Summary record of the third session of the Fair Play Council

Meeting details

The third session of the Fair Play Council was held on 18 April 2026 in two Open Table sittings: the Asia-Pacific sitting from 06:00 to 07:30 UTC and the Europe, Africa and Americas sitting from 16:00 to 17:30 UTC. The chair presided over both sittings. The two-part format enabled members in different time zones to contribute to the same evidence review.

The Council’s membership at the date of the session was 58 members from 25 countries. A sitting-specific attendance register, including the number of participants and the countries represented at each sitting, was not available; the membership figures are not presented as attendance figures.

Agenda

1. Opening remarks and confirmation of the Council’s current mandate.
2. Review of evidence received under FP-001, the call for evidence on business fraud.
3. Discussion of common payment-fraud situations, including changed invoices and business email compromise.
4. Consideration of practical questions for further evidence gathering: payee verification, payment recall, reimbursement and cross-border transfers.
5. Decisions, action items and arrangements for the next session.

Proceedings

1. The Chair opened the session by recalling that FP-001 remained an evidence-gathering item. The Council was not being asked to approve a standard at this stage. Its task was to establish whether members’ reports showed a sufficiently consistent and corroborated problem before proposing any fix. The Chair referred members to the five-part pattern test used across Reseated: Volume, Frequency, Consistency, Spread and Corroboration.

2. The Chair noted that the call for evidence had been issued on 10 February 2026 as RC/FP/2026/1. The Council had also published RC/FP/2026/20 on 8 April, an open letter calling for a callback before payment when invoice details change. He emphasized that the letter was a practical warning and not a finding against any particular provider, bank or business. Members were asked to distinguish the reported event, the payment process and any proposed remedy when submitting evidence.

3. The Chair presented the evidence position available on 18 April. The Fair Play Council had received 50 reports from 22 countries. The median amount at stake was approximately US$6,129. Reports described fraud in all 50 cases. Thirty-one reports had been filed during the preceding 30 days. The Chair cautioned that these figures described submitted reports, not the prevalence of fraud among all small businesses or the rate of loss across payment systems.

4. The Chair reviewed the reported team-size distribution: 50 per cent of reporting businesses were operated by one person; 36 per cent had two to nine team members; 4 per cent had 10 to 49; and 10 per cent had 50 to 249. He observed that the evidence included both solo operators and larger small-business teams, and that later analysis should not assume that every case involved the same capacity to verify a payment or recover from a loss.

5. The Chair also summarized the countries with the largest numbers of reports to that date: the United Kingdom, 10; South Africa, 4; Nigeria, 4; the United States, 4; Kenya, 3; Poland, 3; Mexico, 2; and Brazil, 2. The remaining reports came from other countries. Members were reminded that a country count did not, by itself, establish that the cause, payment route or applicable rules were the same across jurisdictions.

6. In the Asia-Pacific sitting, Mei Lin Tan of Singapore described the importance of keeping an evidence record that separates a supplier’s legitimate change of bank details from a fraudulent instruction that imitates one. She said that the sequence of events mattered: how the change arrived, whether a second channel was used to confirm it, when the payment was made, and when the sender first suspected fraud. She recommended that the evidence form invite members to record those steps without requiring them to identify their businesses or counterparties.

7. Ravi Kumar of Bengaluru, India, spoke about the pressure a small operator could face when an invoice appeared overdue and a replacement payment instruction was presented as urgent. He said that the record should capture whether the payer had a usable way to pause or verify the transfer before release. He did not propose treating urgency as proof of fraud; rather, he considered it a circumstance to document alongside the payment method and the availability of a contact independent of the changed instruction.

8. In the Europe, Africa and Americas sitting, Lerato Mokoena of Johannesburg, South Africa, described the difficulty of responding when a payment had been authorized by a business employee who believed that the instruction was genuine. She urged the Council to use neutral language that would not imply that a business had failed to take reasonable care merely because an employee had been deceived. She also asked that evidence capture whether the sending provider was contacted promptly and what options, if any, were explained.

9. Daniel Otieno of Nairobi, Kenya, said that the evidence should record the time between discovery of a suspected fraud and the first report to the payment provider. In his view, “recall” needed to be made specific for evidence purposes: whether a request was made, when it was made, whether the receiving institution was contacted, and what outcome was communicated. He stressed that a report should distinguish a request to stop or return a payment from a confirmed recovery.

10. Ewa Kowalska of Warsaw, Poland, asked the Council to include cross-border transfers in its evidence questions from the outset. She observed that a member could encounter different procedures depending on where the sender, recipient and payment provider were located. She recommended recording those locations and the currency involved, while avoiding any assumption that a domestic remedy would apply to an international transfer.

11. Mariana Costa of São Paulo, Brazil, supported a separate field for the method used to verify a changed payee or invoice. She said that a reply to the same email chain should not automatically be described as independent confirmation. The Council should ask whether a known telephone number, established account contact or other separate channel was used, while leaving members free to explain a different method in their own words.

12. Aisha Bello of Lagos, Nigeria, said that evidence should show not only the loss but also the practical consequences for the business, such as delayed supplier payment, interrupted operations or time spent seeking recovery. She cautioned that the Council should not ask members to provide sensitive bank credentials, full account numbers or unnecessary personal data. If supporting documents were submitted, members should be instructed to remove identifying and security information that was not needed to understand the event.

13. Miguel Reyes of Mexico City, Mexico, asked that the Council distinguish among payment authorization, identity verification and reimbursement. He said that a payer might have personally approved a transfer while acting on a fraudulent instruction, and that the evidence should describe that distinction plainly. He supported further study of reimbursement but said the Council should not treat reimbursement as a substitute for early detection, rapid contact between providers or an effective payment-recall process.

14. The Chair summarized the discussion as identifying questions for evidence collection, not conclusions about the conduct of any named institution. Members had raised recurring themes concerning changed invoices, independent confirmation, the speed and result of recall requests, the handling of authorized payments induced by deception, and differences in cross-border procedures. The Chair noted that the next analytical step would be to test whether these themes were supported across reports and whether they were consistent enough to justify a proposed remedy.

15. Members considered the existing United Kingdom APP reimbursement framework as a relevant, limited point of comparison. The framework, effective from 7 October 2024, provides reimbursement of up to £85,000 per claim for eligible consumers, micro-enterprises and charities; eligible costs are split equally between sending and receiving payment service providers, and international payments are excluded.¹ The Chair emphasized that this was a jurisdiction-specific arrangement and not a policy adopted by Reseated. Members were not asked to treat its eligibility rules or scope as a conclusion for FP-001.

16. On the five-part pattern test, the Chair recorded that the Council had not passed the test as of 18 April. The number of reports and their geographic spread were relevant evidence, but did not resolve the questions of frequency, consistency or corroboration. No draft fix was before the session. No public consultation or Assembly ballot had been scheduled for FP-001. The Council would continue evidence review and report its findings through the established process.

Conclusions and decisions

1. The Council agreed to continue the FP-001 call for evidence and to organize reports around the event sequence: receipt of the instruction, method of verification, authorization, discovery, first contact with a provider, recall or recovery steps, and outcome.

2. The Council agreed that evidence collection should cover both domestic and cross-border cases. Submissions should identify relevant locations and, where known, the payment route, without presuming that the same procedures or remedies apply in each jurisdiction.

3. The Council agreed to distinguish an authorized payment induced by deception from a payment instruction knowingly initiated for a fraudulent purpose. The distinction was adopted for clarity of evidence, not as a legal determination in individual cases.

4. The Council agreed that the published evidence summary should use aggregate figures and non-identifying descriptions. Members should not be asked to name their businesses in public accounts, and submitted supporting material should be limited to what is necessary to understand the reported event.

5. The Council confirmed that it had made no finding against an individual company or provider and had adopted no reimbursement rule or business fraud standard. Any later draft would require completion of the pattern test, a draft fix, public consultation and an Assembly ballot before letters were sent to relevant chief executives.

Action items

Next session

Notes and sources

Sources

1. Payment Systems Regulator, APP fraud reimbursement protections