Author: James Borley, Director of Payment Services
The Payment Systems Regulator (PSR) has published Consultation Paper CP26/2 proposing significant changes to Specific Direction 17 (SD17), the regulatory instrument that underpins broad participation in the UK’s Confirmation of Payee (CoP) regime. The proposals are relatively modest in drafting terms, but potentially significant in their long-term implications for Payment Service Providers (PSPs) in the UK.
At its core, the Consultation seeks to achieve two objectives:
- Remove the current expiry date of SD17, which is due to lapse on 1 November 2026; and
- Consider expanding the scope of directed firms so that PSPs currently providing CoP voluntarily would become subject to the same regulatory obligations as firms already within scope.
For the payments sector, this represents another step in the transition of CoP from an anti-fraud initiative into an established and permanent component of the UK’s payments infrastructure.
Why the PSR is Acting
CoP was originally introduced to help combat both misdirected payments and certain forms of Authorised Push Payment (APP) fraud by verifying whether the payee’s name entered by a payer matches the account details held by the receiving PSP.
The regime has become deeply embedded within UK payments. According to the PSR, more than 320 organisations now offer CoP, with in excess of 2 million checks performed each day. The regulator points to evidence suggesting substantial reductions in payments sent to incorrect accounts and measurable reductions in fraud losses since implementation.
Against that backdrop, the PSR’s view appears straightforward: to allow the legal obligation underpinning broad market participation to expire would risk undermining a control that has become an essential consumer protection measure.
Proposal 1: Removing the Expiry Date
The most immediate proposal is to remove SD17’s sunset clause.
As matters currently stand, SD17 expires on 1 November 2026. The PSR believes that maintaining mandatory CoP participation remains necessary while the wider payments landscape continues to evolve. The regulator therefore proposes that the direction should continue indefinitely rather than operating under a fixed end date.
From an industry perspective, this proposal will not materially change day-to-day operational requirements. Most firms within scope have already invested heavily in CoP technology, governance, monitoring, and customer journeys (and messaging).
However, the Consultation provides a clear signal regarding regulatory direction of travel:
- CoP is no longer viewed as a temporary intervention;
- The PSR considers CoP a core consumer protection mechanism;
- Firms should assume that CoP obligations will remain a permanent feature of UK payments regulation.
For compliance teams, this would remove any lingering fears that the regime may be revisited or reduced in the near future.
Proposal 2: Expanding the Scope of Directed Firms
The more interesting aspect of the Consultation concerns the potential expansion of SD17’s scope.
A number of PSPs currently provide CoP on a voluntary basis (i.e. not caught by the ‘specific direction’). While these firms operate within the CoP ecosystem, they are not necessarily subject to the same direct regulatory obligations as firms specifically captured by SD17. The PSR is seeking views on whether those firms should now be brought formally within the direction.
The regulator’s rationale is centred on creating consistent regulatory treatment (and outcomes) across the market. If firms are already offering CoP services, the PSR questions whether it remains appropriate for some providers to be subject to mandatory obligations while others participate voluntarily.
This may appear a relatively technical change, but it carries several implications.
Increased Compliance Accountability
Firms currently participating voluntarily may become subject to:
- Explicit regulatory obligations;
- Formal compliance monitoring;
- Potential enforcement exposure;
- Ongoing governance and assurance requirements.
For some providers, particularly smaller firms, this could necessitate more structured compliance oversight around CoP controls and operational resilience.
Greater Regulatory Consistency
The proposal would help eliminate differing standards within the market.
A consistent framework is likely to be welcomed by larger PSPs that have invested significantly in implementing CoP requirements and may view uneven regulatory obligations as creating competitive disparities.
Future Market Entry Considerations
The Consultation suggests that future PSPs entering relevant payment systems may ultimately be expected to operate within the same CoP framework from the outset. This would reinforce CoP as a baseline market standard rather than an optional service enhancement.
Strategic Implications for Payments Firms
Whilst the Consultation is narrowly focused, firms should consider the broader regulatory context.
The UK regulatory framework around APP fraud has undergone significant expansion in recent years, including reimbursement requirements, stronger fraud controls, and increased expectations regarding preventative measures. CoP sits squarely within that broader agenda.
The Consultation therefore sends three important messages:
- Fraud Prevention Remains a Regulatory Priority
The PSR continues to view preventative controls as critical to protecting consumers and reducing fraud losses. Firms should expect continued scrutiny of customer safeguards rather than regulatory relaxation. And, it is likely that the Financial Conduct Authority (FCA) will also be interested in firms’ arrangements in this regard.
- Voluntary Participation May No Longer Be Sufficient
Where industry initiatives have achieved widespread adoption, regulators appear increasingly willing to formalise participation requirements. The distinction between voluntary and mandatory controls may continue to narrow.
- Infrastructure Standards Are Becoming Embedded
As payments infrastructure develops, controls such as CoP are becoming standard components of the UK’s payments ecosystem. Firms should view investment in these capabilities as part of ongoing business-as-usual compliance rather than one-off regulatory projects.
Conclusion
CP26/2 is unlikely to generate significant controversy. Few stakeholders are expected to argue that CoP has failed to deliver value, and the case for maintaining broad participation appears strong given current fraud and consumer protection priorities across both the PSR and FCA.
The more substantive debate will centre on whether PSPs currently participating voluntarily should now be formally brought within the regulatory perimeter. For many firms, the operational impact may be limited because they already provide CoP. The key change would be one of regulatory accountability rather than technology implementation.
CoP is no longer an emerging anti-fraud measure. It is becoming a permanent and foundational element of the UK’s payments control framework.
How Complyport Can Help
As regulatory expectations around CoP, APP fraud prevention and payment controls continue to evolve, firms should ensure their governance, policies and operational arrangements remain aligned with both PSR and FCA expectations.
Complyport supports payment service providers and other regulated firms by helping them:
- Assess the impact of new regulatory developments, including PSR Consultations and changes affecting payment service providers;
- Review governance and control frameworks to ensure payment processes and fraud prevention measures remain effective and compliant;
- Conduct gap analyses and compliance reviews against applicable regulatory requirements and industry best practice;
- Strengthen financial crime and fraud prevention frameworks, including controls designed to mitigate APP fraud risks;
- Support operational resilience and risk management for payment services and critical business processes;
- Provide regulatory horizon scanning to help firms identify, understand and prepare for upcoming regulatory changes;
- Deliver tailored compliance advisory and implementation support to assist firms in embedding new regulatory requirements into their policies, procedures and operational processes.
To discuss how these proposals may affect your firm, contact Complyport today to book a meeting with one of our Subject Matter Experts.
Ask ViCA, your Virtual Compliance Assistant. Claim your complimentary 20 queries today! Register here: https://vica.chat
