UK APP fraud reimbursement rules after the PSR's July 2026 evaluation: what stays in test scope

What the PSR published in July and what it did not change

On 1 July 2026 the Payment Systems Regulator (PSR) published the independent evaluation of the APP reimbursement requirement by Frontier Economics. The PSR reports that APP fraud losses fell by an estimated £73 million per year and that the reimbursement rate for in-scope claims is now 97%. It states: "A consultation, launching before the end of the year, will include proposals to improve consistency in the application of the policy."

The Q1 2026 reimbursement dashboard (updated 30 July 2026) reports 86,500 claims in scope, 82% resolved within five days, and around 1,700 (2%) rejected for insufficient consumer caution.

The APP scams policy roadmap (undated page, read on 22 September 2026) schedules a formal consultation for December 2026 on "the treatment of claims that cannot be resolved within 35 business days and the treatment of 'returns from investment' under the policy", plus data requirements and consumer caution guidance. The roadmap says the summer engagement will "include consideration of the treatment of some types of investment scams, and the 13 month reporting requirement and any steps we may wish to take on these areas". It plans to "Publish decision and revised legal directions" in May 2027, with implementation "within six months of the decision being published".

Nothing in these publications changes a rule today. On 22 September 2026, Specific Direction 20 (SD20) is still the amended version of July 2024, and the maximum level is still £85,000 per claim for Faster Payments and CHAPS, in force since 7 October 2024 under PS24/7 (2 October 2024). The review covers the 35 business day limit and the 13-month window, so keep both configurable and under test.

The clauses that set test scope

The PSR's consolidated policy statement PS25/5 (21 May 2025) is guidance; the definitive text is in SD20, Specific Direction 19 (SD19, operator monitoring), Specific Requirement 1 on Pay.UK, and the Faster Payments reimbursement rules. For CHAPS, Specific Direction 21 and the Bank of England's CHAPS reimbursement rules apply from 7 October 2024 (PS24/5, 6 September 2024). Each item below cites PS25/5 by paragraph.

• 13-month claim window (Table 2, policy 8). "Sending PSPs can deny APP scam claims submitted more than 13 months after the final payment in a given claim." The window runs from the last payment in the claim. Para 3.13 repeats the 13 months as the prompt reporting requirement of the consumer standard of caution, so one date calculation feeds both.
• Consumer standard of caution (paras 3.40 to 3.44). The two exceptions are first-party fraud and gross negligence. The four requirements are regard to specific, directed interventions, prompt reporting, information sharing, and police reporting. Para 3.42 reads: "Where a PSP can demonstrate that a consumer who has not been classed as vulnerable has, through gross negligence, not met one or more of these four requirements, the PSP is not obliged to reimburse the consumer." "The burden of proof falls exclusively upon the PSP to demonstrate that a consumer has acted with gross negligence" (para 3.43). The PSR interprets gross negligence as a higher standard than common-law negligence: "a 'significant degree of carelessness.'" (para 3.44).
• Vulnerable consumers (Table 2, policy 9; para 3.51). "If a consumer is deemed vulnerable in relation to a specific APP fraud, the sending PSP must not apply the consumer standard of caution exception or claim excess."
• Claim excess (paras 3.32 to 3.35). Optional for the sending PSP, maximum £100. "All 50-50 liability splits must be calculated on the assumption that a £100 claim excess has been applied" (para 3.34). Where the sending PSP does not apply the maximum, a single receiving PSP "may deduct 50% of the maximum claim excess amount from its reimbursement contribution" (para 3.24); two or more receiving PSPs split that 50% by their share of liability (para 3.25).
• 50:50 split (paras 3.21 to 3.23). The sending PSP cannot request the contribution "unless and until they have reimbursed the consumer". The receiving PSP pays the lower of 50% of the amount paid attributable to its payments or 50% of the required amount (para 3.22), within five business days of notification under rule 5.7 of the Faster Payments reimbursement rules (footnote 26).
• Five business days and stop the clock (paras 3.27 to 3.29). The clock may stop only while the sending PSP waits for a response to one of five information requests listed in paragraph 5.4 of Specific Requirement 1. It pauses when the request is sent and resumes when a response arrives. The sending PSP "must close the claim before the end of the 35th business day following the reporting of the APP scam claim".
• Data reporting (paras 4.5 to 4.12). Reporting Standard A of the Compliance Data Reporting Standards applies from 7 October 2024, record-keeping applies to all directed PSPs, and CHAPS participants report monthly to the Bank of England without nil returns.

Civil disputes, international payments, other payment systems, and unlawful purposes are out of scope (Table 2, policy 1), so a remittance product must classify each claim before any clock starts.

Why claim engines fail these clauses

In our reviews of claim workflows, the defects sit in claim state rather than in the decision screen. The four we see are:

• a stopped clock that never resumes because the customer replied through a channel the engine does not read;
• a vulnerability flag set after the decision that does not reverse an applied £100 excess;
• a contribution request sent to the receiving PSP before the customer is paid, which para 3.21 prohibits;
• a 13-month window computed from the first payment of a multi-payment claim instead of the last.

Each one produces a wrong reimbursement amount, a missed deadline in the Pay.UK data, or both.

For neobanks and business banking platforms, the sending and receiving roles run in the same system, so one claim record has to hold both sides of the 50:50 split.

Test cases to run now

Our regression set below uses synthetic claims, amounts in GBP, and "BD" for business days.

T6 and T7 are our reading of paras 3.24 and 3.25; confirm the multi-PSP method in the Faster Payments reimbursement rules, since Pay.UK sets it (para 3.26). T1 and T2 use our month-end convention: 13 months after 31 August 2025 ends on 30 September 2026, the last day of that month. Policy 8 says "more than 13 months" and nothing about months without a 31st, and a date library that rolls 31 September over to 1 October would accept the T2 claim, so record the convention and test both dates.

Intervention records behind T4 fall under KYC, AML and fraud testing; the payment flows behind T3 and T8 under payment rails testing. When the revised directions are published, planned for May 2027, rerun T1, T2, T9 and T10 against any revised 13-month and 35 business day rules.