Signs of a changing regulatory landscape
On October 7th The Payment Services Regulator (PSR) in the UK launched a set of regulatory protections for individual consumers, microenterprises and charities to protect them from Authorized Push Payment Fraud (APP Fraud). Largely underreported in the mainstream media this set of protections is likely to have a significant impact on retail banks, Payment Service Providers (PSP) and consumers alike.
Key Facts:
The measures only apply to UK Bank Transfers.
Reimbursements need to be within 5 days with the maximum time allotted to coming to a final outcome is 35 days.
Maximum amount of reimbursement is 85K and the cost of this is split between the sending and the receiving bank or payment service provider.
Analysis:
This evolution from a commonsense perspective isn't all that surprising. In the wake of the COVID 19 pandemic digital fraud and scams skyrocketed and an exponential number of people were impacted. Pressure built up and a critical mass was reached where regulators had to do something about this. The protections provided will certainly benefit consumers, however there is an argument that this will encourage recklessness and decrease vigilance of consumers.
PSP's and banks will be materially impacted - and extend certain protections to consumers placing additional burdens on banks and payment service providers. According to UK Finance around 485 million GBP a year is attributed to APP and there is wide ranging consensus that this figure is severely underreported. It is likely that these figures will start materializing on retail banks and PSP's PnL's and most likely force some smaller PSP's out of business.
The regulation is likely to serve as an additional lever that organized criminal enterprises are going to use in their ever-enduring quest to defraud banks and individuals, so it is likely that collusion cases will see an uptick and efforts will have to be enhanced in order to detect these cases.
Conclusion:
As a part of a wider regulatory trend the PSR is one of the first regulations allotting significant protections to consumers at the expense of banks and PSP's. This trend is likely to continue in the EU with PSD3 (article 59) and PSR (article 69) closely following suit with protections of their own for consumers. What this means for banks and PSP's is that they will have to face a wave of risk materialization that was so far largely outside of their capital allocation calculations.
Aside from the obvious solutions of doing a better job at preventing and detecting scams targeting their consumers, all of the impacted institutions will have to think about building stronger litigation shields. The focus will be to enhance the ability to showcase a high level of duty of care in order to be in a position to challenge claims made against them. This can be done by enhancing and implementing targeted client training (PSD3 outlining the obligation to inform), and adopting a truly intelligence led approach to end-to-end fraud prevention.
These regulatory developments will have a significant impact on the financial ecosystem of retail banking - and with a wider context decreasing interest rate environment in the UK and EU - they could materially impact the stability of some payment providers. What remains to be seen is how the enforcement climate will develop and operate in practice. Despite the uncertainty, it is clear that this is the start of a shift in responsibility from the individual to the payment institution, that will apply additional pressure to the already heavily regulated financial services sector.