Confirmation of Payee – what you need to know

David Shinkins: Great, thank you very much.  So good afternoon, everybody.  To introduce myself.  So I’m Dave Shinkins, I’m the global head of cash management service for Barclays Corporate Bank, and firstly, a huge thank you to all of you for joining today on what is on what is actually an exceptionally interesting topic, I know, for all of our clients, which is, as we said earlier, a Confirmation of Payee.

Before we go to the introduction, though, for those of you that are in front of your computers, we do have some slides available for you, so I would suggest if you want to follow along as we’re talking through the presentation, please visit, barclayscorporate.com/confirmation-of-payee, and the same section that you would have clicked through to register for this call, you’ll find a link entitled “presentation slides,” so I’m just going to send that link again, for those of you that have that, so it’s www.barclayscorporate.com/confirmation-of-payee.

So, I think, as I mentioned earlier, thank you very much for joining the call in honestly what is, at the moment quite a – quite a period of uncertainty (particularly) – particularly, in the U.K.  The one thing I would say about this industry initiative, which is Confirmation of Payee, has, obviously, been a long-time coming.  

Clearly, one of the primary objectives of Confirmation of Payee is to reduce the instances of misdirected payments that are associated with APP fraud, so authorized push payment fraud, which is otherwise known as, impersonation or CEO fraud.

The key thing for us, as Barclays, is making sure that, along with the rest of the industry, we’re actually safeguarding that of our clients and, of course, aiming to reduce that (overall level of further expecting to see).  I will be joined today by two colleagues by Barclays corporate.

The first is Katherine Moore, from our global payment solution’s team.  And the second colleague is (Shameet Shah) from our (board) initial team.  

The call today is going to last 30 minutes after which there will be time for 15 minutes of Q&A. So on that note, I’m going to firstly hand over to Katherine.  So, Katherine, over to you.

Katherine Moore: Thanks, David.  And good afternoon, everyone, and so today I’m going to be talking about Confirmation of Payee, as David said.  The agenda for today just covers a few topics that relevant for this initiative, so I broadly want to cover what confirmation of payee is, why it’s being implemented and how does confirmation of payee complement our security model, and, what are the timeframes that we’re working towards, how we are actually delivering this initiative, and really, what are the benefits and implications for you and for your business.

And some (information) what’s next and where you can find further information, and, as David said, then we’ll move into some questions and answers to give you the opportunity to raise any queries that you may have.

So for those of you with the slides and, on slide three, really what is Confirmation of Payee.  The Confirmation of Payee is a – it’s a fraud prevention tool, and it’s designed to tackle authorized push payment fraud, so things like impersonation fraud, that we see, and very widely in the industry, this type of fraud is (tackled) specifically by this too.

The Confirmation of Payee an answer to all fraud problems, but what it is, it’s a tool to add to the kit of fraud prevention tools that are available industry-wide and within the banks as well.  What the service does and, it allows the payer to check the name of the account against sort codes and the account number that they hold.

So, what you will do when you make a payment, when Confirmation of Payee goes live, you will put in  your sort codes, your account number, the name of the account that you think you’re paying, and then you need to indicate whether it’s the person you’re paying or whether it is a business you are paying.

The check, then, is in done in real time, it only takes a couple of seconds, and what will – it will do is respond to you with either a match, a close match, a new match or non-available.  For those four outcomes very clearly are match, the name matches on the account, so you’ll get a positive response.

A close match.  The name you have input is broadly similar to what you have input.  Things like, abbreviations will be included in that close match so if you enter limited versus “ltd” on the company name, that would respond as a close match for you.  

And then no match scenario, the name that has been entered is nothing like what is actually held on the beneficiary banking system.  And that is where that matching is done against, so it is actually the account information held by the account holding bank.

The other response is unavailable.  So that could be for technical reasons.  It would be because that particular bank doesn’t offer Confirmation of Payee.  It may be because for a personal customer, for example, they may have actually opted out of this service for data privacy reasons.  A number of reasons are available under that unavailable brackets.

For all of those responses, it is entirely up to the payer whether they want to proceed with that payment or not.  In the event of anything except a match, the liability would then shift from the bank to the payer.  If, in the event of a close match, a new match or an unavailable response, we’ll go into that in a little bit of detail in a minute, but that is a key change as part of this and part of this initiative.

I’ll just hand it to (Shameet) for slide four on implementation.

(Shameet Shah): Thanks, Katherine.  So hi, I am Shameet Shah.  I work in the digital banking team in corporate, specifically looking at security and fraud prevention across our digital channels. So to sum this up, focusing on why CoP is being implemented and how it can benefit your business and your stock.  So the key objectives mentioned that it reduced its instances of misdirected payments associated with different types of authorized push payment fraud.

The key issue, that will be addressed by CoP.  In fact, the initiative Confirmation of Payee got running when there was a consumer who wrote into the Which? magazine to ask, you know, can’t banks help confirm or determine a beneficiary name whether that name actually is an account or sort code.

So an industry-wide initiative, and one main reason is trying to prevent and reduce the amount of authorized push payment scams and fraud we see in the industry.  So, we see where that headline number on the left-hand side to seven million pounds in the first half of 2019.

Further down, just some information around Barclays, I mean, these are very – these are very constant – consistent across the industry, not just Barclays, this is what – you know, as a bank, we started tracking reporting fraud from – basically at the end of 2014. 

And this kind of shows you the – you know, the shift we’ve seen across industry in the last couple of years, very high levels, we saw – in 2015, 2016, we saw lot of Trojan fraud. That basically means a criminal has been able to take over your digital banking or your payment system and has made the payment themselves.

With a lot of work with Barclays to – to prevent that, and in 2016 onward, we’ve seen a shift from criminals trying to attack our systems and actually going straight to our – to our clients and our colleagues and providing them with some kind of payments direction whether it be via e-mail or a phone or SMS or an invoice, you know, basically, a payment instruction – provided to the genuine user to convince – to try to convince them instruction is genuine, and, therefore, make that payment using a payment system.

And that is, basically, the difference between, kind of, account take over fraud where the criminal has made a payment, and APP fraud where the – where the genuine user has been tricked into making a payment, and that’s where we’ve seen the mass increase, and that’s on APP fraud.

Our benefits, of course, are around, basically, credit confidence that you’re paying to the right person and to stop mistyping an account number or sort code or an account name.  They’re trying to help both colleagues, clients and trying to prevent fraud.

So, moving to – if you can’t see the slides, slide five, this, very briefly talks about our layered fraud security model across our digital channels.  These images have been around for three or four years, and it competent because of the fact that it is working.  And what we do is upon these different layers.

Basically, the model is all around providing different ways for our colleagues, our clients, to kind of detect any kind of erroneous payments or any kind of scam that we might – that they may think they’ve received. 

It’s all around prevention detection and recovery, so we have the first two layers all around trying to stop malware fraud, and, also, trying to stop, our users being tricked, so we provide around the different types of attack methods we see and provide lots of tools that can be accessed through our corporate banking website including some videos around, you know, the types of attacks we see, and then, how you can prevent those.

Briefly, online bank control, fraud monitoring, fraud payment profiling the next three layers, they’re around Barclays trying to detect any kind of unusual suspicious behaviour. This is where we put the control on the client to basically assign roles and responsibilities within our payment channels, and, also, to provide techniques and solutions where we can look for suspicious behaviour when using payment channels, and, also, suspicious or unusual payment types.

And we use fraud modelling to try and analyse what we see and detect and, then hopefully, you know, prevent fraud by stopping these payments and contacting our clients to confirm whether a payment is genuine.  

Now confirmation of payee detection area whereby we are, you know, we are the industry providing another level of – or layer of security whereby a user can be more confident that a payment instruction is genuine by what they see when they type in a payment and the response that they receive from the confirmation.  

Moving on to slide six.  Now back to what timeframes are.  Firstly, just so – just so you’re aware, we basically in phase of one confirmation of payee.  Phase one of CoP.  Phase one has been signed off by the banks you see on the screen.  If you can’t see those, they are Barclays, Bank of England, HSBC, Lloyds NatWest, Nationwide, RBS, Santander, Ulster Bank, Monzo and Starling.

All these banks signed up to choose a service by the 31st of March 2020, and then in the next year, we expect more banks to join the service.  

So, in terms of brief timelines, the first phase completed back in December 2019, and this is where banks must be able to (receive) and respond to Confirmation of Payee requests from other banks.

The next phase is phase 1B, but this of 31st March 2020, and this is where banks must be able to send Confirmation of Payee requests and notify the payee of the outcome.  So to demonstrate that with our channels, if you’re using Barclays.Net and you’re looking to make a payment to HSBC, you go onto the fast payment screen, you type in the beneficiary name, the sort code, account number. 

By doing that, we dynamically send a request to HSBC, to ask them if the name matches the sort code and account number and that – and that response back from HSBC will be provided on the screen.

And one of the four options that Kathrine mentioned earlier, and then the user can decide if they want to proceed with that payment or not.

As said earlier, there are future phases beyond the 31st of March this year.  We expect other payment types and have other clients come to scope, other banks to join. But at the moment, the industry and the banks are all concentrating on delivering the first – the first phase of Confirmation of Payee, and, then, following that, you know, we’ll be working currently, what future phases will look like.

Katherine Moore: So, and, yes, so, I suppose, so, the question that will come to mind for all of you and for us, as well, is, what are the implications and given the current climate, given the implications of external environment, COVID-19, and all the disruption that that is causing and to everyone, at this time, so we are working very closely with the regulator at the moment.

And, in that regard, and, you will see that the end of the 31st of March, as it is right now, we are working with the regulator to determine if that continues to be an appropriate delivery date or whether we may see an extension to that date, so that’s something we will be able to share with you is that, and it does in case becomes the case.  

What you will see and some banks have actually already gone live with some of their channels for Confirmation of Payee, and that was as early as mid-February, so some banks will have channels live, so you may have experienced and Confirmation of Payee from a consumer perspective already.  You may have seen it on your own online banking, and you may have actually received payments, and you have some queries coming into your account in relation to Confirmation of Payee.

So that may be happening already, but we will start to see all of that volume and ramp up as more and more banks put their channels live and then that list of banks that Shameet just shared with you, those are the banks that have decided to be part of this first phase of Confirmation of Payee. There are several others waiting in the wings to introduce this initiative post 31st of March or at a later date, and, should that date be extended.

OK.  So, specifically, for Barclays, how are we actually delivering Confirmation of Payee.  So this is slide seven if you have it in front of you.  So just to make you aware, the service is regulated by the payment services and the regulator and in conjunction with Pay.UK, and for those of you who are interested how it works, technically, in the background, and it works by the open banking infrastructure from (API) to (API), bank to bank.

So that allows that bilateral basis of information sharing in a secure manner that – and it makes it extremely fast to actually get those responses.  So, when you’re thinking about your process loads of how you input a payment, and this will not slow down your payment processing.  If you input a payment, and you’re asked to a CoP check as part of that payment as it is in (scope) of Confirmation of Payee.  As I said, it will only be a couple of seconds for that response.  

So that takes me to what is actually in scope of phase one of Confirmation of Payee.  So the list of items that are in scope for this and similarly a list of that are out of scope.  So, in scope are the participating banks that we have mentioned.  As I said, more will come on board, and, as time passes.  This initiative is for corporate, businesses and consumers, so everyone is included in it.

It’s for U.K. starting accounts only, so no currency accounts would be included or anything outside of the U.K.  Electronic payments only, single payments, online channels, and the payment types are FPS, faster payments and CHAPS.

Also, in scope are confidential invoice discounting clients, but I’ll talk about that slightly later on, and customer presence only, so you have got to be either present by your online channel, or in the branch to actually – or over the phone to actually to utilize the confirmation of pay check.  

And out of scope, BACs including direct debits are not in scope, bulk payments are not in scope including file (via) payments, any other payment types.  And if you have a service where you submit payments on a host-to-host basis, via SWIFT, via EBICS, all of those different integration methods, and that is not actually in scope for confirmation of payee phase one.

Agency banks are not included in the scope, and head office and collection accounts, and then I’ll talk about that in a second, are not in scope with the solution.

So, the channels that Barclays will be delivering the solution on are Barclays.Net, which many of you may use, and iPortal, and (standing orders).

So for Barclays.Net, there is a summary of updates that have already been – that has already been published and on (.net) that you can have a look at, it will explain how the service (will) – how the initiative will work when it goes live and what changes, and users will actually see on the system.

Shameet, do you want to add anything to the channels delivered?

Shameet Shah: No, you’ve covered the key points on that.  Just to repeat, we’re looking some of our internet based calls, same channels which are Barclay.net and iPortal for phase one.  We do have a couple other niche systems, but we’re prioritizing, like I said, the – our call based channels.

Katherine Moore: OK.  On slide eight, then, I have outlined what are the benefits of this – of this service, and the implications for your business, and you may have seen that your terms and conditions have been updated, so you will have the (same) communications.  And, in relation to that, alongside it, you may received a leaflet about Confirmation of Payee and changes that that will mean.

So really there’s two main areas of consideration, and the Confirmation of Payee.

The first one is outbound payments.  So for your business, do you have any payments that actually fall into the scope of phase one, so those in scope and out of scope items that we looked at, if they are in scope, then you’ll need to consider how your (outlying) payments will be affected.  Think about how your payment are made, whether they’re single payments or whether bulk payments, what channels do you use, if any.

And are your staff familiar with these changes, so I refer to that summary of updates in Barclays.Net, any users should make themselves familiar with that.  And what will happen in Barclays.Net and of our primary channel is, when an inputter goes into Barclays.Net to make a CHAPS payment or an FTS payment, they will be asked to input their sort code, account number, the name that they’re paying to, and whether it’s a business or person they’re to.

The CoP check will then happen in a couple of seconds, and the response will come back.  The inputter, then, will make the decision whether to go ahead and process that payment or not depending on that CoP response, so there’s a consideration that, depending on the risk appetite of your company, do you want to allow the inputter to proceed with that payment or not depending on what the match response actually is.

If they chose to proceed with the payment, and that will be a liability acceptance to do that.  The authorizer will then see the outcome of that CoP check, and they’ll be able to then authorize the payment or decline it, depending on what your risk appetite is.  If there are subsequent authorizers, they will also be able to see the outcome of that CoP check.

So the consideration for outbound payments is really to familiarize yourself with any changes and consider that risk appetite and how you want your inputters for .Net put in the payment and how they should treat this in terms of the response that they get.

On the flip side of that is the inbound payments.  So do you receive any push payments, i.e., faster payments, or CHAPS payments into your accounts.  If you do, you need to consider how these account details are actually communicated to your payers.  So if you send out an invoice or you put payee information on your website, for example, you need to make sure that the account name you give matches what we hold on our system.

What we match against in our system is the legal name and the trading as name, and we also have an internal account name that we use for a matching.  What you may see is many of you are multi banked.  You may see some differences between the matching rules between the banks.  

That’s something that’s – we’ll begin to see as various banks go live, and that matching end criteria is something that is – that is fluid – that can be changed, that can be – that can be worked on if need be, if we’re getting – if we’re finding that certain things, such as, common acronyms are not – are not being matched, but that all being done as part of the – of the rollout.

Again, from an inbound perspective, and as you think about your client servicing teams, are they prepared to actually answer questions about Confirmation of Payee.  The payer is trying to make a payment to you to get a CoP check and they’re getting no match, for example, that is likely to trigger a call to yourselves and to your servicing teams asking, maybe what this is, and should they go ahead with the payment, and how to – how to proceed – ready to give them that assurance.

So that conversation with your servicing teams and the procedures of our entire servicing teams deal with that, needs to be considered.  I’m very conscious of time, so at the bottom of slide eight there are some other considerations in relation to more complex structures, so Confidential Invoice Discounting and Head of Collection Accounts, and complex naming structures.

There are specific guidelines in the regulations for all of these items, and if you fall into, particularly, the head of collection account and confidential and bulk discounting category, you are likely to have already received communications from your relationship team.

If you do have concerns about that, please contact your relationship manager and they’ll talk to you about those concerns.

So very quickly, what’s next for confirmation of payee, phase 2 isn’t defined yet and, as I said, we’re in a dynamic environment where lots is changing, and there are many concerns and many disruptions, so phase two, as I said, is not defined yet, but it’s something that is being actively worked on, and from what is not included in phase one, such as, bulk CoP checks, file uploads,  reference data, maybe other payment types, and all of those are possibilities and may come in within phase two, but there will be more communication to follow on that

So for further information and, obviously, you can contact your relationship teams, then if you have any particularly queries or concerns, there is industry information available on Pay.UK dedicated page, UK finance has a dedicated page, as well, with corporate specific questions, and FAQs, a summary of updates is available on the notification boards and Barclays.Net.

We have a corporate banking web page, which is – I think, where you accessed the slides if you some available, and there’s digital channels help centre page as well, so that’s all the information and can find any of those cases that will be updated and as this – and, as this evolves.