Letter transmitting the FP‑001 draft to payment regulators for comment

Letter | Status: Circulated

Letter transmitting the FP-001 proposed text to payment regulators for comment

From: Chukwudi Umeh, Chair, Fair Play Council, Reseated

On behalf of: The Fair Play Council and the rapporteur for FP-001

Purpose

Dear colleagues,

We are writing to transmit the Fair Play Council’s proposed Business Fraud Standard, FP-001, and to invite your comment. The proposed standard is now undergoing public consultation, which opened on 13 October and closes on 12 November 2026. We invite regulators and central banks to consider the evidence and proposed practices, identify where they fit or conflict with existing arrangements in your jurisdiction, and tell us what should be clarified before the Assembly considers the text.

FP-001 concerns payment diversion and invoice fraud, including authorised push payment (APP) fraud and business email compromise (BEC). The proposed standard calls on banks and payment providers to verify payee names, act quickly to recall fraud payments, and reimburse small businesses affected by these forms of fraud, including where payments cross borders. It is a proposed standard, not an adopted resolution or a statement of law. The Founders Assembly has not yet voted on it.

Who we are and our mandate

Reseated is a global assembly of small-business owners, organized in seven councils. Its Founders Assembly brings recurring operating problems reported by members through a defined process: reports are assessed against five tests—Volume, Frequency, Consistency, Spread and Corroboration—before a proposed fix is prepared, consulted on, and put to an Assembly ballot. If a proposal is adopted, the Assembly may write to the executives able to adopt it. The councils describe practices and problems across markets; they do not make findings about a single company.

The Fair Play Council’s remit is to examine the conditions under which small businesses make and receive payments, and the effects of fraud and payment-system responses on those businesses. FP-001 began with a call for evidence on 10 February 2026. The Council certified that the issue met the five-part pattern test on 8 September. The resulting proposed text, RC/FP/2026/L.1, was issued on 29 September and opened for public consultation on 13 October. This letter is part of that consultation. It seeks informed regulatory comment; it does not ask regulators to endorse the proposal or to treat it as a substitute for their own statutory processes.

At the date of this letter, Reseated has 1,710 members in 49 countries and has received 5,236 reports from 50 countries. The Fair Play Council has 205 members from 42 countries. It has received 665 reports from 48 countries, each recorded in the Council’s dataset as a fraud situation. These are member reports collected for pattern analysis, not a representative survey of all businesses or a count of verified criminal incidents.

Evidence before the Council

The Fair Play Council’s evidence dataset records reports, not necessarily distinct businesses, transactions, or perpetrators. Members remain anonymous unless they choose a public seat. The figures below describe the material recorded by the Council as of 14 October 2026.

The largest country counts in the Council’s reports are the United Kingdom, 95; the United States, 90; Nigeria, 37; Canada, 33; India, 32; South Africa, 31; Kenya, 30; and Brazil, 21. These are counts of reports, not population-adjusted rates or estimates of national prevalence. The reports come from 48 countries; the countries listed here are the highest counts in the Secretariat's records.

The amount at stake is a median, not an average and not a measure of the total losses represented by the dataset. It indicates that the reported cases are material to small businesses, while avoiding the implication that every case has the same financial effect. A fraud payment may also create costs beyond the amount transferred, including time spent contacting a bank or payment provider, interruption to ordinary business activity, and uncertainty about whether funds can be recovered.

The Council treats member submissions as reports of suspected fraud, not as adjudicated findings about another party. It assesses the volume, recurrence, consistency, spread and corroboration of reports to decide whether a problem merits a proposed practice standard. The evidence supports consultation and further examination alongside supervisory data, payment-system records, law-enforcement information and case-level investigation.

Relevant policy context

We are aware of two existing policy developments relevant to this consultation. In the United Kingdom, APP fraud reimbursement protections have applied since 7 October 2024. The stated protections cover consumers, micro-enterprises and charities, provide for reimbursement of up to £85,000 per claim, and allocate the cost equally between sending and receiving payment service providers. International payments are excluded from those protections.[1]

A first-year evaluation reported that APP fraud was down by 21% and that reimbursement increased from 54% to 65%.[2] We cite those reported findings as relevant context, not as proof that a particular policy can be transferred unchanged to every market. The scope of the UK framework, including its stated exclusion of international payments, is one reason the Council’s proposal asks regulators to consider how business fraud cases and cross-border payments are treated in their own jurisdictions.

In the European Union, the Instant Payments Regulation requires verification of payee from October 2025. The Council regards payee-name verification as a significant policy development relevant to reducing payment diversion, while recognizing that regulatory coverage, implementation and the treatment of business payments need to be considered in the applicable legal context. This letter does not characterize the precise scope of the Regulation beyond the information available to the Council.

These developments show that policy tools addressing payment fraud and payee verification are under active consideration or in operation in some jurisdictions. They do not establish that the same legal duties apply elsewhere. We therefore ask each recipient to assess the proposal against the laws, regulatory powers and payment arrangements within their own remit. Where a proposal is already covered by a binding rule or established scheme, we welcome advice on how the text should recognize that rather than duplicate it.

Requests for comment

We respectfully invite payment regulators and central banks to comment on the proposal, in particular on the following questions:

1. Payee-name verification. Is the proposed request that payment providers verify payee names sufficiently clear for business payments? Please identify any distinctions that should be made between account-name checking, other verification-of-payee mechanisms, and warnings shown to a person initiating a payment. We welcome comments on how the practice should operate where a business uses a trading name, a changed account, an intermediary, or a cross-border payment route.

2. Payment recall. Does the proposal describe a workable expectation for promptly seeking recall when fraud is reported? Please advise what the text should say about the responsibilities of the sending provider, the receiving provider, and any payment-system operator, without implying that a provider can guarantee recovery once funds have moved. We are particularly interested in how existing processes can enable an urgent request to be received, acknowledged and acted on.

3. Reimbursement for small businesses. Is the proposed reimbursement of small businesses affected by APP or BEC fraud framed in a way that can be assessed alongside your jurisdiction’s consumer, business and payment-system rules? Please identify relevant eligibility criteria, exceptions, evidential requirements or allocation arrangements that should be reflected. The Council is seeking comment on a practical standard and does not presume that the UK model should be adopted in full.

4. Cross-border cases. What arrangements, within your authority or coordination role, can support timely recall and fair treatment where the sending or receiving account is outside the jurisdiction? The proposal asks that cross-border business fraud not be left without a clear route for urgent contact and review. We welcome corrections on jurisdictional limits and suggestions for cooperation between providers, supervisors and relevant payment-system bodies.

5. Business-specific risks and safeguards. Does the proposal adequately reflect invoice changes, impersonation and business email compromise while preserving appropriate checks against mistaken claims and misuse? Please identify safeguards that would improve accuracy without making a small business’s ability to report and seek assistance depend on resources it is unlikely to have.

6. Measurement and implementation. What data could be collected consistently to assess reporting, recall attempts, recovery, reimbursement and processing time, while protecting customer and business information? Please indicate whether phased implementation, guidance, or review periods would make the proposed practices more workable.

7. Legal fit and drafting. Please identify any provision that is unclear, duplicates an existing obligation, exceeds the appropriate role of a standard, or would benefit from a jurisdiction-specific qualification. We would also welcome suggested language or references to public rules and guidance that the Council should consider before the consultation closes.

Written comments may be submitted during the consultation period, which closes on 12 November 2026. We ask recipients to identify the provision or question being addressed and, where possible, distinguish between a legal requirement, a current operational practice and a recommended change. A response may be limited to the matters within your authority. If the proposed text is not appropriate for your jurisdiction, comments on the underlying operational problem and on how it is currently handled will still be useful.

Anonymized evidence and safeguards

The Council is willing to provide anonymized and aggregated evidence to support regulatory discussion. Depending on the question, this may include counts grouped by country, broad descriptions of reported payment-diversion patterns, or aggregated member descriptions of the steps taken to seek recovery. Any provision of material will be subject to review for confidentiality and re-identification risk. We will not disclose a member’s identity or the name of a member’s business without that member’s explicit choice and appropriate permission.

We will also distinguish clearly between information that members reported, conclusions drawn through the Council’s pattern test, and verified information supplied by an external source. We will not present an individual report as an established finding against a payment provider, bank, merchant or other named party. If a regulator requests case-level information, we will discuss whether it can be shared lawfully and safely, and will not assume that a request removes the need for member consent or other safeguards.

Next steps

Following the close of consultation, the Fair Play Council will review the submissions and publish a response to the material issues raised, subject to privacy protections. The text may be revised. Any final proposal will proceed through the Founders Assembly’s ballot process; until that process is complete, FP-001 remains a proposal. If adopted, the Assembly may then communicate the resulting standard to relevant institutions. No adoption decision has been made as of the date of this letter.

We hope this consultation can help distinguish measures that are technically possible from those that are operationally dependable for a small business facing a suspected fraud payment. A prompt route to verify a payee, an effective attempt to recall funds, and a clear explanation of reimbursement or review can matter most when a business has limited staff and little time to absorb disruption. We welcome rigorous criticism of the proposal and practical alternatives that better meet those aims.

Annex: sources and records cited

1. Payment Systems Regulator, “APP fraud reimbursement protections for consumers.” The cited facts are the start date, covered groups, maximum reimbursement, cost allocation and exclusion of international payments.[1]

2. Grant Thornton, “APP fraud reimbursement requirement: were industry’s concerns justified?” The cited facts are the reported first-year change in APP fraud and reimbursement.[2]

3. Reseated internal evidence snapshot dated 14 October 2026: overall membership and report totals; Fair Play Council membership, report counts, countries, median amount at stake, country counts, team-size distribution and reports in the preceding 30 days.

4. RC/FP/2026/1, Call for evidence: Fair Play Council agenda item FP-001; RC/FP/2026/N.1, Interim pattern review: payment-diversion and invoice fraud; RC/FP/2026/N.2, Certification of the pattern test for FP-001; and RC/FP/2026/L.1, Proposed resolution: the Business Fraud Standard.

5. RC/A/2026/2, Rules of Procedure of the Founders Assembly; and RC/A/2026/7, Pledge Standards for businesses. These records describe the Assembly’s process and institutional context.

Notes and sources

Sources

1. Payment Systems Regulator, APP fraud reimbursement protections for consumers
2. Grant Thornton, APP fraud reimbursement requirement: were industry’s concerns justified?