PSR Fines Bank of Ireland UK Over £3.7m for Failing to Implement Confirmation of Payee

WHY THIS MATTERS: The penalty levied against Bank of Ireland UK is far more than a simple regulatory infringement; it serves as a powerful industry statement that the UK’s Payment Systems Regulator (PSR) has zero tolerance for delaying critical consumer safeguards. This is fundamentally connected to the ongoing, escalating crisis of Authorized Push Payment (APP) fraud, where Confirmation of Payee (CoP) is the frontline defense. The true significance is that a 14-month compliance delay unnecessarily exposed transactions totaling £6.9 billion and over one million new payees to potential risk. For the wider market, the imposition of this fine confirms that operational sluggishness in implementing mandated regtech solutions carries a heavy financial and reputational cost, establishing a non-negotiable precedent that timely adherence to anti-fraud protocols is mandatory for all primary payment service providers.

The Payment Systems Regulator (PSR) has fined Bank of Ireland UK for failing to implement Confirmation of Payee by the required deadline.

Bank of Ireland UK plc (BOIUK) has been fined £3,779,300 for implementing a system to send requests for Confirmation of Payee (CoP) checks 14 months after the deadline. As a result, the safeguard was not applied to transactions involving more than 1.14 million new payees, with payments totalling approximately £6.9 billion.

BOIUK were directed to have a system in place to send and receive CoP requests by 31 October 2023. CoP allows people to confirm the account they’re sending money to is the one they expect. It’s an important mechanism in combating fraud and in giving people confidence when making online payments.

Payment service providers had ample time to put the measure in place, after the PSR confirmed the requirement in October 2022. BOIUK were the last Group 1 payment service provider to achieve compliance.

David Geale, Managing Director at the PSR said: “Confirmation of Payee is a vital tool to combat fraud and misdirected payments, giving people confidence that their money is going exactly where they intend.

“Bank of Ireland UK had plenty of time to put the system in place, missing the deadline by more than a year put its customers at increased risk of fraud. Where we see firms failing to comply with the Confirmation of Payee requirements and leaving customers without this critical protection, we will use our powers to intervene to make sure this important direction is followed.”

FF NEWS TAKE: This substantial financial penalty moves the needle by signaling an aggressive enforcement stance from the PSR, affirming that the era of soft deadlines for anti-fraud measures is unequivocally over. As the last Group 1 provider to comply, BOIUK is now a public example of the high price of non-compliance. We should watch for the immediate effect on other regulated entities, and anticipate the PSR will now swiftly turn its attention to broadening the scope of CoP mandates, potentially extending requirements to smaller payment service providers and new payment rails to ensure systemic protection is comprehensive.