About Innovate Finance

Innovate Finance is the independent industry body that represents and advances the global FinTech community in the UK. Innovate Finance’s mission is to accelerate the UK's leading role in the financial services sector by directly supporting the next generation of technology-led innovators.

The UK FinTech sector encompasses businesses from seed-stage start-ups to global financial institutions, illustrating the change that is occurring across the financial services industry. Since its inception in the era following the Global Financial Crisis of 2008, FinTech has been synonymous with delivering transparency, innovation and inclusivity to financial services. As well as creating new businesses and new jobs, it has fundamentally changed the way in which consumers and businesses are able to access finance.

Introduction and summary of key points

Innovate Finance welcomes the opportunity to respond to the Payment Systems Regulator’s (PSR) consultation on Authorised Push Payment (APP) scams data collection and publication (CP23/1).

While our members have welcomed the open and constructive dialogue over recent months with PSR colleagues, we wish to flag that with the exception of one FinTech bank, no other start-up or scale-up firms participated in the PSR’s trial on Measure One in June 2022. We are concerned therefore that the Measure One regime’s operational practicalities and the overall impact on FinTechs has not been appropriately tested by the PSR, given the small sample size involved in June’s data-collection trial. Many of our members who were unable to participate in the data-collection trial, owing to limited resources, have raised serious concerns that they are now at a significant disadvantage compared to firms that were able to participate in the dry run.

Moreover, it is disappointing to note that only one of our concerns and recommendations set out in response to CP22/5 (Metric C) have been addressed via amendments to the reporting template and guidance currently being consulted on. We understand that the other concerns and recommendations that Innovate Finance raised in response to CP22/5 were shared by a wide range of trade associations representing payment service providers (PSPs) (both incumbents and FinTechs) in the UK. Given alignment across the payments sector on these issues, we would have expected the PSR to engage with industry and make appropriate adjustments that would be reflected in the reporting guidance and template and the forthcoming policy statement expected this month.

We summarise the headline recommendations in response to this consultation, below. We recommend that the PSR:

• Clarify and confirm its methodology for determining which PSPs are captured by Metric C comparisons, avoiding an ‘either/or’ approach to absolute value and rates of fraud.
• Synchronise the timelines of the Measure One reporting and Measure Three mandatory reimbursement requirements. The Measure One reporting metrics should not be made publicly available until the reimbursement regime goes live. If the PSR is not minded to synchronise the timelines, we would urge the regulator to drop the requirement to report on and publish H1 2022 data.
• Provide greater clarity regarding the data validation process for Metric C to support firms as they look to achieve operational readiness ahead of key milestones. We would also urge the PSR to address data quality concerns.

At the end of our response, we also flag up the challenges posed by the extremely short consultation period – originally two weeks which was then extended by one week – which coincides with an extremely high volume of other consultation papers that are running concurrently.

We would be pleased to discuss our response with PSR colleagues and/or facilitate a roundtable with our members.

We summarise the headline recommendations in response to this consultation, below. We recommend that the PSR:

• Clarify and confirm its methodology for determining which PSPs are captured by Metric C comparisons, avoiding an ‘either/or’ approach to absolute value and rates of fraud.
• Synchronise the timelines of the Measure One reporting and Measure Three mandatory reimbursement requirements. The Measure One reporting metrics should not be made publicly available until the reimbursement regime goes live. If the PSR is not minded to synchronise the timelines, we would urge the regulator to drop the requirement to report on and publish H1 2022 data.
• Provide greater clarity regarding the data validation process for Metric C to support firms as they look to achieve operational readiness ahead of key milestones. We would also urge the PSR to address data quality concerns.

At the end of our response, we also flag up the challenges posed by the extremely short consultation period – originally two weeks which was then extended by one week – which coincides with an extremely high volume of other consultation papers that are running concurrently.

We would be pleased to discuss our response with PSR colleagues and/or facilitate a roundtable with our members.

Comments on the revised reporting template and guidance

Engagement with industry

Our members have welcomed the open and constructive dialogue with PSR colleagues over the previous months, some of which is detailed as part of the stakeholder engagement at paragraph

2.5 of the consultation.

Our members wish to flag up, however, that with the exception of one of our FinTech challenger banks no other FinTech voices were represented as part of the data-collection trial in June 2022. Many non-Directed PSP members were interested in participating, but with the short lead time provided by the PSR and start-up and scale-up firms’ extremely limited resources – compounded by other competing consultations and the heavy compliance focus on implementing sanctions against Russia and related entities – they were unable to do so. Therefore, our members are concerned that there has been insufficient testing of the reporting regime with start-up and scale-up PSPs, and we will continue to push for a pilot of the reporting measures (as mentioned in our response to CP21/10) before the regime is fully implemented across the payments sector.

While some of the comments that we shared in early March 2022 – part of an informal request for feedback rather than a formal consultation – on the draft reporting template and guidance has been reflected, it is disappointing to note that only one of the concerns or recommendations set out in our response to CP22/5 (Metric C) have been addressed. We understand that many of the concerns and recommendations that Innovate Finance raised were shared by a wide range of trade associations representing PSPs (both incumbents and FinTechs) in the UK. Given the alignment across the industry, we expected that the PSR may make some adjustments in this consultation and the forthcoming policy statement.

The PSR must clarify and confirm its methodology for determining which PSPs are captured by Metric C comparisons, avoiding an ‘either/or’ approach to absolute value and rates of fraud

We note that the PSR has not in this consultation clarified its methodology for determining which PSPs are captured by Metric C comparisons, and we would urge the PSR to make clear its position to provide the industry with clarity in the forthcoming policy statement.

We note that the PSR's rationale for the publication of Metric C data is to aid customers' (a layperson audience) understanding of the performance of PSPs in tackling APP fraud.

Our members are cognisant that there is a need to present the Metric C data in the most readily accessible and understandable form for consumers, recognising that varying levels of financial literacy and characteristics of vulnerability within the UK's consumer population will result in some individuals finding it challenging to interrogate and draw appropriate conclusions and comparisons from the data.

In the absence of broader contextual explanations being provided to consumers alongside the Metric C data points, taking an 'either/or' approach and presenting only one data point per firm (an absolute value or rate of fraud) does not provide the basis for fair or accurate comparisons of PSPs' performance. Each approach will produce an equally misleading picture. Essentially, an either/or approach to absolute terms or rate of fraud in ranking firms would be prejudicial to either larger PSPs which are mainly incumbent banks, or smaller PSPs which are mostly FinTech firms.

With this in mind, we recommend that the PSR presents both the absolute values and the rate of fraud to the public, rather than take an either/or approach. In terms of ranking, our members recommend that the PSR takes a proportionate approach, where PSPs are then ranked according to the greatest proportion of mules-to-account ratio. Doing so will ensure that rankings do not misleadingly penalise large PSPs or small PSPs without context because the data will illustrate which PSP is actually ‘riskier’ to send funds to and is more susceptible to mules. Our members believe that this approach might better fulfil the PSR’s aim to educate consumers about which PSP is succeeding to tackle and address APP scams.

Our members remain concerned about the 'cherry picking' and misrepresentation of data by the media and others. Therefore, we would welcome more information from the PSR about the tools (referenced in CP22/5 at paragraph 4.39) that are being developed for use by comparison websites and media/journalists, amongst others. One unintended consequence of the publication of these metrics and any sensationalist media coverage may be that it knocks consumers' confidence in FinTechs and the payments and banking sector as a whole.

Further, we would welcome more information about the learnings that the PSR has taken on board from any end-user testing of the Measure One disclosures (and any other financial services consumer-facing disclosure regimes), particularly the findings in relation to consumers with characteristics of vulnerability.

Reflecting feedback from industry, we would urge the PSR to clarify and confirm its approach and methodology for determining which PSPs are included in published Metric C comparisons. Given the materiality of this data to consumers, individual firms and the industry’s reputation, ‘flexibility’ should not be an option. Instead, we recommend that this methodology should remain stable for a number of reporting cycles to guarantee consistency, minimise confusion and provide certainty to businesses and consumers over the medium term.

Reporting and publication of Metric C should align with mandatory reimbursement timelines

We reiterate our recommendation that the PSR considers aligning the mandatory reimbursement and Metric C publication timelines, so that the regulator and consumers have a clearer understanding of the effectiveness of mandatory reimbursement. The Measure One metrics should not be placed in the public domain until the Measure Three reimbursement requirements go live. Alternatively, if the PSR is not minded to synchronise the timelines, our members would request that the regulator drops the requirement to report on and publish H1 2022 data.

Our members wish to flag up that the backdated reporting of 2022 APP scam data, in relation to receiving PSPs, was not expressly proposed in CP21/10. As such, this current re-consultation will be the first awareness that nearly all receiving PSPs will have that backdated reporting is in scope. Our members consider that backdating data before mandatory reimbursement proposals take effect seems patently unfair. Additionally, while nearly all Directed PSPs were already subject to reimbursement requirements under the Contingent Reimbursement Model (CRM) Code, nearly all receiving PSPs were not. Receiving PSP data will be misleading in that the Directed PSPs were not during 2022 and at present under an obligation to report and request reimbursement for every claim. Therefore, the data will have a bias against receiving PSPs (i.e. without this incentive, receiving PSPs are expected to appear to have an overall poorer performance than the Directed PSPs). APP scam data representing both Directed and receiving PSPs will only show a level playing field when both are subject to mandatory reimbursement obligations.

Further, our members queried the utility of providing H1 2022 data, given how out of date this will be by the time it is published. This is not in a bid to bury bad news as UK Finance¹ in fact reported that APP fraud fell by 17% from £305.1m in H1 2021 to £249.1m in H1 2022. At the same time, the amount of money returned to victims of APP fraud rose from £125.8m to

£140.1m in H1 2022 which represents an increase of 11%.

If the PSR is not minded to align the mandatory reimbursement obligation timelines with Metric C reporting, our members would strongly urge the PSR to consider amending the reporting requirements, so that PSPs report data from the period H2 2022 onwards. This would also reduce some of the burden on FinTechs that are expected, as proposals currently stand, to prepare two half year returns (H1 and H2 2022) in time for the first publication date in October 2023.

In terms of the burden of this reporting, the PSR received feedback from UK Finance and Innovate Finance members (Directed PSPs) in March 2022 at a stakeholder engagement session on the difficulties of being operationally ready to go live with the publication of Metric C data from October 2023. It was striking that even the incumbent banks, many of whom commented that they had secured approvals for additional budget and headcount to stand up new teams to deal with Measure One reporting, flagged that they would still struggle to achieve operational readiness in this timeframe. If this is the case then we question how the regulator can expect scale-up, challenger PSPs — who do not have the same resources at their disposal — to be operationally ready by the key milestones this year.

PSR needs to provide greater clarity regarding the data validation process for Metric C

We recognise that the PSR has amended its original timelines and process for data validation between sending and receiving PSPs; however, we remain concerned that the approach to data validation has not been clarified in this latest consultation and does not take into account real-world practicalities and will have unintended consequences for small PSPs. We would therefore urge the PSR to provide much needed clarity that will assist firms as they look to achieve operational readiness for the new regime. We would also urge the PSR to address data quality issues (set out below).

The majority of our members did not participate in the June 2022 trial data-collection exercise – it is an entirely new process, which we foresee will have teething issues.

From a practical perspective, with the above in mind, our members would welcome from the PSR:

• Clarity about the dedicated contact point(s) at each firm that will be responsive to requests for data and supporting evidence.
• Clarification regarding the rules on reporting where a PSP does not give notice or seek recovery under the reimbursement regime.
• Greater clarity as to what and how evidence can realistically be shared between PSPs as part of this data validation process. Members have flagged up data protection considerations, given that firms will likely be manually transferring customer data on a bilateral basis and not through, for example, a secure digital platform and Application Programming Interface (API) integration. See by way of contrast, for example, the Monetary Authority of Singapore’s ‘COSMIC’ (for “Collaborative Sharing of ML (Money Laundering) / TF (Terrorism Financing) Information & Cases”) digital and centralised data-sharing platform² which integrates with firms’ data analytics tools.
• Greater certainty about the evidential threshold and basis on which sending PSPs can choose to reject receiving PSPs request for revision of the data. Our members are concerned that the data validation process may become liable to abuse and ‘weaponisation’ — i.e. where sending PSPs may only revise data if a receiving PSP commences a more formal dispute resolution process (e.g. legal action), which small PSPs could not afford to pursue at scale. It would be helpful for the PSR to collect data from the sending PSPs as to the proportion of challenges they receive from receiving PSPs that they either uphold or reject. This would allow the PSR to look at outliers and potentially identify unfair approaches to considering the challenges.

Our members have significant concerns about data quality and how this may translate into an unfair and inaccurate representation of the position of many receiving PSPs, when it comes to the publication of Measure One metrics. Our members have evidenced the discrepancy in the number of fraud notices that they received in 2022 in comparison to the PSR’s estimated figures for them. An explanation for this is that many large, traditional PSPs simply disregard or write off small claims whereby no investigations or pursuit of recovering funds are conducted. It is also clear that many firms under the CRM Code do not pursue recovery against non-CRM code firms. This is linked to our recommendation that the PSR drops the requirement for firms to report H1 2022 data.

Further, our members call upon the PSR to re-evaluate its position that receiving PSPs should only make one request to sending PSPs for their results to be altered. This is because this strict position with regard to appeals will impact the quality of data whereby new information from receiving PSPs can simply be ignored by sending PSPs, leading to further data discrepancies between real data and the PSR data. Therefore, as an alternative and to avoid these data gaps, the PSR should allow receiving PSP data to be directly reported to the PSR.

Indirect access providers and disaggregation of data

Our members that are Indirect Access Providers (IAPs) are grateful to the PSR for allowing data disaggregation. Identifying APP fraud at the level of each authorised PSP is consistent with the basis of reporting to the Financial Conduct Authority (FCA) in the REP17 Payments Fraud Reporting, and it is necessary to identify fraud trends and to establish meaningful peer reviews. We would encourage the PSR to adopt a disaggregation approach for the upcoming reimbursement liability and reporting.

However, our IAP members flagged that transparency and data in relation to their indirect PSPs’ fraud rates is more important for PSR and FCA regulatory supervision and enforcement³ purposes than for public consumption.

Challenges posed by the consultation period

Echoing our earlier feedback to CP22/5, our start-up and scale-up FinTech members have flagged up the difficulty in responding to this consultation given the extremely short time period allocated.

The initial two-week consultation period (which was then extended by one week) cut across February half-term holidays for many schools, which meant a number of firms’ key stakeholders were not available for review of the paper. It left in practice around a week for most of our member firms to review with their subject matter experts and take the response through internal governance with their senior stakeholders.

Moreover, the PSR’s consultation period coincides with an extremely high volume of other regulatory consultation and discussion papers that are running concurrently. This includes but is not limited to papers on the following topics: Basel 3.1 (CP16/22); Credit Information Market Study (MS19/1/2); HM Treasury’s consultation on reform of the Consumer Credit Act 1974; and HM Treasury’s consultation on review of the Payment Services Regulation 2017.

We also note that the regulatory initiatives grid (due to have been published in November 2022)

— which was created with the intention to give industry a forward look of regulatory policy changes and assist with workload planning associated with regulatory change — was not published in advance of the consultation. The grid was only published on 28 February.

Many of our start-up and scale-up members’ public policy and regulatory affairs teams are a ‘one-person band’ with limited capacity. So, there is a risk that the voice of the FinTech community is not represented in these important discussions referenced above. We would urge the PSR and other policy makers to give consideration to the design and timing of future consultations, so that they allow a diverse range of stakeholders to feedback views.

[ENDS]

¹ UK Finance, 2022 Half Year Fraud Update, 2022.

²https://www.mas.gov.sg/news/media-releases/2021/mas-and-financial-industry-to-use-new-digital-platform-to-fight-money-laundering

³ In that failing to manage APP fraud and other forms of fraud is a breach of FCA SYSC (systems and controls) rules (amongst others).