An APP fraud reimbursement policy is a bank's written decision on every point the UK's reimbursement rules leave open: whether and when to take the optional £100 excess, whether to reimburse more than the rules require, which decisions get a second reviewer, how requests for information are made and how long customers have to answer, what letters look like, and who may change any of it. The rules fix the rest, from the five-business-day deadline to the protection for vulnerable customers, and a policy should say so rather than restate them as choices. Each choice moves money, sometimes between the bank and its customer, sometimes between the bank and the receiving bank, so each should be written down, approved and versioned. Botminds' APP Fraud Reimbursement holds the policy as settings, changed only with a second administrator's approval, and every claim shows which setting it was decided under.
This guide is for policy owners and the administrators who keep claims systems in line with policy. It separates what the rules fix from what they leave to you, works through the decisions that cost money, and ends with how to keep the policy auditable.
The settings an APP reimbursement policy needs, and the rule behind each
- Excess: none, a fixed amount up to £100, or conditional
Optional and once per claim (SR1 paras 5.20 and 5.21); never for a vulnerable customer whose vulnerability had a material impact.
- Receiving firm’s share when no excess is taken
Whether to claim the full half or half less £50 where vulnerability barred the excess; settle your reading against the scheme rules.
- Voluntary reimbursement
Whether to pay above £85,000, beyond 13 months or after a claim has closed; none of it can be shared with the receiving firm.
- Second-review thresholds
Which refusals and which amounts get a full second review before the letter goes.
- Release checks
Whether every reimbursement, refusal letter and payment out to another firm needs a second person.
- Requests for information
Standard reply windows and chase steps that meet the guidance on proportionate requests and reasonable time frames.
- Who confirms vulnerability, and on what evidence
A specialist’s judgment of material impact, recorded with a note.
- Letters
Plain language, reading age, formats for customers who need them, and the Ombudsman wording.
- Reason codes and overrides
The codes for refusals, part refusals and changed amounts, and who may override a proposal.
- Change control
Who may change a setting, who approves it, and how claims show the version that applied.
What goes in an APP reimbursement policy?
The decisions the rules leave to the bank, each with its reason and an owner. A policy that restates the rules adds nothing; a policy that leaves the open decisions to individual handlers produces the inconsistency the PSR's July 2026 evaluation found across the industry. The useful test for each line is: if two handlers read it, would they reach the same answer on the same claim?
The rules are explicit that some of these are choices. On the excess, the sending bank "must decide whether to apply the excess, whether at the maximum value (£100) or lower (any value up to the maximum is permitted) to a reimbursable APP scam claim. The sending PSP also has the option to not apply an excess at all." On the maximum, firms may choose to reimburse more than £85,000. On a rejected claim, the PSR does not prohibit reconsidering it. Each of those is a policy decision whether or not anyone wrote it down.
What do the rules fix, and what do they leave to the bank?
The rules fix the timetable, the exceptions, the protections for vulnerable customers, the burden of proof and the split between banks. They leave the bank its excess, its generosity, its controls and its way of working.
Fixed by the rules, and left to the bank
| Topic | Fixed by the rules | Left to the bank’s policy |
|---|---|---|
| Timing | Five business days; stops only for five purposes; close by the 35th business day; notify receiving firms within two hours | Internal alerts, reply windows for customers, when a stopped claim goes to a reviewer |
| Amount | Up to £85,000 per claim; excess up to £100, once per claim | Whether to take the excess, and how much; whether to pay above £85,000 voluntarily |
| Time limit to claim | The bank may deny claims reported more than 13 months after the last payment | Whether to reimburse late claims voluntarily |
| Refusal | Only for first-party fraud or proven gross negligence; the burden of proof is the bank’s | Who reviews a refusal, and at what amount a second review is mandatory |
| Vulnerability | No excess and no caution exception where vulnerability had a material impact; the FCA’s definition | Who judges it, with what training, and how it is recorded |
| Customer communication | Written reasons before the claim closes | Letter format, reading age, accessible formats, and wording approved by compliance |
| The other bank | Half of the reimbursement, claimed only after the refund; the excess deduction rule | How quickly to claim, how to chase, and how to read the barred-excess case |
Should a bank charge the £100 excess?
It depends on whether the bank believes the excess changes behaviour enough to justify what it costs in refusals of small claims and in errors. The PSR allowed it for that reason: an excess helps manage moral hazard, the risk that customers take less care if they expect to be reimbursed. The PSR's data so far shows no sign of that risk: in the first quarter of 2026 the share of claims rejected for lack of care was the lowest since the policy began (PSR dashboard).
Two excess policies, and what each costs
Take £100 on every claim, except vulnerable customers: Nothing reimbursed under the rules, as the Ombudsman’s own example shows
Take no excess: Reimbursed in full
Take £100 on every claim, except vulnerable customers: Customer £100; each bank £4,450
Take no excess: Sending bank £4,550; receiving bank £4,450
Take £100 on every claim, except vulnerable customers: An excess taken from a customer later confirmed vulnerable must be refunded
Take no excess: None from the excess
Take £100 on every claim, except vulnerable customers: Every refund letter must explain a deduction
Take no excess: Simpler letters
Take £100 on every claim, except vulnerable customers: Straightforward: the split assumes the excess
Take no excess: Each contribution is £50 less than half, by rule
The cost of waiving is predictable. Where there is a single receiving bank and the sending bank chooses not to take the full excess, the receiving bank may deduct 50% of the maximum excess, £50, from its contribution. So, compared with charging, a policy of never charging costs the sending bank the full £100 on each shared claim: the customer keeps the £100, and the receiving bank still pays as if it had been taken. Multiply by the number of reimbursed claims to price it. A middle course is to take the excess only on claims above a size where £100 is a small share of the loss.
The error cost is easier to miss. In the solution's fictional sample month, the Consistency agent found 11 claims where a handler had taken the £100 excess from a customer whose vulnerability was later confirmed. Each needed a £100 refund and a release check. A policy of charging the excess needs a vulnerability check that comes before the deduction, not after.
What happens to the receiving bank if the excess is waived?
It pays £50 less than half. The PSR's consolidated policy statement gives the principle in one line:
"All 50-50 liability splits must be calculated on the assumption that a £100 claim excess has been applied."
PSR, PS25/5 consolidated policy statement, para 3.34
Where there are several receiving banks, they share the £50 deduction in proportion to their liability for the reimbursable part of the claim, by the method Pay.UK sets in the scheme rules. The policy question is how the bank treats a claim where it did not choose to waive the excess but was barred from taking it, because the customer was vulnerable. Specific Requirement 1 ties the receiving bank's deduction to the case where the sending bank "chooses not to apply the maximum claim excess value", while paragraph 3.34 of the policy statement speaks of all splits. The two texts can be read differently, and the bank should settle its reading against the Faster Payments and CHAPS scheme rules, record it, and apply it the same way every time so that receiving banks know what to expect. Botminds' solution offers both readings as a setting rather than choosing for the bank.
Can a firm reimburse more than £85,000?
Yes, but the extra is voluntary, outside the rules, and not shared. Specific Requirement 1 says a reimbursement above the maximum "will be a voluntary reimbursement", and the receiving bank is not liable for any voluntary reimbursement. The same applies to claims reimbursed after the 13-month limit and to any payment made after a claim has closed, including one ordered by the Financial Ombudsman or a court.
That makes voluntary reimbursement a policy decision with a clear price: every pound above the rules is a pound the sending bank bears alone. A bank may choose to pay above the cap where its own controls failed, because the Ombudsman can award more than £85,000 against a bank it finds at fault. The APP fraud reimbursement limit page works through that case.
Who reviews a refusal?
Someone other than the person who decided it, at least for every refusal on grounds of gross negligence. The rules do not prescribe roles, but they put the burden of proof on the bank and require written reasons, and the Financial Ombudsman will test the intervention a refusal relies on. A second review is the bank's own test before the Ombudsman's.
The thresholds are policy. Botminds' solution ships with a full second review for every refusal on gross negligence, which cannot be switched off, and for every claim over £30,000, which can be changed. It also requires a second person to check every release of money, every refusal letter and every payment out to another firm. In the solution's fictional sample, a £34,200 investment scam claim with a part refusal crossed both lines and went to the claims quality reviewer before anything was sent. How a refusal file is built is covered in the consumer standard of caution exception.
The solution's default settings, each changeable only with a second administrator
£30,000
claims above this get a full second review
changeable
Every
refusal on gross negligence is read twice
fixed
0.85
confidence below which an agent asks a person
changeable
9
reading age or lower for outcome letters
changeable
Who approves policy changes?
A named policy owner, with a second person approving the change itself. Changing the excess, a review threshold or a letter template changes outcomes for customers, and the change should carry the same control as a decision on a claim. The most common failure is not a bad policy but an undocumented one: a threshold changed in a system without anyone being able to say when, by whom or why.
In Botminds' solution, administrators change settings, and every change to a limit, a role or an agent needs a second administrator. The head of fraud operations may grant a policy exception on an individual claim under its own reason code, but cannot change settings. A handler cannot be given the reviewer role on a claim they decided, and every override of a proposal is recorded with its reason code.
Roles and settings: each change needs a second administrator
How should policy versions be recorded?
So that any claim can be traced to the policy version in force when it was decided. When the Ombudsman asks why a customer was charged an excess in March, the answer has to be the March policy, not today's. The same applies to a regulator's request for a period, and to the rule changes that the PSR has planned: its consultation in December 2026 and decision in May 2027 may change how claims beyond 35 days, investment returns or caution are treated, and claims decided before and after will need different explanations.
Three things make a version usable: an effective date, the approver, and the rule passage each setting rests on. The last matters because the rules themselves will move to the FCA by transitional provisions, and a setting that cites "SR1 para 5.20" can be remapped once if the instrument is renumbered. Firms already report monthly claims data to Pay.UK (PSR, Deadlines for firms), and the policy version behind each decision is the natural companion to that data.
Your policy as settings, in the solution
In Botminds' APP Fraud Reimbursement, the reimbursement policy is a set of settings that every claim is checked against: the second-review threshold, fixed second reviews of gross-negligence refusals, release checks, the excess (never, above £1,000, or always except vulnerable), the receiving firm's share when the excess is barred, the confidence below which agents ask a person, the clocks with UK bank holidays and a day-4 alert, and letters at reading age 9 or lower in the formats each customer needs. Each answer on a claim shows the setting and the rule passage it rests on.
A vulnerability finding changes the settings that apply to the claim
What the solution does not do is choose the bank's policy. The defaults are a starting point; the bank decides its excess, its thresholds, its reading of the barred-excess case and its voluntary payments, and the solution applies them consistently and keeps the evidence. How the policy's money choices add up across a year of claims is set out in the APP fraud reimbursement scheme.
Questions people ask
Do all banks charge the £100 APP excess?
No. The excess is optional: firms may take up to £100, a lower amount, or nothing, and may not take it from a vulnerable customer whose vulnerability had a material impact. Policies differ by firm, so the same claim can be paid in full at one bank and less £100 at another.
Can the excess be taken from each payment in a scam?
No. Specific Requirement 1 allows a single claim excess for each claim, so a scam with six payments carries one excess at most.
Should an APP policy set a deadline for customers to answer questions?
It should set reasonable reply windows and chase steps. The PSR's guidance says firms should not impose unreasonably short time frames, should limit requests to essential information, and should not treat a reluctant customer's silence as gross negligence without considering why.
Who should own the APP reimbursement policy?
Usually the head of fraud operations or an equivalent senior owner, with compliance approving letter wording and changes approved by a second person. The owner should be able to show which version applied to any claim.
Does the policy need to cover CHAPS separately?
The Bank of England's CHAPS rules are aligned with the Faster Payments rules, with the same £85,000 maximum and the caution exception, so one policy can usually cover both. Where the scheme rules differ in detail, the policy should say which applies.