FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Crime and fraud
Since 7 October 2024, UK payment firms must reimburse authorised push payment fraud victims, but for businesses the protection covers only micro-enterprises and charities with annual income under £1 million. Most companies therefore still carry the loss themselves.
Part of: Commercial crime insurance
In short
The mandatory reimbursement requirement, made by the Payment Systems Regulator under section 72 of the Financial Services and Markets Act 2023, applies to Faster Payments and CHAPS payments made on or after 7 October 2024. It protects individuals, micro-enterprises and charities, up to £85,000 per claim, with an optional excess of up to £100 and a 13-month claim window. International payments are excluded. A micro-enterprise means fewer than 10 staff and turnover or balance sheet of no more than €2 million. Larger businesses should look at crime insurance with social engineering cover, subject to the insurer's acceptance and the policy terms.
Authorised push payment (APP) fraud is where you are tricked into sending money yourself, for example to a fake supplier account. The Supreme Court in Philipp v Barclays [2023] UKSC 25 noted that whether banks should reimburse victims is a matter of social policy for regulators and Parliament, and that section 72 of the Financial Services and Markets Act 2023 now provides for a mandatory scheme.
The Payment Systems Regulator's requirement started on 7 October 2024 and applies to payments made on or after that date over Faster Payments, with a parallel requirement for CHAPS. Both the sending and receiving payment firms are brought in: under the PSR's consolidated policy statement, the sending firm can require 50% of the reimbursement from the receiving firm.
The requirement protects individuals, micro-enterprises and charities. The definitions come from regulation 2 of the Payment Services Regulations 2017.
| Who sent the payment | Within the reimbursement rules? |
|---|---|
| An individual acting outside their trade, business or profession | Yes |
| Micro-enterprise: fewer than 10 staff and annual turnover or balance sheet total of no more than €2 million (EU Recommendation 2003/361/EC) | Yes |
| Charity with annual income less than £1 million | Yes |
| Small business with 10 or more staff, or above the financial threshold | No |
| Charity with annual income of £1 million or more | No |
| Medium or large company, partnership or public body | No |
One detail is easy to miss. Under the regulations, micro-enterprise status is judged at the time the contract for payment services is entered into, which in practice usually means when the account was opened. Ask your bank how it classifies you, and whether that has been reviewed as you have grown.
For a business, gross negligence is the risk to watch. Ignoring a Confirmation of Payee mismatch warning or a specific bank warning could be argued against you.
The Government plans to consolidate the PSR into the Financial Conduct Authority. Its consultation response of April 2026 says this will require primary legislation, to be brought forward when parliamentary time allows, and that the transfer will include requirements connected to the mandatory reimbursement regime. Once the functions move, the FCA will decide its own approach. In the meantime the PSR continues to act: in October 2026 it removed the expiry date from its Confirmation of Payee direction. As at October 2026 the PSR rules described here remain the ones that apply, but businesses should expect the regulator, and possibly the detail, to change.
Even an eligible micro-enterprise faces the £85,000 cap, the gross negligence exception and the exclusion of international payments. Everyone else has no statutory right at all, and after Philipp a bank following its customer's clear instruction generally owes no duty to refuse it.
Illustrative: an engineering firm with 40 staff pays £62,000 to a fraudster posing as its components supplier. It is not a micro-enterprise, so its bank has no obligation to reimburse. Without a crime policy carrying a social engineering extension, the firm bears the full loss.
Read invoice redirection fraud: who pays, CEO fraud and deepfake scams and crime vs cyber cover for payment fraud. Policy detail is in social engineering and fund transfer fraud and social engineering cover conditions. Charities near the £1 million line can also see our charity insurance guide.
Apex arranges commercial crime insurance, including social engineering and invoice fraud cover for businesses outside, or above the limits of, the reimbursement rules. A broker reads each enquiry and comes back with options, with no fee for a quote, and cover is subject to the insurer's acceptance and the policy terms. We need your business activities, turnover, location and claims history, plus staff numbers, typical payment sizes, whether you pay overseas, and your verification procedures.
See also: UK business fraud statistics
Only if the company is a micro-enterprise: fewer than 10 staff and annual turnover or balance sheet total of no more than €2 million, judged when the payment services contract was entered into. Charities with annual income under £1 million are also covered. Other companies fall outside the rules and need their own protection.
£85,000 per claim for Faster Payments and CHAPS payments made on or after 7 October 2024. Payment firms can choose to pay more, and may apply an optional excess of up to £100. Claims can be refused if made more than 13 months after the final payment in the claim.
No. The requirement covers UK payments over Faster Payments and CHAPS only. International transfers, card payments, cash and cheques are outside it. Many larger invoice and CEO frauds involve money moved abroad, which is one reason businesses still look at crime insurance with social engineering cover.
Yes. The rules allow refusal where the payer was complicit or acted with gross negligence, although gross negligence cannot be applied to vulnerable consumers. For a business, ignoring a clear bank warning or a Confirmation of Payee mismatch could be argued as gross negligence, so record why each payment was considered genuine.
As at October 2026, yes. The Government has confirmed plans to fold the PSR into the FCA, including the reimbursement regime, but its April 2026 consultation response says this needs primary legislation. Until that happens, the PSR's existing requirements continue to apply to payment firms.
Contact your own bank, the sending payment firm, as soon as you realise, and in any event within 13 months of the final payment. Give the details of each payment and how you were deceived. Reimbursement is expected within 5 business days, although the bank can pause the clock to gather information.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
