Authorised Push Payment fraud and the Economic Crime and Corporate Transparency Act 2023

Companies should be aware of new protections relating to Authorised Push Payment fraud (APP Fraud) and the Economic Crime and Corporate Transparency Act 2023.

APP fraud

APP fraud is where a fraudster tricks a payer into making a payment to an account controlled by that fraudster. This differs from other kinds of fraud, such as where a fraudster steals money from an account without the owner of the account knowing, because in APP Fraud, the account owner authorises the payment, although under false pretences.

APP fraud has quickly become one of the most significant types of fraud, both in the UK and globally with losses totaling nearly £500 million in the last year.

The Payment Systems Regulator (PSR) has confirmed new requirements for banks and payment companies that it hopes will ensure more people will get their money back if they are a victim of APP fraud.

Specifically, there will be new rules in Faster Payments – the payment system across which the vast majority of APP fraud currently takes place. All payment firms will be incentivised to take action, with both sending and receiving firms splitting the costs of reimbursement 50:50.

Customers will be better protected under consistent minimum standards, with most APP fraud victims being reimbursed within five business days and additional protections offered for vulnerable customers. Further points to note include:

• The start date of the requirement to reimburse is 7 October 2024
• The time limit to submit an APP fraud claim is 13 months after making the last payment
• The maximum reimbursement level is £415,000 per claim
• Sending firms may, however, choose to reimburse a value exceeding the maximum reimbursement level of £415,000
• Sending firms will be allowed to levy an excess of up to £100 per claim.

The new requirements are welcome news for businesses, particularly following the decision of the Supreme Court in Philipp v Barclays Bank UK plc [2023] which reversed the expansion of the Quincecare duty. The Quincecare duty, which requires a bank to avoid carrying out a customer’s instruction to make payment where it is put on inquiry that the payment in question is an attempt to fraudulently obtain the customer’s funds, has been the focus of extensive litigation for a number of years.

The Economic Crime and Corporate Transparency Act 2023

Following Russia’s invasion of Ukraine, the UK government put in place the Economic Crime (Transparency and Enforcement) Act 2022 which created a Register of Overseas Entities to help crack down on foreign criminals using UK property to launder money and strengthened the UK’s Unexplained Wealth Order regime to better support law enforcement investigations.

More recently, the Economic Crime and Corporate Transparency Act 2023, which received Royal Assent on 26 October 2023, is intended to deliver wider-ranging reforms to tackle economic crime and improve transparency over corporate entities and includes:

• Reforms to Companies House
• Reforms to prevent the abuse of limited partnerships
• Additional powers to seize and recover suspected criminal cryptoassets
• Reforms to give businesses more confidence to share information in order to tackle money laundering and other economic crime
• New intelligence gathering powers for law enforcement and removal of unnecessary burdens on business.

Of particular significance is the creation of a new failure to prevent fraud offence. When the offence is in force, an organisation will be liable where a specified fraud offence is committed by an employee or agent, for the organisation’s benefit, and the organisation does not have reasonable fraud prevention procedures in place. It will not be necessary to demonstrate that company bosses ordered or knew about the fraud.

The offence will apply to all large bodies corporate, subsidiaries and partnerships. This means that in addition to businesses, large not-for-profit organisations such as charities will also be in scope, as well as incorporated public bodies.

The offence will apply to all sectors. However, to ensure burdens on business are proportionate, only large organisations will be in scope – defined (using the standard Companies Act 2006 definition) as organisations meeting two out of three of the following criteria: more than 250 employees, more than £36 million turnover and more than £18 million in total assets.

A conviction may result in an unlimited fine. There will however be a defence if the organisation has reasonable procedures in place to prevent fraud and we are awaiting government guidance, which must be published before the new offence comes into force. It is therefore anticipated the new offence will come into force in late 2024/ early 2025.