The Payment Systems Regulator (PSR) has issued Specific Direction 17 to extend the use of Confirmation of Payee (CoP) to a broader range of payment service providers (PSPs). This direction aims to enhance security and reduce authorised push payment (APP) scams and misdirected payments. A crucial deadline is set for Group 2 firms to implement these changes by October 31, 2024. This article delves into the specifics of the PSR’s role, the scope and provisions of the direction, the timeline and the next steps for in-scope firms.
What is Confirmation of Payee and how does it work?
CoP is an account name verification service, effectively validating account names before payment initiation. It has led to enhanced confidence in UK domestic payments by ensuring funds are directed to the intended account holder. The service’s utility is also proven for customers making payments to unfamiliar accounts, reinforcing the overall reliability of financial transactions and reducing the risk of errors. In the Payment System Regulator’s Specific Direction 2017 (PSR SD17), the PSR established that Confirmation of Payee is now a requirement for directed PSPs.
When initiating a new payment, PSPs using CoP are able to verify essential details such as the name, sort code, account number and further reference data (e.g. building society roll number, account type). They cross-reference information with payee account records and outcomes fall into four possible categories:
- A positive confirmation for correct account names,
- A “Close Match” for similar names that require additional verification or clarification,
- A negative response for mismatches prompting customers to check payee details,
- An “Unavailable” outcome due to factors like timeout, customer opt-out, or non-existent accounts.
Who is the PSR and what is Its Role?
The Payment Systems Regulator (PSR) is the body established under Part 5 of the Financial Services (Banking Reform) Act 2013 (FSBRA) to oversee payment systems in the UK. Its primary role is to ensure that payment systems are operated and developed in a way that promotes the interests of businesses and consumers. The PSR aims to enhance competition, innovation, and the interests of service users within payment systems.
Scope of Direction 17
Specific Direction 17 mandates that PSPs from both Group 1 and Group 2 must implement and use systems to send and respond to CoP requests.
- Group 1 is comprised of PSPs listed on the Schedule, which had the earlier deadline of 31 October 2023 to have set up and begun using the system to send and respond to CoP requests. They were prioritised by the PSR based on complexity and size, alongside the projected impact of their use of CoP on APP fraud prevention.
- Group 2 is comprised of the rest of the directed PSPs, who will be subject to the 31st of October 2024 deadline. As defined in SD17, this is any other PSP lacking a CoP system in regular operation (as of the date of direction), and that is a participant in Faster Payments/CHAPS, conducts relevant business, possesses a unique sort code listed on the Extended Industry Sort Code Database (EISCD), and/or is a building society.
Considerations and Provisions Outlined in the Direction
- Implementation Requirements:
PSPs must establish systems to send and respond to CoP requests as per the CoP rules and standards. CoP requests must be made when customers provide information about new payees or amend details of existing payees.
- Notification and Compliance:
PSPs must notify the PSR within 28 days once their CoP systems are in place. If a PSP foresees difficulties in meeting the deadlines, it must inform the PSR, outlining the reasons and steps being taken to comply.
- Applicable Date:
- Group 1 PSPs must comply by October 31, 2023.
- Group 2 PSPs must comply by October 31, 2024.
- Exemptions:
The PSR may exempt PSPs from certain obligations or adjust deadlines if deemed necessary or appropriate.
- Monitoring:
The PSR retains the right to request information on compliance and may publish details of exemptions or adjustments.
Timeline of Provisions
- October 24, 2022: Specific Direction 17 comes into force.
- October 31, 2023: Deadline for Group 1 PSPs to implement CoP systems.
- October 31, 2024: Deadline for Group 2 PSPs to implement CoP systems.
- November 1, 2026: Direction ceases unless extended or varied by the PSR.
Next Steps for In-Scope Firms
For Group 2 firms, the key immediate actions include:
- System Development:
- Develop or upgrade systems to comply with CoP requirements by the specified deadline.
- Internal Reviews and Testing:
- Conduct thorough testing of CoP systems to ensure functionality and compliance with PSR standards.
- Notification to PSR:
- Notify the PSR upon successful implementation of CoP systems or if there are anticipated delays.
- Continuous Compliance:
- Regularly review and update systems to maintain ongoing compliance and adapt to any changes in CoP rules and standards.
In conclusion, the PSR’s Specific Direction 17 significantly impacts Group 2 firms, mandating the implementation of robust CoP systems by October 31, 2024. Firms must take proactive steps to develop, test, and notify the PSR about their compliance status, ensuring enhanced security and accuracy in payment processing.
How Complyport can help
Appropriate compliance frameworks and systems and controls are essential to ensuring fraud prevention, consumer protection and security and undisrupted business continuity of your company’s services. Complyport’s specialised team can ensure your company meets the latest regulatory standards and best practices. The services we offer include:
- Compliance Review
- AML Audit
- Operational Resilience & Business Continuity Audit
- SWIFT Attestation
- Consumer Duty Implementation Review
Complete the form below to book a FREE consultation.
Ask ViCA, your Virtual Compliance Assistant. Claim your complimentary 20 queries today!
