What is Confirmation of Payee?

Introduced by Pay.UK, Confirmation of Payee (CoP) is an industry-wide initiative to help businesses and customers to minimise Authorised Push Payment (APP) Fraud and reduce the volume of payments being processed incorrectly, where a genuine human error is the underlying cause.

Prior to the launch of this service, a payer would provide their Bank or Payment Service Provider (PSP) with payee details including the name of the organisation or individual to be paid, along with the account number and sort code.

The payment would then be processed assuming the payer had entered accurate details. Whilst the bank account number and sort code were often verified as valid, there was no validation that the payee specified actually matched that of the account holder with the bank.

This creates a weakness that is regularly exploited by fraudsters using APP. Where a misapplied payment has been made, there is the additional challenge of recovering the money from the account it has been sent to.

The introduction of CoP provides a greater level of assurance for payments. It is a mandatory requirement that works by cross-referencing the account name with the account number and sort code in real-time for Faster Payments, CHAPS or when a new Standing Order is created. At the present time, it is optional for Bacs and Direct Debit payments to use CoP but this may be included in future phases.

There are over 14 different responses through technical reason codes but the main four possible outcomes are:

Yes - all details match.

No - the account name is a close match but not exact e.g. the name on account is ‘Joe Bloggs’

No - the account name does not match.

Data is unavailable (i.e. the site timed out or the account doesn’t exist).

This outcome is then followed by an additional step enabling the payer to confirm whether the transaction should proceed or be canceled. In a bid to curb potential fraud, corporates and consumers are forced to take more or better responsibility for the payments they process.

This additional step allows the bank or PSP to warn payers about the risks associated with submitting a payment when there is a mismatch between the beneficiary and the account details. Payers should be advised to stop and make further checks to verify the details with the payee in order to ensure use of full and correct banking details.

CoP introduced a new layer of payment protection and became mandatory for the six largest UK banking groups in 2020. It initially applied to payments made to or from transactional accounts in the UK and has since expanded to include accounts requiring secondary authentication data such as credit cards and ISAs too.

When did Confirmation of Payee start?

The introduction of CoP has two phases, the first of which is due for completion in summer 2021. Banks were given the directive by the Payment Systems Regulator (PSR) to fully implement CoP by June 30^th 2020. The major banking groups successfully launched on or before the deadline, and a number of other UK banks, building societies and PSPs have now followed.

Why has Confirmation of Payee been introduced?

In the UK, APP fraud accounted for losses totaling £479m in 2020 (Source: UK Finance), as payment scams increasingly moved online. However, only 25% of losses are ever recovered which highlights the urgency around implementing stronger preventative measures. CoP aims to minimise APP fraud and reduce the volume of payments that don’t reach the intended destination.

What general impact does Confirmation of Payee have?

CoP provides a greater degree of payment protection not only for the financial services sector but for corporates and individuals too.

In July 2020, shortly after the launch of the directive, the financial services sector was already reporting in excess of one million CoP requests per day (Source Pay.UK).

Over 90% of Faster Payment traffic is now managed through Confirmation of Payee

The industry take up has varied. Whilst 90% of Faster Payments are subject to CoP checks, smaller banks, building societies and businesses are lagging behind in terms of understanding and readiness for this new initiative (Source: Bottomline 2020 Business Payments Barometer).

Phase 1 of Confirmation of Payee applied to 396 qualifying UK banks. These banks are registered with the Financial Conduct Authority (FCA) and have their own sort code in the Extended Industry Sort Code Directory. The biggest six banks were forced to join Confirmation of Payee for outbound and inbound transactions before June 30^th 2020, through a Payment Systems Regulator mandate. Only a handful of more proactive banks have joined Phase 1 before it is predicted to close to new applicants at the end of June 2021 and move to Phase 2.

Phase 2, opens in July 2021 and will apply to inbound and outbound transactions for over 2,000 organisations such as Credit Unions, Crown Dependencies and Building Society HOCAs (Head Office Collections Accounts), which don’t own a sort code. Phase 1 will be supported in the transition to Phase 2 and further phases or capability extensions are expected in the future for businesses to use CoP for their outbound transactions.

What do I need to do to prepare for Confirmation of Payee?

“Any Banks or Corporates that are not doing Confirmation of Payee checks, are exposed to risk and potential liability for any losses incurred due to deliberate or accidental misdirection of funds.”

Ed Adshead-Grant, General Manager and Director, Payments, Bottomline Technologies

According to Pay.UK there are four criteria for enrolling in Phase 1 of CoP:

Be an account servicing PSP.

Have a sort code allocated with their own bank code in the Extended Industry Sort Code Directory (EISCD).

Be an FCA registered entity.

Be registered as a full member of Open Banking for Payment Services Directive 2 (PSD2) purposes.

There are three simple steps for banks and corporates to get started with CoP:

1. Enrol with the Pay.UK and Open Banking entities.
2. For inbound projects: Take extracts of the accounts to be verified and send these daily to your chosen Confirmation of Payee provider. 
3. For outbound projects: Communicate the new customer journey explaining the response codes that are generated when a CoP check has been completed.

How will Confirmation of Payee affect me?

Impact on banks: As a bank or financial institution, CoP can help prevent a significant amount of APP fraud and misdirected payments. Without CoP checks, banks are expected to become liable for any losses incurred.

The initial enrolment process takes just 20 minutes. If the bank is implementing a cloud-based solution for CoP like Bottomline’s solution, the project can be completed within a 6 week target.

For Outbound checks, the bank is provided with a controlled testing environment to replicate the new customer journey and help internal teams understand the process and reason codes that get returned.

For Inbound checks, accounts are sent overnight from the bank to a Service Provider such as Bottomline, via a secure link and can be updated through the day via API calls.

Impact on corporates: CoP provides Corporates with an additional level of control by verifying the beneficiary with the account number and sort code before requesting further approval for a transaction to take place. This creates greater confidence in the outbound payment process whilst also ensuring accidental misdirected payments do not occur. Corporates should ensure that all payment instructions and invoices should use the correct name, account number and sort code.

How can Bottomline help you take advantage of the Confirmation of Payee initiative?

Whether you’re a bank or corporate, Bottomline provides a fully integrated service delivering all the enrolment, set up, testing and reporting capabilities to integrate CoP into your customer journey. This provides banks and corporates with a seamless and proven service.

Summary

Historically, only 25% of APP losses are ever likely to be recovered. For businesses, APP Fraud costs on average, £25,000 per fraudulent transaction. This can have a significant impact on whoever is deemed liable for the loss.

Working with a specialist provider such as Bottomline provides access to an end-to-end, fully proven solution for managing CoP and potentially all your future SaaS-driven, Open Banking requirements. As a cloud-hosted solution, you are always up to date with the latest regulations, technologies, security features and authentication processes. It also removes the ambiguity of different phases in the CoP program as all phases are already built into the solution.

The ability to minimise or prevent financial losses due to APP Fraud, or misdirected payments is a major step forward when it comes to implementing tighter payment controls. CoP will potentially provide both banks and corporates with significant cost savings whilst increasing confidence in the robust nature of the payment process. With future phases of CoP already under consideration, this is just the beginning of the journey.