APP fraud reimbursement rules: is this claim in scope?

The APP fraud reimbursement rules require a UK bank or payment firm to reimburse a customer who was tricked into sending money by Faster Payments or CHAPS, on or after 7 October 2024, to a UK account they did not control, either to the wrong person or for a purpose that turned out to be false. The customer must be an individual, a microenterprise or a charity with income under £1 million, and should report within 13 months of the last payment. The bank pays up to £85,000 per claim within five business days, may deduct an excess of up to £100 unless the customer is vulnerable, and may refuse only for the customer's own fraud or proven gross negligence. The rule leaves each judgment to the sending bank, and scope is the first one: whether each payment in the claim is covered at all. Botminds' APP Fraud Reimbursement answers that question payment by payment, with its confidence and the passage of the rules it rests on, for a handler to confirm.

This guide is written for handlers and the people who train them. It sets out the scope test as a sequence of questions, explains each one from the PSR's texts, and collects the edge cases the PSR has answered in its consolidated policy statement.

What are the APP fraud reimbursement rules?

They are the PSR's reimbursement requirement, set in its legal instruments and written into the payment schemes' own rules. Parliament required the PSR to introduce reimbursement in the Financial Services and Markets Act 2023. The PSR did it through Specific Requirement 1, which made Pay.UK put the requirement into the Faster Payments scheme rules, and Specific Direction 20, which requires firms to follow those rules. For CHAPS, the Bank of England wrote equivalent rules and the PSR directed CHAPS participants to follow them; the PSR says the CHAPS requirements are "substantially the same as for Faster Payments".

The PSR's consolidated policy statement, PS25/5, is the plain-language reference, with one warning: where it differs from the legal instruments or the scheme rules, the latter prevail. A handler checking a borderline case should read the definition, not the summary.

Which payments are covered?

Faster Payments and CHAPS payments that the customer authorised, executed by their bank in the UK and received in a UK account the customer does not control, made on or after 7 October 2024. Specific Requirement 1 defines the covered payment as one that "is not to the recipient the consumer intended, or is not for the purpose the consumer intended." Every kind of scam qualifies if it fits: "All types of APP fraud, regardless of the character or methods of the fraud itself, are within the scope of the new reimbursement requirement."

The exclusions are listed in the policy statement: payments over other payment systems, payments before 7 October 2024, international payments, payments for unlawful purposes, and civil disputes. Accounts provided by credit unions, municipal banks and national savings banks are not "relevant accounts", so payments from or to them fall outside. The PSR's consumer page adds that card, cash and cheque payments "have their own protections in place."

Two location rules trip handlers. Where the customer or fraudster lives does not matter; what matters is that the payment was executed in the UK and received in an account held in the UK, which can include some virtual or "borderless" accounts with UK sort codes. And "UK" means Great Britain and Northern Ireland: an account held in the Channel Islands is not held in the UK for these rules.

Are businesses covered by APP reimbursement?

Small ones. The rules protect individuals, microenterprises and charities. Specific Requirement 1 defines a microenterprise as an enterprise that employs fewer than ten people and has an annual turnover or balance sheet total of no more than €2 million, and a charity as one with annual income under £1 million. A business above those thresholds is outside the rules, though it may still complain to the Financial Ombudsman if it is otherwise eligible.

For a handler the practical step is to establish which the customer is at the start, from the account type and what the bank knows of the business, because the answer decides whether the five-day clock applies at all. In the solution's fictional sample queue, an invoice and mandate scam against a joinery company is marked as a microenterprise claim and runs under the rules like any personal claim.

Six payments, each with the warnings shown before it

How long do victims have to claim?

Thirteen months from the final payment in the claim. Banks "can deny APP scam claims submitted more than 13 months after the final payment in a given claim." Because the limit runs from the last payment, a scam that went on for a year can include payments made two years before the report, provided the last was within 13 months.

The time limit is separate from the duty to report promptly. A customer who reports within 13 months can still fail the consumer standard of caution if they delayed with gross negligence after realising they had been scammed, although the guidance sets a high bar for that. A bank may reimburse a claim reported after 13 months, but the payment is voluntary and the receiving bank owes no share. The PSR's 2026 roadmap says its summer engagement covered the 13-month reporting requirement, so this is one rule to watch.

What is the £100 excess?

An optional deduction the sending bank may make from each claim, of any amount up to £100, or none. The PSR's consumer page puts it simply: firms may apply the excess, choose a lower amount, or not use it at all, and "This excess cannot be applied to vulnerable consumers." It applies once per claim, not per payment, so a six-payment scam carries one excess.

The Financial Ombudsman gives the consequence for small claims: a customer who lost £56 to a fake trainers seller, where the bank applies the excess fairly, receives nothing under the rules. How the excess affects what the receiving bank pays, and whether to charge it at all, are policy questions covered in APP fraud reimbursement policy.

What is first-party fraud in an APP claim?

It is where the person claiming took part in the fraud or is claiming dishonestly, and it is one of only two exceptions to reimbursement. Specific Requirement 1 is explicit: "if the consumer is party to the fraud or dishonesty, this is not an APP scam" for the purposes of the rules, and a reimbursable payment is one where the victim is not claiming fraudulently or dishonestly to have been defrauded.

Suspicion is not a finding. Where the bank has evidence of fraud by the claimant, it may stop the clock to gather information from the receiving bank, law enforcement or others. Any suspicion report goes to the bank's financial crime team under its own legal duties, and nothing about it can appear in a letter to the customer. In Botminds' solution suspicion reports are restricted to the money laundering reporting officer's team, and the Letter agent checks that no letter mentions one.

Scam, unauthorised payment or civil dispute?

The rules cover only scams: payments the customer authorised because they were deceived. A payment made by a fraudster who had taken control of the account is unauthorised and falls under different rules. A payment to a genuine supplier that failed to deliver is a civil dispute. The PSR has published separate guidance on telling a scam from a civil dispute, and its 2026 roadmap lists further guidance on civil disputes among the topics for its December consultation.

The distinction is often found in the customer's own words. A customer who says "I gave him my login so he could set up the investment" may be describing an unauthorised payment; one who says "he told me to move it to a safe account" is describing a scam. The PSR's answer to question 14 in PS25/5 settles the first: payments executed by a fraudster exercising control over the account are not within scope, though they may qualify as unauthorised payments.

Edge cases the PSR has answered

The PSR's consolidated policy statement answers 22 questions firms asked after the rules were published. The ones that come up most on a claims desk are below.

Multi-step scams are a policy area still being refined. The policy statement says plainly that the rules apply to multi-step payments, and one of the five permitted reasons to stop the clock is to gather information from the other firms involved. But each step must still meet the definition, and money moved to an account the customer controls is not an APP scam payment. The PSR's roadmap lists me-to-me transactions among the areas where it will consult on clarity. Meanwhile the Financial Ombudsman notes that the PSR "expects PSPs to consider payments made between accounts at the same PSP under the new rules", even though such internal transfers do not cross Faster Payments.

A claim only partly in scope

Many claims mix covered and uncovered payments, and the rules are applied payment by payment. A romance scam that began in September 2024 has payments before and after 7 October 2024; only the later ones are covered. An investment scam may combine a Faster Payment to a UK mule account with a card payment to a crypto platform; only the first is covered. A bank may reimburse the rest voluntarily, but the receiving bank's share is calculated only on the reimbursable payments.

The volumes show how much triage the scope test does. Over the regime's first 18 months consumers reported around 438,300 claims, of which 301,500 were in scope (PSR dashboard). The rest failed at least one of the questions above.

In Botminds' solution the Assessment agent answers scope for every payment: the payment system, the date, whether the payee account is a UK relevant account, whether the customer is a consumer, microenterprise or charity, the 13-month limit and the £85,000 maximum. Each answer carries its confidence and the passage it rests on, and below 0.85 confidence it asks the handler. The solution's fictional queue shows claims marked "Partly in scope" and "Out of scope" beside ordinary ones, so the handler sees the triage before opening the claim.

Partly in scope, out of scope and microenterprise claims in one queue

Once scope is settled, the remaining questions are gross negligence, set out in the consumer standard of caution exception, and the amount, which the £85,000 limit caps.

Questions people ask

Are CHAPS payments covered by APP fraud reimbursement?

Yes. The Bank of England's CHAPS reimbursement rules took effect on 7 October 2024, the same day as the Faster Payments rules, with the same £85,000 maximum and the consumer standard of caution exception. The PSR's published dashboard data covers Faster Payments only.

Is a payment to a crypto exchange covered?

A payment to an account the customer controls, including their own account at a crypto exchange, is not an APP scam payment, and a loss that happens later in cryptocurrency is on another payment system. A Faster Payment straight to a fraudster's UK account is covered whatever the scam involved.

Are international payments covered?

No. The rules cover payments executed in the UK and received into an account held in the UK. A virtual account with a UK sort code and account number can count as held in the UK even if its holder lives abroad.

Do the rules cover scams before 7 October 2024?

No. Earlier payments are outside the rules, though a bank that signed the voluntary Contingent Reimbursement Model Code may reimburse under it, and the customer can complain to the Financial Ombudsman, which considers the earlier code and the bank's own conduct.

Is purchase fraud covered by APP reimbursement?

Yes, if the customer paid by bank transfer to a fraudster rather than a genuine seller; the PSR's survey found almost 60% of APP fraud victims fell for purchase scams. A genuine seller that failed to deliver is a civil dispute instead.