Review of the Contingent Reimbursement Model Code for Authorised Push Payment Scams Consultation Document July 2020 Driving fair customer outcomes CONTENTS 1. Introduction 4 1.1 Background 1.2 The role of the LSB 1.3 Engagement with stakeholders 1.4 Review of approach to reimbursement of customers 1.5 About this consultation 1.6 Who should respond 2. Implementation 8 2.1 The current version of the CRM code 2.2 Coverage and barriers to signing up 3. Customer experience 10 3.1 Reducing the impact on customers 3.2 Vulnerable customers 2020 4. Prevention measures 12 4.1 Awareness 4.2 Effective warnings 4.3 Confirmation of Payee 5. Resolving claims 14 5.1 The process of resolving claims 5.2 Funding the reimbursement of customers 6. Next steps 17 6.1 How to respond 6.2 Publication of consultation responses Annex 1: Full list of consultation questions 18 Review of the Contingent Reimbursement Model Code for Authorised Push Payment Scams 3 1. INTRODUCTION 1.1 BACKGROUND In September 2016, the consumer body The code designed, the Contingent Which? submitted a super-complaint to the Reimbursement Model (CRM) Code, was Payment Systems Regulator (PSR) regarding launched on 28 May 2019. The voluntary code Authorised Push Payments (APP) scams. The sets out good industry practice for preventing complaint raised concerns about the level of and responding to APP scams. It also sets protection for customers who fall victim to APP out the requisite level of care expected scams. The PSR investigated the issue and of customers to protect themselves from published its formal response in December APP scams. Currently there are nine firms, 2016. The response recognised that further comprising 19 brands, signed up to the Code: work was needed and made recommendations for actions to be taken by industry. • Barclays Bank UK plc Barclays In November 2017, the PSR published an update on the progress made. The PSR • The Co-Operative Bank recognised that there were still concerns Britannia and Smile around the reimbursement of victims of APP • HSBC UK scams and consulted on the introduction HSBC, First Direct and M&S Bank of a ‘contingent reimbursement model’. • Lloyds Banking Group In early 2018, taking into account responses Lloyds Bank plc, Halifax, Bank of to the consultation, the PSR established Scotland plc and Intelligent Finance a steering group with representatives • Metro Bank from industry and consumer groups. The • Nationwide Building Society steering group was tasked with designing and implementing an industry code which • NatWest Bank plc would reduce the impact that these crimes Royal Bank of Scotland plc, have on consumers, micro-enterprises and NatWest Bank and Ulster Bank small charities by introducing measures that • Santander UK would reduce the occurrence of APP scams Santander, Cahoot and Cater Allen Limited and see victims of APP scams reimbursed. • Starling Bank 4 1.2 THE ROLE OF THE LSB 1.3 ENGAGEMENT WITH STAKEHOLDERS On 1 July 2019, the Lending Standards Board (LSB) became the official governing Over the past year we have engaged with body for the CRM Code. The LSB is pivotal various interested stakeholders through in driving fair customer outcomes within a combination of bilateral meetings and financial services through independent through the continued meetings of the CRM oversight. Standards and Codes overseen Advisory Group which is formed of both by the LSB cover lending to personal and industry and consumer representatives. business customers, branch closures, and APP scams. The LSB is independent Based on our engagement to date, in its approach to setting Standards and stakeholders have raised a number of overseeing compliance of these standards. concerns about the Code and how it operates, including those regarding: Having assumed governorship of the CRM Code, the LSB’s role is to monitor the • the types of transactions that implementation of the Code, to ensure its are in scope of the Code; effectiveness, and to maintain and refine it. • liability requirements where In this role, the LSB has continued to engage either the sending or receiving with a range of stakeholders regarding bank sits outside the Code; the implementation of the Code and has • transaction monitoring requirements; undertaken a themed review of firms’ approach to reimbursement of customers. • operational costs of participating The LSB also committed to carrying out a full in the Code compared against review of the effectiveness of the Code and the level of scams that occur; its impact on the industry and consumers, • expectations for identifying payments one-year post-implementation. This which have a higher risk of being consultation will form the basis for this review. vulnerable, as well as identifying and treatment of vulnerable customers; and To provide context alongside this • the future funding mechanism for consultation, the following sections set 2020 out a summary of views collated through ‘no blame’ reimbursements. our stakeholder engagement and a A further key area of discussion has been summary of the review of firms’ approach around how to improve the coverage of to reimbursement of customers. the protections offered by the Code, both in terms of signing up new banks and in terms of taking steps to allow other key firms, such as building societies or Payment Initiation Service Providers (PISPs), to sign up to the Code or to offer similar protections. These concerns and considerations have been taken on board when drafting this consultation and are reflected in the questions included. Review of the Contingent Reimbursement Model Code for Authorised Push Payment Scams 5 1.4 REVIEW OF APPROACH As with the feedback from stakeholders, issues TO REIMBURSEMENT raised in this review have been taken into OF CUSTOMERS account in the drafting of this consultation and are reflected in the questions included. Between October 2019 and January 2020, the LSB carried out a review of the approach to reimbursement of customers under CRM 1.5 ABOUT THIS CONSULTATION Code provision R2(1)(c). The Code requires As set out above, this consultation will that where a customer has been the victim form the basis for the LSB’s one year post- of an APP scam, firms should reimburse the implementation review of the CRM Code. customer. Provision R2(1)(c) sets out that if the While the focus of the review is the Code, customer has not met a reasonable level of we are including within the scope of the care when making a payment, reimbursement review two supporting documents: can be denied. However, firms must be able to demonstrate that in all the circumstances at the time of the payment, in particular • the Practitioners Guide, which was the characteristics of the customer and the developed by the LSB and is made complexity and sophistication of the APP available to signatories to the Code scam, the customer made the payment to support them in achieving the without a reasonable basis for believing that: requirements of the CRM Code. The guide also contains supporting annexes. • the payee was the person the • the Information for Customers document, customer was expecting to pay; which was published to promote awareness of the Code and to inform • the payment was for genuine customers of the various ways in which goods or services; and/or they can reasonably protect themselves • the person or business with whom from falling victim to an APP scam. they transacted was legitimate. The consultation sets out questions The review included an assessment of the across four different areas: key controls and processes firms have in place to demonstrate compliance with the • Implementation - with questions seeking provision including considering how firms to establish any challenges firms have have interpreted the provision and assessing faced in adopting the Code, any barriers the level and depth of staff training. that exist to new firms signing up, and areas where the Code could be improved Overall, the LSB found that all firms involved to take account of insight gained over in the review had taken positive steps to the first year of implementation. implement the requirements of the Code for reimbursing customers. However, a number • Customer experience - with questions of key areas of improvement were identified seeking to establish whether the Code – reimbursements; effective warnings; has met its objective to increase the customer vulnerability and record keeping. proportion of customers protected from the impact of APP scams, both via reducing The LSB has issued individual reports to each incidents of scams and by reimbursement, firm which contain recommendations and and to determine what the experience required actions and will be working to ensure of victims of APP scams has been in the these are implemented, including tracking year since the Code was launched. through to completion. The LSB intends on completing a follow-up review exercise later in 2020 to ensure all actions are fully embedded. 6 • Prevention measures - with questions 1.6 WHO SHOULD RESPOND seeking to establish whether consumer education and awareness campaigns, Current Code signatories, other payment warnings, and Confirmation of Payee service providers, consumer representatives (CoP) are working effectively to support and the industry more generally will have an to the objectives of the Code. interest in the LSB’s review of the CRM Code and may want to respond to this consultation. • Resolving claims - with questions seeking to establish what challenges firms face While we have set out a range of questions when making a decision to reimburse in this consultation, further comment, a customer, including in relation to discussion and representations from how that reimbursement is funded. respondents are encouraged in respect of any of the elements of the Code. The responses to the consultation and the work undertaken as part of the wider Respondents are welcome, in the course review may be used to inform revisions to of their response, to provide suggestions the Code and to the supporting documents for changes to the Code or the supporting that fall within the scope of this work.