# Bank of Ireland UK fined £3.7m after introducing anti-fraud tool a year late

By Dr Rasha Kassem — 2026-02-19

Dr Rasha Kassem, senior academic and leader of the Fraud Research Group at Aston University, said: “The £3.7 million fine imposed on Bank of Ireland UK by the Payment Systems Regulator is significant not just for its size, but for what it signals about regulatory expectations in the fight against fraud.

“Confirmation of Payee (CoP) is no longer viewed as an optional safeguard or operational enhancement — it is a core consumer protection control within the UK payments system.

“Missing the implementation deadline by 14 months meant that more than 1.14 million new payees, representing £6.9 billion in payments, were processed without this name-checking safeguard.

“While this does not automatically mean those transactions were fraudulent or misdirected, it represents a period during which customers were exposed to elevated risk, particularly from authorised push payment (APP) fraud.

“CoP is designed precisely to interrupt common fraud typologies by alerting customers when the account name does not match the intended recipient.

“The regulator’s message is clear: firms were given sufficient notice, and implementation delays that weaken systemic fraud defences will attract enforcement action.

“The fact that the penalty would have reached £5.4 million without the early settlement discount reinforces that compliance failures in this space are being treated seriously.

“More broadly, this case highlights a shift in regulatory posture.

“Payment system protections are now seen as collective infrastructure — weaknesses at one firm can undermine trust across the ecosystem.

“As APP reimbursement requirements tighten and fraud losses remain high, regulators are signalling that operational readiness and timely implementation of safeguards are non-negotiable.

“For banks, the lesson is straightforward: fraud prevention controls must be prioritised at board level.

“Delays in deploying mandated protections carry not only financial penalties, but reputational and systemic consequences.

“Alongside technical implementation, banks should ensure ongoing anti-fraud training across operational, technology and frontline teams so that regulatory requirements are understood not simply as compliance exercises, but as critical consumer protection measures.

“Embedding fraud awareness into governance and project delivery frameworks reduces the risk of delays and strengthens institutional resilience.”

Canonical: https://experts.pressassociation.com/expert/110/views/b00a42eeb999e378