What the first evaluation of APP fraud reimbursement means for SMB operators
The UK’s mandatory reimbursement regime for authorised push payment fraud has now been running long enough to produce independent evidence, and the results carry direct implications for how SMB finance leads think about banking relationships and payment risk.
The headline numbers. An independent review by Frontier Economics, published by the Payment Systems Regulator on 1 July 2026, found that APP scam losses sent over Faster Payments fell by around 21% since the reimbursement requirement took effect, equivalent to roughly £73 million a year. Reimbursement of confirmed losses by value rose from 54% before the policy to 65% after it. The PSR frames this as evidence the regime is working broadly as intended, with no sign of firms exiting the market or of the reckless consumer behaviour some critics predicted.
Where the evidence gets uneven. The review also surfaces a wide spread in how payment service providers apply the rules. Reimbursement rates ranged from 21% to 94% across firms, driven partly by inconsistent data recording but also by genuine divergence in how PSPs apply the Consumer Standard of Caution — the exception allowing a firm to withhold reimbursement where a customer is judged not to have taken enough care. One firm applied that exception in over a quarter of cases by value; others applied it in none. For a business owner, this means the strength of fraud protection now depends materially on which PSP holds the account, not just on the existence of the rule.
The relevant shift for SMBs. Since receiving firms now share liability alongside sending firms, any business holding a UK payment account carries a form of exposure it did not have before October 2024 — if funds pass through that account as part of a fraud chain, the receiving PSP’s conduct and controls become part of the claim. Frontier also found that fraud is migrating to channels the requirement does not reach: out-of-scope international APP scams rose from £21 million in 2023 to £60 million in 2025, and scams routed to crypto exchanges rose from an estimated £59 million to £153 million over the same period.
What this signals ahead. The PSR has said it will consult on changes in December 2026, with the caution-exception divergence and the scope gaps likely candidates for tightening. For finance leads reviewing banking providers or payment rails this year, provider-level reimbursement performance is now a legitimate due-diligence question, not a background assumption.
