Beyond Reimbursement: Why Upstream Fraud Intelligence Matters When You Are Not the Sending PSP

The Fraud That Never Shows Up as a Sending Payment

Article 4 established that Consumer Duty is a prevention obligation, and closed on the observation that the Duty reaches further than reimbursement liability does. For institutions that have correctly concluded they carry no reimbursement risk, that observation raises a direct question. If reimbursement is not the hook, what is?

One Step Upstream of the Scam Payment

Consider how an APP fraud actually touches a savings-and-mortgage mutual. The member, coached by a criminal over days or weeks (see

Article 2), withdraws funds to the nominated account in their own name, then makes the scam payment from their current account at another institution. On paper, the mutual never sent a fraudulent payment.

In substance, the mutual was the source of funds, saw the drawdown, and held the deepest relationship with the member. The kill chain ran through its ledger one step before the payment that PSR rules attach to. Treating that as another firm’s perimeter is exactly the reading of foreseeable harm that the Duty forecloses.

The available interventions at that point are limited. Withdrawal friction arrives late, is blunt, and taxes every legitimate member to catch one coached one. Intelligence that operates before the member is compromised, while they are still interacting with the criminal’s site or message, is the only intervention that precedes the drawdown itself.

Where PSR Scope Ends, and Why That Settles Less Than It Seems

The Relevant-Accounts Test

The PSR’s mandatory reimbursement requirement directs “all PSPs participating in the Faster Payments Scheme that provide relevant accounts” to reimburse eligible APP scam claims from 7 October 2024.³ Accounts that permit withdrawal only to a nominated account in the member’s own name do not, on that test, generate sending-PSP liability. This is a reading of the test rather than a PSR statement naming these institutions, and each firm should confirm its own position.

The same scope logic reaches beyond the mutual sector. Any FCA-regulated firm serving retail clients without providing relevant accounts under Faster Payments, from advice firms to wealth managers, carries the Duty’s obligations without carrying reimbursement liability. This article concentrates on mutuals, where the operational pattern above arises most directly, but the principle is general.

A Boundary Under Review, Not a Settled Fact

Scope positions established in 2024 should not be treated as permanent. The FCA has stated it will consult in H1 2026 on clarifying the application and requirements of the Consumer Duty, and an independent evaluation of the PSR’s APP fraud policies is due to conclude in Q3 2026.¹ An institution whose fraud posture depends entirely on sitting outside one regime is exposed to that regime’s next revision.

What the Regulator Asked of Boards in March 2026

From Policy Alignment to Demonstrable Outcomes

The FCA’s Regulatory Priorities report for retail banking, published 12 March 2026, replaced portfolio letters as the annual statement of supervisory expectations for the sector’s boards and chief executives.¹ Fighting fraud and financial crime is one of its four priorities, and its Consumer Duty section presses firms to keep improving the data and management information their boards use to monitor customer outcomes, with specific reference to customers in vulnerable circumstances.

Read against the annual Consumer Duty board reporting cycle, that expectation converts into a concrete question for a non-PSR institution. When the next report asserts that the firm acts to avoid foreseeable harm to members in vulnerable circumstances, what fraud-specific data will sit behind that sentence? Warnings literature and branch training are activity; the regulator’s 2026 emphasis is on evidence of outcomes.

Upstream Intelligence as a Strategic Asset

What Pre-Compromise Detection Adds That Later Controls Cannot

APP fraud losses reached £576.4 million across the UK in 2025, up 19 per cent year on year, with roughly two thirds of APP fraud originating online.⁴ Controls positioned at the point of payment, or at the point of withdrawal, only ever see the final steps of a chain that began on the member’s device (see Article 2).

Detection that operates before compromise produces two distinct assets. It produces protection, for the member who never reaches a drawdown because they were never successfully deceived. It also produces intelligence: a live picture of what the institution’s own members are being targeted with, which no transaction feed can supply.

The case is sharpest for members in vulnerable circumstances, the cohort most exposed to social engineering and least able to absorb a loss. The same detection extends value across the full membership as coverage grows, and the intelligence it generates feeds precisely the outcome monitoring the FCA’s March 2026 report demands.

Remove reimbursement liability from the picture entirely and each leg stands alone: the foreseeable-harm obligation, the duty of care members join a mutual for, the intelligence value of pre-compromise detection, and trust economics. A mutual’s trust asset has a specific erosion mode: the member who loses savings they held with you, however the payment left, tells other members exactly where the money sat.

What a Fraud Case Still Costs Without Reimbursement Liability

Fair and Reasonable Is Not the Same as Not Liable

A defrauded member does not vanish from the institution’s cost base because reimbursement rules do not apply. Complaint handling, member contact, and internal investigation still happen, and a complaint that escalates goes to the Financial Ombudsman Service, which decides on a fair and reasonable basis rather than by reference to PSR scope. The Ombudsman can award compensation for distress, inconvenience and other non-financial impact even where no reimbursement rule is engaged.⁶

An institution that can evidence what it did before the loss, not only what its terms permitted, defends those complaints from a different position. An institution that cannot is arguing policy against a jurisdiction built to weigh fairness.

The case fee is the floor of the cost, not its measure. Article 6 will set out the complete cost cascade of a single fraud case, from detection through investigation to remediation, across every institution type regardless of PSR scope.