The Table, No. 35: Two years after the reimbursement rule

A note from the Secretariat. A rule can change what people are entitled to expect. It cannot, by itself, make every case clear or every process easy to navigate. This week we are looking at a two-year milestone in the UK’s mandatory reimbursement arrangements for authorised push payment (APP) fraud. The questions around it are familiar across the Assembly: what happened, what evidence is needed, who makes the decision, and how does a small business learn what to do next? As always, we will distinguish what members report from what we can establish, and keep members’ identities and businesses private.

The week at the table

On 7 October, the Secretariat issued Two years of mandatory APP fraud reimbursement in the UK (RC/SEC/2026/7). The date marks two years since the UK’s mandatory reimbursement arrangements came into effect. For the Assembly, the milestone is a reason to examine how a formal protection meets the practical experience of smaller businesses—not a basis for assuming that every case is covered, or that every claimant has had the same outcome.

APP fraud involves a person being deceived into authorising a payment to a fraudster. That feature can make the experience especially difficult for a small firm to explain: the payment may have been approved by someone at the business, while the decision to send it was shaped by deception. The details of the payment, the communication that prompted it, and the steps taken afterwards can all matter. Small firms may be trying to assemble that account while also handling customers, payroll and suppliers.

Two years is a useful point to ask practical questions. Are the relevant steps and requirements understandable to a small-business customer? Is it clear where to raise a case and what information to keep? Can a business understand the decision it receives and what to do if it disagrees? Those are questions to investigate, not findings to assume. RC/SEC/2026/7 gives this week’s discussion a specific reference point: a protection with a defined history, and a continuing need to make the customer’s path through it legible.

The Secretariat’s statement is not a ruling on any individual claim, and it does not replace the applicable UK rules or the decisions of the organisations responsible for a particular case. Reseated’s role is to collect accounts, look for recurring patterns, and propose changes where evidence supports them. In keeping with that process, reports about APP fraud belong in the wider record only when they are described carefully enough to distinguish a repeated problem from a single difficult experience.

By the numbers

As of 9 October, Reseated had 1,687 members in 49 countries. Members had filed 5,182 reports from 50 countries. The difference between those country counts is intentional: the location where a report originates is not necessarily the same as the location of a seated member.

• Platform: 1,948 reports
• Cashflow: 1,329
• Fair Play: 654
• Trade: 485
• Resilience: 316
• Red Tape: 285
• Team: 165

These are counts of reports, not a count of confirmed violations or unique businesses. They do not tell us, on their own, whether a practice is widespread or consistent. Each report is an input to the five-part pattern test: Volume, Frequency, Consistency, Spread and Corroboration. A finding requires more than a large number in a table; it requires evidence that holds together across those tests.

From the table

A small business receives a message that appears to come from a familiar supplier. The message says that the supplier’s bank details have changed and gives a reason for the change. A staff member, working through several invoices, sends the next payment to the new account. The real supplier later asks why the invoice remains unpaid.

The owner now has two urgent problems: the money has gone to the wrong destination, and the supplier still needs to be paid. The business contacts its payment provider and gathers the invoice, the message, the payment confirmation and the supplier’s response. Even with those records, the owner may not know which details will matter most, whether the case fits the reimbursement rules, or when a decision can be expected. The immediate strain is not abstract. Cash reserved for stock or wages is unavailable while the business tries to establish what happened.

This kind of account helps explain why a rule and a usable process are different things. A business needs to know what to preserve, where to raise the issue and how to understand the response. It also needs protection from a second burden: being asked repeatedly for information without a clear explanation of what remains unresolved. The story does not establish that a provider acted improperly or that reimbursement is due in any particular case. It points to questions that a careful evidence process can test across reports.

Members should avoid putting names, account numbers, confidential correspondence or other identifying details into public discussion. Reports can describe the sequence of events and the process encountered without exposing the business, its staff or its counterparties.

Coming up

The next stage on the Fair Play track is the opening of the FP-001 public consultation, scheduled for 13 October and running through 12 November. Members and other interested readers will have an opportunity to review the draft and submit comments. A consultation is not an adoption decision: it is the point at which the proposed text is tested, challenged and, where warranted, revised.

The Cashflow track’s CF-001 consultation closed on 24 September after receiving 362 comments. The proposal is scheduled for an Assembly adoption ballot from 26 October to 9 November. That ballot is still ahead; no outcome has been decided. Members can follow the published proposal and ballot materials through the Assembly’s process when they become available.

The Trade track is also moving through its own evidence and drafting work. It is important not to confuse one council’s stage with another’s: each issue has its own record, pattern test and timetable. Reseated’s monthly Open Tables remain a place for members to compare experiences and raise questions, including experiences that may not yet support a formal finding. The Secretariat will share the relevant session details through the usual channels.

One thing you can do

If your business has dealt with a payment sent after being deceived, write down the sequence while it is still clear: when the instruction arrived, what made it appear credible, when the payment was made, when the issue was discovered, whom you contacted and what response followed. Keep copies of relevant records securely, but do not include account credentials or private customer information in a Reseated report.

Separate what you know from what you suspect. For instance, record that a payment was made on a particular date and that a later message revealed a change of bank details; do not state who was responsible unless you have evidence to support it. If you choose to report the experience through Reseated’s usual reporting channel, that distinction helps the Assembly compare accounts fairly. One carefully described report may not establish a pattern. Together, comparable reports can show whether a problem is recurring—and whether a practical fix deserves to be put to the table.