers may be less likely to take suitable precautions online (leading to greater volumes of scams taking place), with PSPs bearing the economic brunt caused by criminal behaviour, and at times, consumers' behaviour.

[END]

—

1 See also the Royal United Services Institute for Defence and Security Studies ("RUSI") paper published in January 2021: https://static.rusi.org/the_silent_threat_web_version.pdf Here, RUSI describes the impact of fraud on UK National Security as a silent threat, and calls for a "whole of system, public–private strategy for tackling fraud. This should include: [...] pathways for cross-government collaboration; and a clearer role for the private sector – including the financial, e-commerce and telecommunications sectors – in tackling fraud."