Lagos, NigeriaUse Readable text for larger type, or zoom in on the pages.
Fair Play Council
A pattern is not yet protection: May’s work in Fair Play
RC/FP/2026/CL.4 · 27 May 2026
Dear members,
May has been a month of movement, but not of easy answers. Our work is to make the repeated experience of small businesses visible, test whether it forms a pattern, and then turn that pattern into a practical proposal. That takes evidence, patience and the willingness to be precise about what we do—and do not—know.
What moved this month
On 5 May, the Assembly’s pledge programme opened under the Pledge Standards adopted in RC/A/2026/7. A pledge is a public commitment by a business to follow standards that matter to small-business owners. It is not a substitute for law or for our council’s work, but it gives businesses a way to say, in public, what practices they will support.
On 12 May, PL-001 passed the Assembly’s five-part pattern test: Volume, Frequency, Consistency, Spread and Corroboration. That is a Platform Council item, not a Fair Play finding. Still, its progress matters to all of us: it shows the process moving from reports toward a draft fix and consultation. On 26 May, the Platform Council published its draft Fairness Standard for public consideration. We will watch how that consultation works, and learn from it without confusing its subject with ours.
On 19 May, the UK Late Payments Bill was introduced in the House of Lords. Late payment and payment fraud are different problems, but they share a hard truth: a small business can be left carrying a loss it did not create, while the larger institutions around it have more capacity to absorb delay and uncertainty. The Secretariat has already addressed the Bill in RC/SEC/2026/3. Our task in Fair Play remains focused on fraud: preventing misdirected payments where possible, moving quickly when a payment is reported, and ensuring that small businesses are
not left alone with losses from authorised push payment fraud or business email compromise.
Fair Play evidence submissions S.1 and S.2 are now part of our record. They help us ask a better question than “Was there a scam?” We must also ask what could have prevented the payment, how promptly a recall was attempted, what information the business received, and whether the same barriers recur across borders and providers.
The numbers behind the work
As of 27 May, the Assembly had 759 members in 49 countries and had received 1,980 reports from 50 countries. The Fair Play Council had 93 members in 35 countries and 129 reports from 35 countries. The median amount at stake in those Fair Play reports was approximately US$4,280. Fifty-eight Fair Play reports had been filed in the last 30 days.
Those figures are not a verdict on every report or every institution. They are a reason to examine recurring experiences carefully. The reports describe fraud situations, but the numbers alone do not tell us which controls failed in an individual case, whether a recall was possible, or what reimbursement rule should apply. That is why corroboration and consultation matter as much as volume.
Small and medium-sized businesses make up around 90 per cent of businesses worldwide and account for a substantial share of employment and GDP.1 Their scale is not a reason to lower the standard of protection. It is a reason to make the standard usable for businesses without dedicated fraud teams, legal departments or round-the-clock finance staff.
A recurring vulnerability
A small business may receive what appears to be an updated invoice from a familiar supplier. The bank details have changed. The payment is authorised by someone trying to keep work moving, and the business discovers the change only after the money has left its account. It contacts its bank and the supplier, but now needs to establish what happened, who was contacted and how quickly the payment can be traced. The business may have no specialist staff to do that work, and every hour spent chasing the payment is an hour taken from running the business.
The practical point is clear: a payment can be authorised and still be the result of deception. A useful standard must address the steps before payment and the response after it—payee-name checks, accessible reporting, rapid recall attempts and a clear route to reimbursement where responsibility and circumstances warrant it.
What we are learning
First, a warning alone is not enough. “Be careful” puts the whole burden on the person making the payment, even when the fraud depends on convincing impersonation and the business is under ordinary time pressure. Second, speed matters after the event. A process that accepts a report but cannot act quickly enough to attempt recall may be formally available and practically ineffective. Third, the boundaries of existing protections matter. The UK APP reimbursement regime, in force since 7 October 2024, provides protection for eligible consumers, micro-enterprises and charities up to £85,000 per claim, while international payments are excluded.2 That is a meaningful framework, but it does not answer every small-business or cross-border case.
Our proposed work must be specific about who is covered, what a provider should do, what evidence a business should preserve, and how costs should be shared. We should not promise that every loss can be prevented or recovered. We should insist that prevention and response are designed around the realities of small firms, not only the systems of large institutions.
What comes next
The Platform Fairness Standard consultation is scheduled to begin on 2 June and run through 2 July. It is not our consultation, but it will be an important test of the Assembly’s public process. On 23 June, CF-001 is scheduled to undergo its pattern test. We will continue gathering and checking Fair Play evidence as that work proceeds.
For FP-001, our next task is to turn what members have reported into a draft that can be examined in public. The aim is a standard for banks and payment providers that addresses payee verification, prompt fraud-payment recall, and reimbursement for small businesses affected by authorised push payment and business email compromise fraud, including cross-border cases. Any draft must be clear enough to
assess, and open enough to improve. I will report back as the proposal moves through that process.
With thanks
Thank you to everyone who has filed a report, answered a follow-up question or helped us distinguish what is documented from what still needs checking. I also want to recognise members who have chosen to be named publicly: Amina in Nairobi, Kwame in Accra and Thandi in Johannesburg. To every member who has chosen to remain anonymous: your contribution counts just as much.
Thank you, too, to the members who have kept this work grounded in what a small business can actually do at the moment a suspicious invoice arrives or a payment goes wrong. The standard we develop must be worthy of that practical knowledge.
With respect and resolve,
Chukwudi UmehChair, Fair Play CouncilLagos, Nigeria
Notes and sources
- United Nations, Micro-, Small and Medium-sized Enterprises Day. 2 UK Payment Systems Regulator, APP fraud reimbursement protections. ↩