The Payment Systems Regulator has imposed a fine of over GBP 3.7 million on Bank of Ireland for missing the Confirmation of Payee (CoP) implementation deadline by 14 months.
Following this announcement, the UK’s Payment Systems Regulator (PSR) fined Bank of Ireland UK (BOIUK) more than GBP 3.7 million after it failed to implement CoP by the regulatory deadline of 31 October 2023. The delay was 14 months beyond that timeline and affected over 1.14 million new payees, who were unable to benefit from a fraud protection mechanism covering payments totaling approximately GBP 6.9 billion.
A significant compliance delay with substantial risk
According to the official press release, CoP is a name-checking service that enables payers to verify if the account name matches the sort code and account number before a payment is made. This mechanism was introduced in response to an increase in authorized push payment (APP) fraud cases, where individuals are deceived into sending money to accounts controlled by fraudsters. The service also helps prevent misdirected payments due to human error.
The PSR initially mandated CoP obligations under Specific Direction 10 in 2019 for the six largest banking groups. Specific Direction 17 (SD17), published on 11 October 2022 and effective from 24 October 2022, expanded its reach significantly. SD17 created two categories — Group 1 and Group 2 payment service providers — with different compliance timelines. Group 1 providers were required to have both sending and receiving CoP capabilities in place by 31 October 2023.
BOIUK, classified as a Group 1 provider, was the last institution within that cohort to comply with these requirements. The PSR initiated an official investigation on 10 July 2024.
Settlement and penalty details
The regulator’s decision notice states that BOIUK agreed to settle early in the enforcement process, qualifying for a 30% discount under the PSR’s settlement procedures. Without this discount, the financial penalty would have been GBP 5.4 million.
The PSR confirmed that BOIUK failed to meet the send requirements specified in paragraph 3.1 of SD17 — meaning it did not have an operational system to send CoP requests within the required timeframe. A PSR official noted that payment service providers had ample time to prepare, with directions being finalized in October 2022. The regulator emphasized its commitment to using enforcement powers where firms fail to meet CoP requirements and leave customers without this protection.
Regulatory outlook
This fine comes amid ongoing regulatory focus on fraud prevention infrastructure in the UK. The PSR has maintained that CoP is crucial for reducing APP scams, which have caused significant financial harm to consumers and businesses alike. The UK government has signalled that payment systems regulation will remain active until any forthcoming legislative changes take effect, with the PSR continuing its statutory functions.
The full decision notice and details of the penalty are available on the PSR’s website alongside its broader register of enforcement cases.
