The Payment Systems Regulator: payments, fraud refunds and card fees

The Payment Systems Regulator (PSR) is the UK's economic regulator for payment systems: the behind-the-scenes networks that move money when you make a bank transfer, pay by card or withdraw cash. It is the first economic regulator to oversee payment systems¹, and its strategic priorities are protection, competition, unlocking account-to-account payments, and providing access and choice². Eight payment systems have been designated by HM Treasury for its oversight¹, including Faster Payments, the card schemes and the LINK cash machine network.

For most consumers, the PSR matters for three things. It created the mandatory refund rules for authorised push payment (APP) scams, under which banks and other payment firms must reimburse victims up to a maximum of £85,000, with most victims reimbursed within five business days³. It directed the industry to roll out Confirmation of Payee, the name check that runs before you send a bank transfer⁵. And it oversees the LINK network that keeps free-to-use cash machines spread across the country².

What the PSR does not do is handle individual complaints. It has no adjudicatory function and cannot consider individual consumer complaints⁶; those belong to your bank first and then the Financial Ombudsman Service. This page explains what the PSR covers, how the APP scam refund rules work, what is happening with card fees, and where to go when a payment goes wrong.

What the Payment Systems Regulator does, and what it does not do

The PSR regulates the payment systems themselves rather than individual firms' conduct. Its role includes ensuring that the payment systems that facilitate consumers accessing cash are operated effectively and efficiently, in the interests of the evolving needs of service users¹⁰. It oversees Faster Payments, the system over which the majority of APP scams happen¹¹, the card schemes, and LINK, the ATM network, making sure people and businesses have access to cash across the UK².

Its work is carried out through formal legal instruments. The APP fraud reimbursement requirement was implemented by issuing directions under Sections 54 and 55 of the Financial Services (Banking Reform) Act 2013¹². The Financial Services and Markets Act 2023 also gives the PSR ongoing powers: nothing in the relevant provisions limits its power to vary or revoke a requirement it has imposed, or to impose further requirements¹³. The PSR is also building a new team to increase its focus on reducing firms' non-compliance with the rules it enforces².

What it does not do matters just as much when you have a problem. The PSR does not handle queries or complaints from consumers about individual payments², does not deal with consumer related issues, and does not get involved with financial issues beyond the payments industry¹. It has no adjudicatory function and cannot consider individual complaints from consumers⁶. The one route into the PSR itself is narrow: if you have a complaint about a breach of the Interchange Fee Regulation, you may submit it to the PSR, which may then decide to open an investigation¹⁴.

The PSR also co-chairs the Joint Regulatory Oversight Committee², the body overseeing the development of open banking, and works with the FCA on access to cash, where the FCA has assumed the lead role in the long term¹⁵. For a wider picture of which regulator does what, see who regulates what and the Financial Conduct Authority.

APP scam refunds: up to £85,000 when you are tricked into a bank transfer

An authorised push payment scam is one where you are tricked into making a payment yourself, typically a bank transfer, to a fraudster posing as someone trustworthy. APP scams are the second biggest type of payment fraud¹⁶. Because you authorised the payment, the usual protections for unauthorised transactions did not help, which is why the PSR built a dedicated reimbursement requirement.

The rules require banks and other payment service providers to reimburse you up to a maximum of £85,000 if you are the victim of an APP scam⁴. The requirement applies to all payment service providers within its scope, which includes high-street banks and building societies but also smaller payment firms¹². The cost of reimbursing victims is shared 50:50 between the sending and receiving payment firms¹², a deliberate change designed to give the banks that receive stolen money an incentive to spot fraud on their own customers' accounts.

The requirement came into force in 2024¹², with a confirmed policy start date of 7 October 2024⁸. Customers are more protected under consistent minimum standards, with most APP fraud victims being reimbursed within five business days, and additional protections are offered for vulnerable customers³. Where the rules apply and you were particularly vulnerable to the specific type of APP scam, your bank or payment service provider must reimburse you⁴.

The PSR publishes data so the public can see how the system is working. Its APP scams reimbursement dashboard tracks reimbursement to victims, money sent from victims' accounts, and money received into fraudsters' accounts, from the largest 14 banking groups in Great Britain and Northern Ireland¹⁷. The latest report covering 1 January 2024 to 6 October 2024 includes the UK's 14 largest banking groups, along with data for eleven other smaller firms that were in the top 20 highest receivers of fraud¹⁷. The dashboard also records the value of APP scams below the £100 excess and above the £85,000 maximum cap⁷, amounts that fall outside the mandatory refund.

Who can claim, the £100 excess and the time limits

The reimbursement requirement covers all in-scope customers who become victims of APP scams¹². There is no separate minimum value threshold for APP fraud claims under the requirement⁶, a deliberate decision by the PSR, which had earlier consulted on whether to set one and decided it would no longer require a minimum threshold for claims to be valid¹².

The main deduction is the excess. Payment service providers are permitted to charge an excess of up to a maximum of £100 per claim⁶, and if your bank or payment service provider decides to reimburse you it may deduct that excess for each scam claim⁴. The PSR set the maximum permitted claim excess at £100⁶.

Time limits run in both directions. The sending payment firm is not obliged to reimburse any APP scam claim where the customer submits the claim more than 13 months after making the last payment in the case⁸. On the other side, there is a time limit for payment service providers to reimburse eligible cases, and the exceptions for when reimbursement does not have to be issued, are set out in the PSR's policy documents¹².

Separate rules apply to payments you did not authorise. Under the Payment Services Regulations 2017, where a payment instrument is lost, stolen or misappropriated, the payer's liability is capped at a maximum of £35 for losses from the resulting unauthorised transactions⁹. And where strong customer authentication is required but the payer's provider does not apply it, the payer is not liable at all, except where the payer has acted fraudulently⁹. The Financial Ombudsman Service can look at both kinds of case, and can also examine complaints about the bank or payment service provider that received your money, considering the steps it took to recover it and whether it should have had concerns about its customer's account⁴.

Where APP refunds do not apply

The mandatory reimbursement requirement has defined edges. The PSR's consolidated policy statement lists what the requirement does not apply to: payments which take place across other payment systems, payments made before 7 October 2024, international payments, payments made for unlawful purposes, and civil disputes⁶.

Each exclusion matters in practice:

• Other payment systems: the rules were built around Faster Payments, the system over which the majority of these scams happen¹¹. The PSR has proposed directing banks and other payment firms participating in CHAPS to reimburse their customers who have been victims of APP scams¹¹, but until that is in force a CHAPS transfer may fall outside the mandatory rules.
• Payments before 7 October 2024: the policy start date is 7 October 2024⁸, and earlier payments are excluded⁶.
• International payments and unlawful purposes: money sent abroad, or sent as part of an unlawful transaction, is not covered⁶.
• Civil disputes: where money was paid under a genuine agreement that went wrong, that is a dispute between the parties, not a scam refund⁶.

The legislation behind payment protections also contains its own boundaries. Regulation 76 of the Payment Services Regulations 2017 sets a deadline for refunds of unauthorised transactions, but that deadline does not apply where the provider has reasonable grounds to suspect fraudulent behaviour by the payment service user and notifies the relevant person under the Proceeds of Crime Act 2002 of those grounds in writing²⁰. Regulation 90 was amended to make clear that correct execution of a payment does not affect the PSR's ability to use its existing regulatory powers in relation to APP scams, and that nothing in the regulation affects a provider's liability where a payment order is executed subsequent to fraud or dishonesty²¹. Some protections are limited to consumers: regulations 41 and 42 do not apply to a person other than a consumer who accepts electronic money²², and where the payment service user is not a consumer, a micro-enterprise or a charity, the parties may agree that provisions of Part 6 of the PSRs do not apply²³.

Confirmation of Payee: the name check before you pay

Confirmation of Payee (CoP) is the industry-agreed way of ensuring that names of recipients are checked before payments are sent²⁴. It works by checking whether the name of the account a payer is sending money to matches the name they have entered, with alerts notifying the payer when there has not been a match²⁵. If the name does not match, you see that before the money leaves your account, which is the moment a scam can still be stopped.

The PSR drove this into place using its formal powers. Having first consulted on general directions for the implementation of Confirmation of Payee²⁴, it gave Specific Direction 10 requiring the implementation of Confirmation of Payee⁵. The direction followed earlier work in which the PSR confirmed it planned to consult by December 2018 on using its regulatory powers to give a general direction¹⁶.

Confirmation of Payee is one part of a wider set of interventions. The UK's payment firms have also seen additional interventions from the PSR to improve data sharing to spot and prevent scams, alongside the roll-out of the name-checking service¹⁷. The PSR has also consulted on the role of payment system operators in tackling APP scams, work that followed a super-complaint and is relevant to participants in regulated payment systems under the Financial Services (Banking Reform) Act 2013, payment service providers operating in the UK, consumers and consumer groups²⁶.

Card fees: what the PSR is doing about Mastercard and Visa charges

When you pay by card, the retailer pays fees, and part of those fees flows to the card schemes. The PSR is the main competent authority for the monitoring and enforcement of the UK Interchange Fee Regulation (IFR)²⁷, a role the Treasury gave it in the Payment Card Interchange Fee Regulations 2015¹⁴. That includes monitoring compliance with all provisions of the UK IFR, including caps and business rules²⁷. The PSR does not have the power to widen the scope of interchange fee regulation in the UK²⁸.

A central strand of the PSR's work concerns cross-border interchange fees, the fees charged on transactions between the UK and the European Economic Area. After Mastercard and Visa significantly raised some of these fees in 2021 and 2022²⁹, the PSR examined the level. Its interim report set out provisional concerns that Mastercard and Visa have likely raised these fees to an unduly high level, at the expense of UK businesses³⁰. The PSR has also reminded Mastercard and Visa of the need to assure themselves of their compliance with all legal obligations²⁸.

The wider market review asked whether the supply of scheme and processing services is working well, and how competition in that market impacts the fees Mastercard and Visa set³¹. Its call for evidence outlined four themes: the intensity of competition and innovation in the payments ecosystem; differences in the competitive dynamics on the issuing and acquiring sides of the market; the impact of transparency on competitive pressure at all levels of the value chain; and the must-take status of Mastercard- and Visa-branded cards in many retail environments³¹. The Treasury Committee has noted that the PSR consulted on plans to improve the transparency of scheme and processing fees for both merchants and acquirers³². For how these fees reach shoppers through prices, see card interchange and scheme fees.

Free-to-use cash machines and the LINK network

LINK is the network of cash machines that gives you access to your bank account from almost anywhere in the UK¹. It is the UK's largest ATM network, allowing cardholders to withdraw cash at any ATM connected to its network³³, and it is run by banks³⁴. The LINK ATM system is the main network that connects UK card issuers and providers of ATMs, enabling cardholders to obtain cash from their bank accounts³⁵. One boundary worth knowing: the LINK system is not involved with a cash withdrawal made at an ATM belonging to your own bank or building society³⁵.

The PSR's overall aim is to support cash access, including widespread geographic access, which meets the needs of UK consumers who need or want to use cash as a payment method³⁶. Its central tool has been Specific Direction 8 (SD8), issued to LINK in October 2018²¹, designed to make sure LINK does all it can to fulfil its commitment to maintain the broad geographical spread of free-to-use ATMs²¹. The PSR has said it will intervene if it believes the current broad geographical spread of free-to-use ATMs is threatened¹⁰. Its first annual review of SD8 found generally good progress in developing policies that meet LINK's commitment³⁶, and its second review continued to monitor LINK's commitment and to engage with LINK directly where it had concerns²¹. Many of the reasons that supported keeping SD8 in place until January 2022 were likely to apply beyond that date²¹.

LINK also runs a financial inclusion programme, available to deprived areas that do not have a free ATM within a kilometre of the nearest free-to-use ATM¹⁰. And LINK runs access to cash reviews when banks plan closures or if local residents ask for a review, which can result in new ATMs or banking hubs³⁴. These assessments are conducted by LINK, the ATM network operator run by banks¹⁵.

The division of labour between regulators has shifted. The PSR retains oversight of LINK as a designated payment system and works closely with the FCA in the FCA's oversight of LINK as a designated cash access coordination body³³. The PSR will continue to work with the FCA as the FCA assumes the lead role in protecting access to cash in the long term¹⁵. The PSR is also working with other authorities as part of the Joint Authorities Cash Strategy Group and with industry to develop longer-term solutions to society's ongoing need for access to cash³⁶. For the practical rules on branch closures and cash services, see the access to cash rules, and for requesting a review in your area, how to request a cash access assessment.

Problems with a payment: your bank first, then the Financial Ombudsman

When something goes wrong with a payment, the best thing to do first is contact your account provider, for example your bank². You can contact your financial provider by phone, and if you are still unhappy you can also contact the Financial Ombudsman Service¹.

The Ombudsman's process follows that order. Explain to your provider what you are unhappy about and the reasons why; if you are not happy with their response, you can bring the complaint to the Ombudsman with as much information as possible³⁷. For scam cases specifically, the Ombudsman can look at complaints about the bank or payment service provider that received your money, considering the steps taken to recover it and whether it should have had concerns about its customer's account⁴. Payment service providers are also required to inform payment service users of any right they may have to complain to the Financial Ombudsman Service²³.

The PSR itself is not on this route. It does not handle queries or complaints from consumers about individual payments², and it has no adjudicatory function and cannot consider individual complaints from consumers⁶. Where you have a question about the PSR's APP scams policy that is not answered in its existing publications, it asks firms directly impacted to email it⁸, but that channel is for firms, not for individual victims. For a comparison of the routes, see Financial Ombudsman or court and FSCS or Financial Ombudsman.

Scams that pretend to come from the PSR

The PSR has warned that fraudsters have sent members of the public emails posing as PSR staff asking for money³⁸. Scammers may contact you by email, post or a phone call, and claim to be from the PSR or use the name of an employee, to appear genuine³⁸.

The warning signs the PSR lists are practical ones: an overseas contact phone number, or an email address from a hotmail or gmail account, along with spelling mistakes and poor grammar³⁸. All PSR email addresses come from its own domain, so a request from a free email account is not from the PSR.

This follows the general rule for all regulator impersonation scams: use contact details you look up yourself, never the ones the caller gives you. For the wider picture of how these scams work, see scams and fraud.