Safer payments need service ubiquity

The Payment Systems Regulator (PSR) is directing around 400 payment service providers (PSPs) to implement a system to offer the Confirmation of Payee (CoP) name checking service to their customers (both as payers and payees). This will help to reduce authorised push payment (APP) fraud and accidentally misdirected payments.

This direction is another big step in protecting people from the devastation that APP scams can inflict on people. Financial firms have to act to prevent fraud and CoP is one of the many tools that can be used. By giving this direction, we will see more widespread adoption of the protections available to people making payments.
Kate Fitzgerald, Head of Policy, PSR

This is a continuation of the journey the PSR started in August 2019, when they issued Specific Direction 10 (SD10) to require the six largest banking groups to implement CoP.

The new direction represents the PSRs ambition to achieve near ubiquity of Confirmation of Payee and protect a greater number of payment system users.

The PSR’s decision to extend the coverage of Confirmation of Payee was published at: Policy Statement: Extending Confirmation of Payee coverage – Response to consultation CP22/2 published in October 2022.

The journey to CoP ubiquity has been a long one but the end is now in sight:

Ten things you need to know

Although there is no substitute to reading the full document here are ten things you need to know about the PSR’s decision to extend the coverage of Confirmation of Payee…..

Ten things you need to know

Although there is no substitute to reading the full document here are ten things you need to know about the PSR’s decision to extend the coverage of Confirmation of Payee…..

1: First CoP adopters

These are the six banking groups that were issued with a Specific Direction (SD10) to implement the name checking service in August 2019 plus a further 21 PSPs that have adopted CoP in Phase 1.

The PSR have worked with Pay.UK and the Phase 1 banks to enable more PSPs to join CoP, extending the benefits to more consumers and levelling up the playing field. To enable this Specific Direction 11 was issued in February 2022 this has led to a single technical environment and a single set of rules and standards, allowing CoP services across all PSPs to work together. PSPs that rely on different reference information, such as SRD, will be able to implement CoP.

As at 30 September 2022 a further 26 PSPs have voluntarily adopted CoP since the closure of Phase 1.

2: Safer Payments need Service Ubiquity

Notwithstanding the eye watering levels of payment fraud the PSR identified three reasons that PSPs have not adopted CoP so far:

the cost and complexities of Phase 1.
relying on reference information other than sort codes and account numbers to identify customers.
lack of a regulatory requirement to do so.

The PSR are of the view that PSP adoption of CoP has been at a slower pace than they think is necessary.

The PSR remain concerned about the rise of APP fraud being received by non-CoP offering PSPs and that this increase has not incentivised these PSPs to adopt CoP.

Interestingly, the PSR have also been persuaded by the arguments that a mandate will ensure PSPs are able to obtain the funding needed to prioritise CoP.

The PSR believe that the decision to extend the coverage of Confirmation of Payee sets the scene for near account name and number checking ubiquity to be achieved.

3: Approximately 400 PSPs have been issued with a direction to implement a system to offer CoP

The PSPs will be split into two distinct groups1:

Group 1 will be formed by those PSPs2 that meet criteria, designed to distinguish more complex PSPs where the adoption of CoP is likely to have the biggest impact. The PSR calculate that “Group 1” PSPs will increase CoP coverage from 92% of transactions made via Faster Payments to 99%. This group will need to have and use a CoP system with send and respond capability after 31 October 2023.
Group 2 will be formed by the remaining payment PSPs who are either using unique sort codes, or are building societies using a different SRD reference type. This group will need to have and use a CoP system with send and respond capability after 31 October 2024.

The PSPs listed in the PSR’s consultation have been adjusted to remove those that have delivered CoP, confirmed that they have no relevant business and due to payment volumes have been moved from Group 1 to Group 2 – this leaves 32 PSPs being directed under Group 1.

The PSR state that without widespread implementation of CoP there remains a gap in coverage that fraudsters can exploit, and customers won’t be fully protected against making misdirected payments.

The PSR believes that a new Specific Direction will achieve their objective of widespread implementation of CoP.

4: Some payments remain out of scope

Cross border payments: Once a payment leaves the UK jurisdiction the PSR are unable to act, in addition, there isn’t a universal worldwide system for CoP, or a global standard for open APIs to send and receive CoP messages.

The Direction relates to Faster Payments and CHAPS – in addition to other payment types being out of scope bulk payment file submissions, unattended payments and customer not present payments are also out of scope even if the file contains Faster Payments and CHAPS.

5: The PSR believe that there is sufficient time

The PSR have concluded that the industry require more time to plan and coordinate delivery more effectively, especially to avoid bottlenecks.

The PSR state that the published timeline will also allow Pay.UK to make the necessary changes to the CoP rules and standards in relation to a vendor model and/or indirect access model.

The PSR have concluded that PSPs in Group 1 should have 12 months from when they give the direction and Group 2 should have 24 months.

This means the PSR will require:

Group 1 to have and use a CoP system with send and respond capability after 31 October 2023.
Group 2 to have and use a CoP system with send and respond capability after 31 October 2024.

The PSR expect PSPs to regard these dates as the latest possible date for implementation and that PSPs should implement both CoP send and receive capability as soon as they can.

6: The PSR have decided not to go further

The PSR have concluded that there could be capacity issues if they went further than the proposed number of around 400 PSPs believing that this will significantly increase the risk of bottlenecks and increase the resourcing burden on existing participants and Pay.UK.

In light of this the PSR are therefore not proposing to direct HOCA PSPs beyond building societies at this stage.

Additionally, the PSR are not directing a requirement to implement Secondary Reference Data but may consider giving a specific direction on any participant who has received a waiver but fails to meet their new agreed date.

7: Faster Payments and CHAPS rule changes

16 of 26 consultation respondents supported Pay.UK and / or the Bank of England bringing in a rule change with the respective schemes. Respondents felt that it was important to capture new PSPs, such as start ups or international PSPs launching a product in the UK, that join these schemes as a direct participant at a later date.

Some respondents raised a concern on whether such a rule change might create unintended consequences such as a barrier to entry, a participant didn’t have applicable traffic or might reduce competition.

Pay.UK, the operator of Faster Payments, highlighted potential legal risks in setting rules which relate to overlay services that operate outside of (in this case, prior to) the transfer of funds through Faster Payments. Pay.UK suggested that the PSR may wish to consider giving an enduring general direction, which would capture future direct Faster Payments participants, and also other PSPs whose customers might benefit from an account checking service.

The PSRs conclusion is complex: agreement that there are benefits in undertaking a CoP check as part of the payment transaction within the scheme rules, agreement that there might a potential barrier to entry but balance this with the benefits of CoP and that new joiners might have a competitive advantage by not having to implement CoP and concluding that there might be other methods that could achieve the same outcome.

However, whilst the PSR agree with the views expressed they are not proposing to direct Pay.UK of make a rule change. That said, the PSR state that they expect Pay.UK to make rule changes in the future – for example, as a package when other changes are made and / or for the new NPA rulebook.

The PSR will also consider whether there is merit in achieving a rule change through the use of their powers – for example, under FSBRA sections 54 or 55 to amend rules accordingly.

8: Monitoring and Compliance

Directed PSPs will be required to notify the PSR within 28 days of having put a CoP system in place. Conversely where a directed party considers it unlikely that it will meet its obligation under our direction they must contact us, explaining the reason for this, within 28 days of coming to this view.

The PSR currently collect effectiveness data from the initial six CoP adopters with further adhoc data gleaned from other CoP PSPs. Given the increasing number of CoP PSPs, the PSR do not think that this method alone will give them enough data for monitoring the effectiveness of CoP.

As part of a consideration of a wider and more effective monitoring regime the PSR plan to consider what data they may require from CoP-enabled PSPs that have already implemented CoP and those PSPs that they propose to direct in Groups 1 and 2.

9: Reducing misdirected payments

During the first full year of CoP checks by the six largest banking groups, the value of misdirected payments fell by 35%. Assuming that the level of misdirected payments sent by the additional PSPs is roughly proportionate to their share of Faster Payments transactions, extending CoP checks to these PSPs should reduce accidentally misdirected payments by around £2 million a year.

10: Costs of introducing CoP

The PSR have concluded that an indicative estimate for introducing CoP is that annual costs to individual PSPs are likely to be in the range of £30,000 to £100,000, implying an overall annual cost in the region of £12 million to £40 million, with a best estimate in the region of £20 million per annum.

You’ll find more blogs from Northey Point on this subject here: Confirmation of Payee.
Railsr selects SurePay as its Confirmation of Payee vendor as fraud rises in the UK.

SurePay supporting Confirmation of Payee

If you have yet to decide on a way forward then make sure you speak to my friends over at SurePay.

As the leading CoP vendor in the UK, and with their cost-effective packages, SurePay can help every PSP with a tried and tested implementation.

Book a demo or more information: https://lnkd.in/ggUKptaT

Or for Group 2 PSPs visit: https://lnkd.in/ex4Xm75i