The payments regulation roadmap: Q2 2025
April 14, 2025
No Comments
Your quarterly overview of the key regulatory changes impacting payments—what’s happening, what’s coming, and what actions to take
11 April 2025
by Payments Intelligence
What is this article about?
The PSR’s consultation on mandating the Reimbursement Claims Management System (RCMS) for APP fraud claims handling
Why is it important?
The consultation will shape how and when the RCMS is adopted, with major implications for compliance, fraud prevention, and operational readiness across the payments industry.
What’s next?
The PSR will gather industry feedback in April 2025 to determine whether and when RCMS adoption should become mandatory, with implementation unlikely before late 2025.
The UK’s fight against authorised push payment (APP) fraud has taken a major step forward with the implementation of mandatory reimbursement rules. Now, attention turns to the infrastructure that will support the long-term success of those rules—namely, the Reimbursement Claims Management System (RCMS).
Developed by Pay.UK, the RCMS is designed to provide a standardised, secure way for payment service providers (PSPs) to manage, track, and communicate APP scam reimbursement claims. In April 2025, the Payment Systems Regulator (PSR) will launch a formal consultation on whether to mandate the use of the system, and if so, when.
While the system offers a promising path to greater efficiency and transparency, the PSR has acknowledged the significant effort already required from industry to implement the new reimbursement regime. Now, it wants to hear from stakeholders on what comes next.
The PSR’s consultation on the RCMS is not just another box-ticking exercise. In earlier statements, the regulator had signalled that if requirements were confirmed following consultation, May 2025 could be a possible go-live date. That timeline has now been ruled out.
While the regulator initially suggested that mandatory use of RCMS could come as early as May 2025 (if confirmed following consultation), it has now said this timeline is no longer feasible. Instead, the April consultation will focus on whether to require RCMS adoption and when any such requirement could realistically come into effect.
No regulatory requirements on RCMS usage will be introduced before late 2025, and only after careful consideration of consultation feedback.
In short, the industry has been through a lot in a short space of time. PSPs of all sizes have spent months building systems, updating processes, and training staff to comply with the October 2024 rules. Overlaying a new technology mandate on top of that—particularly for smaller PSPs and fintechs—could risk overstretching firms and compromising compliance elsewhere.
The PSR is, therefore, taking a more measured approach. The April 2025 consultation will ask for industry views on when and how any future RCMS requirements should be implemented. While late 2025 is the earliest anticipated go-live date, nothing is set in stone. The regulator has said it will carefully consider feedback before deciding next steps.
Based on the PSR’s March 2025 update, here’s what PSPs can expect the consultation to explore:
What would be a realistic implementation date for mandating RCMS usage?
Should there be a phased or tiered approach, e.g., by firm size or transaction volume?
Are PSPs technically ready to integrate with the RCMS?
What barriers exist in terms of staffing, training, systems or legal constraints?
Will RCMS improve the accuracy and availability of fraud data across the ecosystem?
Are PSPs comfortable with the data protection and governance mechanisms in place?
What will the system cost to implement and maintain?
Are there concerns about disproportionate burdens on smaller firms?
Will RCMS make the claims process faster, simpler, and more transparent for victims?
How can the system be aligned with wider expectations for consumer redress?
While there is broad support for a centralised system in principle, firms will likely raise practical questions in their consultation responses.
Larger PSPs may be more confident in their ability to integrate with RCMS quickly, particularly if they’ve already made progress in onboarding. However, smaller PSPs, including fintechs, building societies, and payment institutions, may argue that they need more time, funding support, or flexibility in how adoption is phased.
There are also questions about governance and access. Will all PSPs be treated equally within the RCMS framework? How will disputes between sending and receiving firms be resolved within the system? And how will the PSR use the data it receives via RCMS to monitor compliance and enforcement?
Critically, firms want reassurance that RCMS won’t simply become another compliance burden but will actually deliver value in terms of automation, case resolution speed, and reduction in manual overhead.
The PSR has been clear that stakeholder engagement is crucial. The RCMS will not be mandated overnight, and the consultation is intended to gather views from a wide cross-section of the industry — not just banks and building societies but also e-money firms, fintechs, processors, and trade bodies.
Firms should start preparing their responses now and consider the following:
While the April 2025 consultation does not impose any immediate regulatory obligations, compliance teams should treat it as a signal to prepare, particularly for the possibility of RCMS becoming mandatory in late 2025.
The PSR has been clear: PSPs’ feedback will shape any future requirement’s direction and timing. However, that feedback will only be meaningful if firms have already begun thinking through the operational and compliance implications.
Here’s what compliance teams should consider in the weeks ahead:
Your quarterly overview of the key regulatory changes impacting payments—what’s happening, what’s coming, and what actions to take
The PSR’s upcoming consultation on the Reimbursement Claims Management System (RCMS) explores if and when its adoption should be mandated for payment firms.
The Federal Reserve’s shift on crypto banking access raises new questions for payments, stablecoins, and the role of digital assets in finance.
The Payments Association
St Clement’s House
27 Clements Lane
London EC4N 7AE
© Copyright 2024 The Payments Association. All Rights Reserved. The Payments Association is the trading name of Emerging Payments Ventures Limited.
Emerging Ventures Limited t/a The Payments Association; Registered in England and Wales, Company Number 06672728; VAT no. 938829859; Registered office address St. Clement’s House, 27 Clements Lane, London, England, EC4N 7AE.
Log in to access complimentary passes or discounts and access exclusive content as part of your membership. An auto-login link will be sent directly to your email.
We use an auto-login link to ensure optimum security for your members hub. Simply enter your professional work e-mail address into the input area and you’ll receive a link to directly access your account.
Instead of using passwords, we e-mail you a link to log in to the site. This allows us to automatically verify you and apply member benefits based on your e-mail domain name.
Please click the button below which relates to the issue you’re having.
Sometimes our e-mails end up in spam. Make sure to check your spam folder for e-mails from The Payments Association
Most modern e-mail clients now separate e-mails into different tabs. For example, Outlook has an “Other” tab, and Gmail has tabs for different types of e-mails, such as promotional.
For security reasons the link will expire after 60 minutes. Try submitting the login form again and wait a few seconds for the e-mail to arrive.
The link will only work one time – once it’s been clicked, the link won’t log you in again. Instead, you’ll need to go back to the login screen and generate a new link.
Make sure you’re clicking the link on the most recent e-mail that’s been sent to you. We recommend deleting the e-mail once you’ve clicked the link.
Some security systems will automatically click on links in e-mails to check for phishing, malware, viruses and other malicious threats. If these have been clicked, it won’t work when you try to click on the link.
For security reasons, e-mail address changes can only be complete by your Member Engagement Manager. Please contact the team directly for further help.
