Dissenting Opinion on the FP‑001 Business Fraud Standard

Who I am and what happened

To the members of the Fair Play Council:

I am Kojo Biney, a member of the Fair Play Council, writing from Accra, Ghana. I submit this dissenting opinion on FP-001 because I agree that payment-diversion and business email compromise fraud cause serious harm, but I disagree with the proposed standard’s allocation of responsibility. A standard that tells owners to verify more, document more and react faster, while leaving the institutions that move the money with broad discretion over prevention, recall and reimbursement, puts the burden in the wrong place.

The pattern that brought me to this position is familiar to small businesses: a legitimate payment instruction is changed or impersonated; an owner or staff member is asked to act within the ordinary flow of work; the payment is authorised; and, once the deception is discovered, the business must try to persuade institutions to trace, stop or return money that has already left its account. That description is not an allegation against any named business or provider, nor is it a claim about a particular transaction. It is the practical problem this standard is meant to address.

Owners should take reasonable care. But care is not the same thing as control. A small business cannot independently inspect the receiving account, see what a payment provider’s systems know about the payee, or compel another institution to act quickly after a report. When the owner is made the principal safety mechanism, the standard risks turning a failure of the payment system into a failure attributed to the person who used it.

My disagreement is therefore not with the aim of FP-001. It is with a design that may make owner conduct the gateway to protection. The standard should require effective safeguards from the institutions that can implement them at scale, then give small businesses prompt and predictable relief when those safeguards do not prevent a fraudulent payment.

What the evidence shows

The Fair Play Council’s internal figures as of 18 October 2026 record 209 members from 42 countries and 680 reports from 49 countries. The median amount at stake is approximately US$4,540. The reports come from businesses of different sizes: 41% are from members who report that they are just one person, 39% from teams of 2–9, 14% from teams of 10–49, and 6% from teams of 50–249. There were 121 reports in the last 30 days. By reported country, the largest counts are the United Kingdom, 98; the United States, 90; Nigeria, 39; Canada, 35; India, 33; South Africa, 31; Kenya, 30; and Brazil, 21.

These figures do not establish that every report has been independently verified, nor do they measure the full incidence of fraud in each country. They do establish the scale and geographic spread of the reports received by this council, and they show that the issue is not confined to one regulatory system or one kind of business. The median loss is substantial for a small enterprise. A loss of that size can affect payroll, supplier payments and the ability to keep operating, even where it would be a modest amount on the balance sheet of a large financial institution.

The team-size figures matter to the drafting. A business with one owner, or a team of two to nine, may have no separate fraud department, round-the-clock payment desk or second approver available for every transaction. A rule that assumes those controls exist will be hardest to follow for the businesses most exposed to the harm described in the reports. A consultation standard should not silently make access to protection depend on an owner’s ability to build a control system that only larger organisations can maintain.

The figures also cannot settle every question about causation or reimbursement. They do not, on their own, tell us what each owner was shown, what a provider could have detected, how long a recall took, or what evidence should be required in a claim. Those are reasons to design a fair process and gather more evidence. They are not reasons to place the central burden on the party least able to see or control the whole payment chain.

How the law in my country and elsewhere handles it

In the United Kingdom, the Payment Systems Regulator’s APP reimbursement protection, in force since 7 October 2024, provides for reimbursement of up to £85,000 per claim for consumers, micro-enterprises and charities. The cost is split equally between the sending and receiving payment service providers, and international payments are excluded.¹ This is a useful comparator because it recognises that a payment fraud response should not be left entirely to the affected customer. It is also an incomplete model for the businesses represented in this council: the stated coverage excludes international payments, even though FP-001 expressly concerns cross-border harm.

The first-year evaluation reports that APP fraud fell by 21% and reimbursement rose from 54% to 65%.² Those results support the case for enforceable provider responsibilities and reimbursement. They do not prove that every part of the UK scheme should be copied, or that a UK threshold and eligibility test fit small businesses in other countries. They do show why a standard should measure whether institutions act and whether victims are reimbursed, rather than measure only whether an owner followed a checklist.

The EU Instant Payments Regulation is recorded as requiring verification of payee from October 2025.³ That approach is relevant to the standard’s verification proposal: payee checking can be built into the payment process, where the provider can perform it systematically, rather than treated only as a customer’s personal precaution.

These cases point in a consistent direction without proving that one jurisdiction’s design should be transplanted wholesale. The UK case places a defined reimbursement obligation on payment service providers but excludes international payments. The EU case establishes a verification-of-payee requirement for instant payments. FP-001 should learn from both: make provider duties operational, close the cross-border gap, and state clearly how reimbursement works. This opinion makes no claim about Ghanaian law beyond the comparative facts stated here.

The strongest argument against my view and my answer

The strongest case against my position is that a payment is authorised by a customer, not initiated by the customer’s bank alone. Owners know their suppliers and their own payment practices best. A changed invoice or unusual request should trigger a call-back or other independent check. Requiring reimbursement regardless of the customer’s conduct could weaken incentives to take care, raise costs for all account holders, and make providers liable for fraud they could not reasonably prevent. Clear limits, evidence requirements and customer safeguards are therefore necessary.

That argument deserves a serious answer. Owners can and should use reasonable checks, particularly when instructions change. A standard should not reward deliberate collusion or a knowingly reckless disregard of a clear warning. Nor should it require reimbursement where evidence shows the claimant participated in the fraud. But these points do not justify making a checklist the main test of whether a business receives protection.

First, the owner’s knowledge is often precisely what the fraudster is exploiting. A convincing impersonation can use familiar details and arrive through a channel that appears ordinary. A call-back is a sound precaution, but it depends on staff knowing when to pause, having a trusted contact route, and being able to reach the supplier without using contact

information supplied with the suspect instruction. It does not reveal what a payment provider can see about an account or payee. The standard should encourage independent checks without treating every unsuccessful check as proof that the victim forfeited protection.

Second, the institutions processing payments can design protections once and apply them across many transactions. They can present a payee-name check, make discrepancies understandable, maintain a clear fraud-report channel, and initiate contact with receiving institutions when a payment is challenged. An owner cannot make a provider verify the destination account, and cannot compel another provider to preserve or return funds. Duties should follow practical capacity and control.

Third, reimbursement is not the same as automatic payment without review. FP-001 can require a prompt, documented assessment, set a fair evidentiary threshold, exclude proven participation in fraud, and permit a reasoned decision where a claimant’s conduct materially contributed. But the standard must not allow a provider to deny a claim simply by pointing to the existence of an owner-side precaution. If the duty is unclear, slow or easy to defeat, the promise of protection will be weaker for the smallest firms.

Finally, costs should be assigned to the institutions in a way that creates incentives to reduce fraud. The UK model’s 50:50 split is one existing case, not a complete answer for FP-001. The council should specify an allocation appropriate to its standard and ensure that cross-border cases are not left in a gap between providers. I would rather see a carefully defined provider liability rule than an apparently simple promise whose conditions place the decisive risk back on the owner.

My position clause by clause

I address the three core duties described for FP-001: verification of payee names, rapid recall of fraud payments, and reimbursement for small businesses affected by APP or business email compromise fraud, including cross-border cases. I support the objectives of all three. I dissent from the

proposed text insofar as it leaves the provider duties weak, makes owner precautions a barrier to relief, or fails to specify how international cases will be handled.

Verification of payee names. I support verification as a provider-side duty. It should be presented before the customer irrevocably confirms a payment, use information available to the provider, and explain a mismatch in language a small-business user can understand. The provider should not discharge its duty merely by displaying an obscure or technically worded warning. At the same time, FP-001 should not make the owner an insurer against a defective match, a confusing warning, or the absence of a usable verification service. The standard must distinguish a reasonable customer precaution from the provider’s obligation to supply a meaningful check.

Rapid recall. I support requiring providers to act quickly after a fraud report. The standard should define the required steps and record the time of the report, the time the sending provider acted, and the time it contacted the receiving provider. It should require a clear channel available to a small business and a prompt acknowledgement, rather than leave recall to informal escalation or goodwill. A recall cannot guarantee that funds will be recovered, especially once they have moved. But the possibility of failure is a reason to require prompt action and transparent records, not a reason to leave the obligation undefined. Owners should report promptly when they discover a fraud; that expectation must not excuse provider delay.

Reimbursement for APP and business email compromise fraud. I support a clear right to reimbursement for eligible small businesses when they are deceived into authorising a payment. The standard should state who assesses the claim, what evidence is relevant, how quickly the decision must be made, what reasons must be given for refusal, and how a disputed decision can be reviewed. The UK comparator demonstrates a defined cap and a provider cost split, while also demonstrating a material exclusion for international payments. FP-001 must make its own choices openly rather

than leave affected firms to discover that a cross-border payment falls outside the protection.

I oppose any clause that makes reimbursement depend on perfect compliance with a long or impractical list of owner controls. Reasonable safeguards may inform a decision, but they should not erase the provider’s independent obligations. If the standard sets a threshold for claimant conduct, it should define that threshold narrowly, require the provider to explain its decision with evidence, and prevent a generic allegation of “failure to follow security advice” from ending a claim.

Cross-border application. I support express coverage of international payments. The standard should identify the responsibilities of the customer’s provider and the receiving provider, require cooperation in recall, and prevent the absence of a domestic reimbursement arrangement from becoming an automatic refusal. The UK scheme excludes international payments; that is a gap FP-001 should address, not inherit. The final text should also acknowledge that implementation may require coordination across jurisdictions, while still establishing a duty for the provider serving the small business.

What I ask

I ask members to vote against FP-001 as presently written unless its final text makes provider responsibility primary and makes owner-side precautions proportionate. In particular, I ask the revision group and Assembly to ensure that the adopted standard:

• requires a usable, timely verification-of-payee service from providers, with clear explanations of mismatches;

• sets measurable duties for rapid fraud reporting, recall initiation, inter-provider contact and communication with the affected business;

• establishes a defined reimbursement process and a fair, reviewable evidentiary standard, rather than making a checklist the gate to relief;

• covers eligible small businesses in cross-border cases and assigns provider responsibilities without leaving the victim between institutions; and

• requires providers to record and report outcomes so that future revisions can be based on evidence about verification, response times, recoveries, refusals and reimbursements.

Notes and sources

1. UK Payment Systems Regulator, APP fraud reimbursement protections: https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/. ↩

2. First-year evaluation of the UK reimbursement requirement: https://www.grantthornton.co.uk/insights/app-fraud-reimbursement-requirement-were-industrys-concerns-justified/. ↩

3. EU Instant Payments Regulation, verification-of-payee requirement from October 2025. ↩

Sources

1. UK Payment Systems Regulator, APP fraud reimbursement protections
2. Grant Thornton, first-year evaluation of the APP reimbursement requirement