What Mandatory Reimbursement Actually Changed: Assessing the APP Regime Against Its Own Promises in 2026

Mandatory reimbursement for authorised push payment fraud was argued for on three grounds, and it is now old enough that the three can be assessed separately rather than defended as a package. The first argument was economic: put the loss where the control sits and firms will invest in prevention. The second was structural: split the liability between sending and receiving firms and receiving institutions will finally care about the accounts that receive the money. The third was social: consumers who have been deceived should not bear a loss they had no realistic means of avoiding.

Those three arguments have not held up equally, and the industry has been slow to say so. The first is largely vindicated, but in a narrower way than its advocates expected. The second is the most important of the three and the slowest to show results, which is exactly what should have been predicted and largely was not. The third has worked, and it has produced a second-order problem that firms find genuinely awkward to discuss in public because the vocabulary available for discussing it sounds like victim-blaming.

What follows is an assessment rather than a defence or a critique. The regime has changed behaviour. It has changed it unevenly, in places its designers did not target, and it has moved a measurable amount of criminal activity into typologies and rails where the reimbursement obligation does not reach. All of that is compatible with the regime being, on balance, the right intervention. It is not compatible with the complacency that has settled over parts of the market since the implementation deadlines passed.

Regulatory and Market Context

The design of the regime is unusual and its details are behavioural instruments, not accounting details. The fifty-fifty allocation between sending and receiving firm was chosen precisely because a purely sending-side liability would have left receiving institutions with no financial stake in the accounts through which the proceeds move. The maximum reimbursement level was set to cap tail exposure for smaller payment firms, and the optional excess was included to preserve a small element of customer care without making the protection illusory. Each of these is a lever on behaviour rather than a way of dividing a bill, and the supervisory commentary from the Payment Systems Regulator and the Financial Conduct Authority has been consistent on that point.

The vulnerability exemption sits awkwardly inside this structure. Neither the excess nor the standard of caution expectation applies where the customer is vulnerable, which is correct in principle and difficult in operation, because vulnerability under the Consumer Duty is a broad and dynamic concept that a fraud case handler is being asked to apply at speed, on partial information, in a population where the fraud itself is often evidence of a temporary vulnerability. The result across the market is inconsistency: firms with very similar customer bases reaching materially different exemption rates, and few of them able to explain the difference from their own data.

What the Data Is Showing

TrustSphere's engagement data across sending and receiving institutions shows the prevention effect concentrated where the incentive is sharpest. Sending-side investment since the regime came into force has been substantial and visible: better payee-name matching logic, risk-scored and typology-specific warnings replacing generic ones, cooling-off and delayed-execution options on high-risk first-time payees, and a marked increase in the use of confirmation calls for larger transfers. Firms that have moved from generic to typology-specific interdiction report the largest reductions, and the reductions are concentrated in investment and impersonation typologies where a well-targeted warning has something specific to say.

The receiving side is a different picture and the more consequential one. Receiving-institution controls are harder to build, harder to demonstrate and almost invisible to the customer, which means they attract less internal sponsorship even where the liability is identical. The work that matters is unglamorous: onboarding controls that detect account-opening patterns associated with mule recruitment, in-life monitoring for the structural signature of a receiving account (rapid inbound from unrelated parties followed by immediate onward dispersal), and network analysis that connects accounts which individually look ordinary. Institutions that have invested here report results that are real but lagging, because the population they are trying to detect was largely recruited before the controls existed.

That lag is the single most misread feature of the regime. Receiving-side improvement was always going to show up years after sending-side improvement, because prevention at the sending side interrupts a transaction and prevention at the receiving side interrupts a network. Firms that judged their receiving-side programme against a twelve-month payback expectation and quietly deprioritised it made a category error, and several are now rebuilding capability they had begun to run down.

The consumer protection argument has worked. Reimbursement rates are high, they are far more consistent between firms than the pre-regime position, and the arbitrary variation that made the old landscape indefensible has largely gone. The cost is a first-party fraud problem that is now material and that the industry discusses in private and rarely in writing. TrustSphere's engagement data shows a rising share of claims exhibiting the signature of fabricated or exaggerated loss: claims from customers with no prior payment relationship pattern consistent with the story told, claims where the beneficiary account has a traceable connection to the claimant, repeat claimants across multiple institutions, and claims clustered around known coaching content. This is not a large majority of claims and nobody serious suggests it is. It is large enough to distort the loss figures used to justify investment decisions, and firms that do not separate it out are measuring the wrong thing.

The final observable pattern is displacement. Criminal activity has moved, as it always does, towards the edges of the regime's scope: purchase scams executed on card rails where the protection framework is different, cross-border transfers outside the domestic scheme, cryptoasset off-ramps reached through a first hop that does not look like a scam payment, and business-targeted variants where the payer is a company and the reimbursement obligation does not apply. Firms that measure only in-scope APP losses will see a flattering trend and will be reporting a partial one to their boards.

Implications for Financial Institutions

The first implication is that the receiving side is where the remaining value sits, and it needs to be governed as a distinct programme with its own metrics rather than absorbed into a general financial crime workplan. Mule detection, network analytics and account-opening controls have a longer payback than payment-time warnings and a larger eventual effect, and they will not survive a governance process that ranks initiatives on twelve-month loss reduction. Institutions should measure receiving-side performance directly: proportion of mule accounts identified before the first fraudulent inbound, time from first inbound to account restriction, and the share of funds still recoverable at the point of identification.

The second implication concerns the excess and the maximum. Both are behavioural instruments and both should be set with an explicit behavioural intention that is documented and reviewed. A firm applying the excess universally is making a statement about customer care that its own complaints and Consumer Duty outcomes data will eventually test. A firm applying it never is forgoing the only friction the regime permits it to place on claim behaviour. Neither position is wrong, but a firm that cannot articulate which it has chosen and why has not made a decision at all.

The third implication is that the vulnerability exemption needs a defensible and consistent operating standard. The variation TrustSphere observes between comparable firms is too wide to reflect genuine differences in customer populations. Firms should be able to show the evidential basis on which vulnerability is determined, the training and quality assurance around it, and the outcome distribution by segment. Supervisors are increasingly likely to ask, and a firm whose exemption rate is an artefact of case-handler discretion has a Consumer Duty problem rather than a fraud one.

The fourth implication is that first-party fraud has to be addressed openly and carefully. The correct posture is not suspicion of claimants; it is a specific, evidenced and separately governed workstream with a high evidential bar, clear escalation, and outcomes that are monitored for disparate impact. Firms that leave this undiscussed will find it managed informally by case handlers using intuition, which is both less accurate and considerably less defensible than an explicit process.

The fifth implication is measurement. Most firms measure reimbursement cost, in-scope volume and warning display rates. Almost none measure the four things that would tell them whether the regime is working for them: total customer scam loss including out-of-scope typologies and rails, warning effectiveness by typology as a measured abandonment rate rather than a display count, receiving-side detection latency, and funds recovery rate as a proportion of value received. Those are the numbers that reveal whether prevention is improving or whether losses have simply moved somewhere the report does not cover.

Conclusion

The regime has done most of what was claimed for it, and it has done so unevenly. Sending-side prevention improved quickly because the incentive was direct and the interventions were visible. Consumer outcomes improved decisively and consistently. Receiving-side accountability, which is the change with the greatest long-term potential, is progressing slowly because the controls are harder, the results are slower and the internal sponsorship is weaker. That is a resourcing and governance failure rather than a design failure, and it is fixable.

The honest assessment is that the regime moved liability successfully and moved criminal behaviour predictably. Both effects are real. Firms that treat the current loss trend as evidence that the problem is receding, without measuring the out-of-scope and cross-border displacement or separating first-party claims from third-party ones, are drawing comfort from an incomplete number. The institutions that will look competent in three years are the ones investing now in the receiving side, where the effect is slowest to appear and largest when it does.

Suggested Next Steps

• Establish receiving-side fraud prevention as a separately governed programme with its own metrics: pre-inbound mule identification rate, time from first suspicious inbound to restriction, and recoverable proportion of funds at identification.

• Replace warning display counts with measured effectiveness by typology, tracking abandonment and downstream claim rates for each warning variant, and retire warnings that demonstrably do not change behaviour.

• Document an explicit rationale for the excess and the maximum reimbursement level as behavioural choices, and review both annually against complaints, claim volume and Consumer Duty outcomes data.

• Build a consistent evidential standard for the vulnerability exemption with quality assurance and segment-level outcome monitoring, and report total customer scam loss including out-of-scope typologies, rails and business-customer variants alongside in-scope reimbursement cost.

Sources: Payment Systems Regulator policy statements and reporting on authorised push payment reimbursement; Financial Conduct Authority Consumer Duty and fraud supervision publications; UK Finance annual fraud reporting; National Crime Agency and National Economic Crime Centre assessments of money mule activity; Financial Action Task Force guidance on the laundering of fraud proceeds; Bank of England and Pay.UK operational material on Faster Payments; TrustSphere Risk Index, April 2026.

Companion vendor assessment: today's TrustSphere Risk Index post assesses ThetaRay against this problem. Read it at www.trustsphere.ai

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai