A customer sends money to a scammer, then discovers the fraud. For years, that customer often bore the loss. Now regulators in the UK, EU, Switzerland and Singapore are putting more responsibility on financial institutions and spelling out the controls they expect. For banks, the stakes go beyond alerts: reimbursement costs, regulatory scrutiny and customer trust are all on the line.

Regulators are responding to a practical problem: scams. Instant payments, social engineering and AI-generated impersonation can help criminals move money through mule networks in seconds. Banks may not see where the deception began, but they see the payment and hold data that could reveal the risk. Regulators increasingly expect them to use it before the money moves.

The EU’s Instant Payments Regulation (IPR) makes the link between speed and safety tangible. As instant payments become mandatory, safeguards must keep pace. These include Verification of Payee and daily customer sanctions screening. Those checks help make faster payments safe enough for routine use.

The financial stakes are already visible in the UK. Mandatory reimbursement rules for authorised push payment (APP) fraud took effect in October 2024. Payment Systems Regulator data through March 2026 shows that victims were reimbursed for 88% of money lost to in-scope APP scams. [1] Sending and receiving firms split the cost. Both sides have a reason to act. Banks need to protect outbound payments and identify mule activity in inbound flows.

In the euro area, the IPR has made Verification of Payee mandatory since October 2025; non-euro member states follow in July 2027. For instant euro transfers, the approach to sanctions checks has also shifted from screening each payment to screening customers at least daily. The goal is to maintain safeguards without slowing a real-time payment to a crawl.

The EU’s proposed Payment Services Regulation would take that expectation further. It is also abbreviated PSR, but is distinct from the UK regulator. Publication was anticipated around the end of 2026. Core provisions were expected around 2028. Under the proposal, payment service providers could be liable for customer losses if they fail to put adequate fraud prevention in place. It also addresses refunds for bank-impersonation fraud and calls for stronger transaction monitoring. Other measures include broader fraud-data sharing and the use of AI where it helps detect risk. The detailed technical standards are still being written. Banks should track the final requirements rather than treat every proposed provision as settled.

Other jurisdictions are tackling the same problem from different angles. In Switzerland, FINMA’s Guidance 02/2026 sets out expectations for fraud governance. Banks should monitor emerging trends and test their controls. They should also prevent the misuse of accounts opened online and connect fraud and anti-money-laundering (AML) controls. The survey behind the guidance found that 42% of banks surveyed had no digital-fraud policy. [2,3] In Singapore, the Shared Responsibility Framework has been in effect since December 2024. It requires banks to carry out real-time fraud surveillance, impose cooling-off periods and provide a customer “kill switch.” Banks that fail their duties can bear the loss.

But should banks carry all of the burden? They are often best placed to see and stop a suspicious payment. Yet the scam may have started with a fake investment ad or a spoofed message. It may have begun as a relationship built over weeks on a messaging app. By the time a customer opens a banking app, the deception may be well underway.

Banks see the payment, but the scam may have started elsewhere. Singapore’s framework places duties on telcos, including blocking SMS messages with malicious links. Telcos are next in line after banks to cover losses. Under the proposed EU PSR, an online platform could also be liable. If it fails to remove fraudulent content after being notified, it could owe money to a payment service provider that refunded a victim. In the UK, reimbursement duties currently sit with payment firms, and extending responsibility beyond them remains a matter of debate. Whatever balance each market strikes, banks still need to strengthen their own controls.

 

The practical question for banks

What does this mean for a bank’s fraud strategy? Requirements vary by jurisdiction, but the direction is clear. Banks need to connect prevention across the payment journey, not just respond when an alert fires. They need to assess both sides of a transaction and understand customer behaviour across channels. They also need to show why a decision was made. In practical terms, banks should focus on:

  • Real-time, behaviour-based monitoring of both incoming and outgoing payments, before the money moves.
  • Customer-level profiling across accounts and channels, so banks can spot mule activity and behaviour that doesn't fit the customer's normal pattern.
  • Continuous sanctions screening that can keep up with real-time payments.
  • Data sharing between banks, and with telcos and online platforms.
  • Explainable, auditable decisions that hold up when a reimbursement claim is challenged.

A suspicious outbound transfer may be easier to assess when a team can also see signals from the receiving account. Bringing behaviour, payment and account data together helps investigators connect those clues. Screening and data sharing add context, while clear records show why a decision was made. The point is not to generate more alerts. It is to help teams intervene before a loss and explain the decisions they took.

Payments Fraud Defense can help banks bring payment and behavioural signals together to spot suspicious activity before funds move. It gives fraud teams a more connected view of risk without treating every unusual payment as the same kind of threat.

There is still time to prepare for the next wave of rules. The detailed standards behind the EU PSR remain in development. The EU’s new AML rules (AMLR) apply from 10 July 2027. But banks can ask a key question now: if a scam got through today, could we show that we had the right controls in place? Could we show that we used them effectively? As liability shifts, banks need to monitor risk in real time, connect signals and explain their decisions. Payments Fraud Defense can support that work by helping teams identify suspicious payments and make more informed decisions before funds move. Those steps can help banks protect customers and manage their own exposure.

Footnotes

  1. Payment Systems Regulator, APP scams reimbursement dashboard for Q1 2026, updated 30 July 2026. psr.org.uk [psr.org.uk]
  2. FINMA, Guidance 02/2026: Digital fraud risks for banks and persons under Article 1b of the Banking Act, 9 April 2026. finma.ch [finma.ch]
  3. Finance Magnates, 42% of Swiss Financial Firms Have No Digital Fraud Policy, FINMA Finds, 9 April 2026. financemagnates.com [financemagnates.com]