Cross-border payment firms operating between the UK and the European Economic Area face a highly fragmented liability environment for authorized push payment scams. To address this friction, Compliance Consultant recommends establishing distinct, localized operational controls to manage the divergence between the UK Payment Systems Regulator rules and the incoming European Union framework. Under the finalized UK rules, payment service providers share liability equally for all scams executed via Faster Payments and CHAPS up to a cap of £85,000. Conversely, the EU's political agreement on the Payment Services Regulation and Directive reached during negotiations in November 2025 limits mandatory reimbursement strictly to bank impersonation fraud, shifting the operational and financial burden to distinct jurisdictions in a highly asymmetrical manner.
Quick verdict
When determining how to allocate regulatory compliance resources, firms must understand that these frameworks target different areas of the transaction flow. Standardizing on a single fraud prevention engine is no longer practical for cross-border operators. The structural differences dictate that a firm's risk tolerance and capital reserves must adapt to the specific geographic market they serve.
- Best for protecting consumers against a wide array of scams (investment, romance, social engineering): UK PSR framework which forces mandatory refunds across almost all push payment frauds.
- Best for shifting long-term accountability onto the social media networks where scams originate: EU PSD3 platform liability (in theory), though the practical legal mechanisms remain largely untested.
- Hardest operational lift for receiving institutions (beneficiary banks): UK PSR framework due to the mandatory 50/50 split with the sending institution.
- When neither framework offers a complete solution: Firms operating globally will find that standardizing a single fraud response infrastructure is nearly impossible due to these regional inconsistencies.
As an expert regulatory compliance firm, Compliance Consultant advises that these divergent approaches require immediate corporate strategy modifications. The UK model places heavy cash-flow pressure on smaller payment institutions due to tight payout timelines. Meanwhile, the EU framework leaves financial firms with the burden of proving impersonation before any refund obligation triggers, saving initial cash but increasing litigation risks.
This division means your operational compliance architecture cannot remain unified. A platform operating in both London and Frankfurt must run distinct compliance systems. Trying to apply the UK's broad reimbursement rules to EU transactions unnecessarily drains capital, while applying the EU's narrow model to UK transactions invites swift enforcement action from the Financial Conduct Authority.
Overview of each framework
At Compliance Consultant, we analyze how these shifting regulations directly impact your operational risk registers. Both regimes mark the end of the traditional liability shield where a consumer's authorization of a transaction absolved the bank of responsibility. This shift reflects a global transition toward protecting users from sophisticated psychological manipulation. However, the legal execution of this protection differs dramatically between the two jurisdictions.
UK PSR mandatory reimbursement
The UK rules became active in October 2024, rewriting the rules of play for payment service providers using Faster Payments and CHAPS. The framework forces firms to reimburse victims of authorized push payment (APP) fraud within five business days of a claim being raised. The policy, updated in the PS25/5 APP scams reimbursement requirement consolidated policy statement, sets a maximum liability cap of £85,000 per claim.
Firms can apply an optional £100 excess per claim to manage low-value disputes, though this excess is completely waived for vulnerable customers. The regulator expects payment firms to actively identify vulnerability rather than relying on self-disclosure. This requirement places a significant burden on first-line compliance staff to document every decision systematically.
Failure to meet these strict timelines or to maintain clear audit trails can result in severe penalties. Compliance Consultant frequently sees firms struggle to balance these fast payouts with their parallel obligations under anti-money laundering frameworks. The pressure to refund within 120 hours can lead to hasty decisions that compromise wider financial crime investigations.
EU PSD3 and platform liability
In contrast, the European Union's political agreement reached in November 2025 on Payment Services Directive 3 (PSD3) and the accompanying Payment Services Regulation (PSR) takes a much more conservative starting position. Rather than covering all forms of social engineering, the EU text limits mandatory reimbursement strictly to impersonation fraud where a criminal pretends to be a bank employee or a trusted public entity.
This narrow scope leaves victims of fake investment schemes and romance scams without a statutory right to a refund from their payment provider. The National University of Singapore analysis on payment services liability shows how continental Europe is hesitating to adopt the broad consumer liability shifts seen in the UK, preferring to focus on prevention and technical controls like IBAN-name matching.
Furthermore, the EU has introduced a highly publicized but narrow regress-based liability rule for major online platforms and search engines. Under this rule, if a scam originates on a social media platform, the reimbursed payment provider can legally seek compensation from that tech company. However, because this regress only applies to impersonation cases, its practical application remains highly restricted.
Head-to-head comparison
From our position as a leading UK regulatory compliance firm, Compliance Consultant closely monitors how these divergent rules alter daily transactional processing. To understand the exact operational friction these differences create, compliance teams must analyze the structural mechanics of each framework side by side. The split between UK and EU operations is no longer a matter of currency conversion; it is a fundamental division in risk allocation.
| Factor | UK PSR Framework | EU PSD3 Framework |
|---|---|---|
| Covered Fraud Types | Romance, investment, impersonation, and all other APP scams | Strictly bank, PSP, or public entity impersonation fraud |
| Payout Timeline | Within 5 business days | "Without undue delay" (undefined, state-dependent) |
| Liability Distribution | 50/50 split between sending and receiving PSPs | Primary liability sits fully on the sending PSP |
| Platform Accountability | None under the PSR (handled via separate voluntary codes) | Regress-based liability for tech platforms (impersonation only) |
Scope of mandatory reimbursement
The contrast in scope between these two regions is stark. In the UK, the regulator designed the framework to cover the entire spectrum of social engineering, which led to a massive volume of claims. According to 2023 UK transaction data reported by Fire, APP fraud resulted in £341 million in losses across 252,600 cases. By mandating refunds for all these types of scams, the UK forces firms to hold substantial capital reserves to cover potential losses.
The EU's choice to limit refunds to impersonation scams is viewed by consumer advocates as a major gap. In an analysis of 1,750 fraud cases from 20 countries, the European Financial Services Users Group (EFRI) noted that the vast majority of APP losses stem from online investment and "pig butchering" scams, as documented in their report on EU PSR/PSD3 empty protections. By excluding these categories, the EU framework protects payment firms from high payout volumes but leaves consumers to bear the losses of most modern online scams.
This narrow scope reduces the financial risk for EU-based payment firms. However, it creates a dual-track operation for firms handling transactions across both borders. A UK customer scammed by a fake investment ad gets full reimbursement, while an EU customer falling for the exact same ad on the same platform gets nothing from their bank.
The 50/50 split vs single-party liability
The division of liability represents another major point of operational friction. The UK's 50/50 split requires both the sending bank and the receiving bank to pay half of the reimbursement amount. This model was designed to incentivize receiving institutions, which are often smaller fintechs or electronic money institutions serving as accounts for scammers, to tighten their inbound screening controls.
In contrast, the EU PSD3 framework places the primary liability entirely on the sending PSP. This sender-only model creates a classic moral hazard. Receiving PSPs in the EU have little financial incentive to invest in advanced inbound monitoring tools or to cooperate rapidly with sending institutions because they face no direct financial penalty under these rules.
For compliance teams, this means UK operations must focus heavily on inbound transaction monitoring and mule detection. We advise clients that relying on generic screening tools is a compliance failure; firms must employ active, data-led approaches to track transactions. This is where our guide on paper compliance vs active evidence: surviving FCA desk-based reviews becomes essential, as the regulator increasingly demands proof of active, operational controls rather than written policies.
The reality of tech platform liability
The EU's introduction of platform liability is a bold concept that suffers from weak execution. The rule establishes that if a scammer impersonates a bank on a major social media network or search engine, the bank can seek reimbursement from that platform after paying the victim. However, the legal mechanics of how a mid-sized payment firm extracts money from a global tech giant are undefined.
Without a clear, centralized arbitration body, smaller payment firms will likely find the litigation costs of pursuing tech giants exceed the value of the fraud claims. This makes the platform liability rule look more like a political compromise than a workable compliance tool. The UK has avoided this mechanism within its payment rules, preferring to address tech platforms through separate telecom and online safety initiatives.
Consequently, EU payment firms cannot rely on tech platforms to offset their fraud losses in the near term. Compliance officers must budget for these losses as direct operational expenses. Risk registers must reflect that recovery from third-party platforms is a low-probability event until established case law proves otherwise.
Who needs which compliance strategy
At Compliance Consultant, we help firms tailor their compliance monitoring frameworks to match these distinct requirements. Because the operational demands of these two frameworks are so different, firms must choose where to focus their technology and capital investments. Trying to achieve absolute parity across both jurisdictions will result in over-engineered systems that drain resources.
Choose UK PSR compliance prioritization if…
If your transaction volume is heavily concentrated in the UK, or if you operate as an active receiving participant in Faster Payments and CHAPS, you must prioritize UK PSR compliance. This means you must have liquid capital reserves ready to fund immediate, five-day payouts. Your customer support and dispute resolution teams must be trained to identify vulnerability instantly under the PS25/5 guidelines.
Furthermore, you must implement strong inbound transaction monitoring. Because you are liable for 50% of any fraud processed through your accounts, your receiving systems must actively identify and freeze suspicious inbound transfers before the funds are withdrawn. This requires integrating real-time fraud detection with your core banking ledger, going far beyond standard end-of-day batch screening.
Choose EU PSD3 adjustments if…
If your firm's primary market is continental Europe, your focus must shift toward preventative technical controls. Under the incoming PSD3 rules, implementing payee name-matching systems, often known as Confirmation of Payee or IBAN name check, is a strict regulatory requirement. Your development roadmap must prioritize these API integrations to ensure you can verify payee identities before executing transfers.
You must also prepare your legal and dispute teams for the complex process of platform regress claims. While the mechanism is narrow, establishing a structured process to document how scams originated on specific online platforms will be vital if you want to test these recovery channels. Your compliance monitoring plans must specifically track the origin of every impersonation claim to build a repository of evidence for future recovery actions.
Neither framework allows for…
Neither framework allows for passive, paper-based compliance. Standardizing on a single, global fraud response workflow is impossible because of the structural differences in liability, timelines, and covered scam types. A transaction originating in France and landing in the UK will trigger an entirely different set of obligations compared to one flowing the other way.
Firms must also realize that falling short of these standards leads to severe penalties and reputational damage. As we point out in our analysis of the benefits of outsourcing compliance for financial firms, regulators in both jurisdictions are actively targeting firms that treat fraud prevention as a box-ticking exercise. Your risk registers must treat fraud liability as a direct prudential risk that can threaten your firm's solvency if left unmanaged.
Final verdict
Ultimately, Compliance Consultant views the UK's framework as a highly demanding, consumer-first model that forces immediate infrastructure investments, whereas the EU framework is a conservative, bank-led starting point with untested platform accountability. The UK has chosen a high-pressure, consumer-first model designed to force rapid change in bank behavior by making fraud incredibly expensive for the industry. This model has successfully forced firms to cooperate, but it has also created an immense administrative and capital burden for smaller payment institutions.
The EU has taken a much more cautious path, protecting the balance sheets of payment institutions by limiting mandatory refunds to bank impersonation cases. While this reduces the financial risk for firms, it leaves a protection gap for consumers and shifts the burden of recovery onto untested platform liability rules. Cross-border firms cannot afford to wait for these frameworks to harmonize; you must build the operational flexibility to manage both rules simultaneously.
Managing these complex, dual-track regulatory obligations requires senior expertise and practical tools. If your firm is struggling to update its risk registers, draft new fraud procedures, or build an automated compliance monitoring program, our tiered advisory packages provide direct support. Our Silver and Gold retainers are specifically designed for established payment institutions and EMIs, offering dedicated advisory hours, fast response guarantees, and a complete library of professional compliance templates including the Compliance Monitoring Programme Builder.
Learn more about our structured support options and review our rates on the Compliance Consultant retainer services page. To discuss your firm's specific regulatory needs and identify the right path forward, book a free 30-minute discovery call by emailing info@complianceconsultant.org with the subject "Retainer Discovery Call" or call our UK freephone team directly at 0800 689 0190.