PSR Fines Bank of Ireland UK £3.7m for Confirmation of Payee Failure

The Payment Systems Regulator (PSR) has fined Bank of Ireland UK for failing to implement Confirmation of Payee by the required deadline.

Bank of Ireland UK plc (BOIUK) has been fined £3,779,300 for implementing a system to send requests for Confirmation of Payee (CoP) checks 14 months after the deadline. As a result, the safeguard was not applied to transactions involving more than 1.14 million new payees, with payments totalling approximately £6.9 billion.

BOIUK were directed to have a system in place to send and receive CoP requests by 31 October 2023. CoP allows people to confirm the account they’re sending money to is the one they expect. It’s an important mechanism in combating fraud and in giving people confidence when making online payments.

Payment service providers had ample time to put the measure in place, after the PSR confirmed the requirement in October 2022. BOIUK were the last Group 1 payment service provider to achieve compliance.

David Geale, Managing Director at the PSR said: “Confirmation of Payee is a vital tool to combat fraud and misdirected payments, giving people confidence that their money is going exactly where they intend.

“Bank of Ireland UK had plenty of time to put the system in place, missing the deadline by more than a year put its customers at increased risk of fraud. Where we see firms  failing to comply with the Confirmation of Payee requirements and leaving customers without this critical protection, we will use our powers to intervene to make sure this important direction is followed.”

Notes to editors:

• The PSR opened an investigation on 10 July 2024. The full decision notice has been published.
• BOIUK agreed to settle at an early stage of the enforcement decision-making process. BOIUK therefore qualified for a 30% early settlement discount under the PSR’s settlement procedures. Were it not for this discount, the PSR would have imposed a financial penalty of £5.4m.
• BOIUK failed to comply with the send requirements of paragraphs 3.1 of Specific Direction 17 (SD17).
• The PSR has published the decision notice and details of the penalty payable by BOIUK in respect of its non-compliance.
• The PSR published Specific Direction 17 on 11 October 2022 and its provisions came into force on 24 October 2022. SD17 built on the PSR’s earlier work under Specific Direction 10 in 2019, which required the six largest banking groups to implement CoP, and aimed to achieve widespread adoption of CoP protections. As a Group 1 PSP, BOIUK was directed to have and use a system to send and receive CoP requests by 31 October 2023. SD17 required two different cohorts of directed PSPs (Group 1 and Group 2) to implement and use CoP in accordance with different timescales. SD17 prioritised Group 1 PSPs based on the complexity and size of the institutions, and on the impact the PSP adopting CoP would likely have on preventing APP scams and misdirected payments.
• The PSR has published a full list of the PSR’s enforcement cases.
• The Government has been clear that payment systems must continue to be effectively regulated. Until any legislative changes take effect, the PSR will continue to carry out its statutory functions as usual.