← Papers

An obligation in one place, a definition in another

The files

Version 1 — 8 October 2026. This file is the fixed, citable copy. It is not overwritten when a later version is published.

Related

A liability rule aimed at the wrong control, paper no. 5, 24 September 2026. Four Measures for Mandate Conformance, version 2, 8 October 2026. The Drift Layer, paper no. 4, 14 September 2026.

I am not a lawyer. What follows is a reading of directions, statutes and reports as published, quoted so the reading can be checked. The questions it raises are for people who are.

Abstract

Confirmation of Payee requires a named firm to check whether the name on an account matches the account number before a payment is sent. The duty is imposed by a direction of the Payment Systems Regulator. The content of the check is not in the direction. It is in a rule book maintained by Pay.UK, and the direction applies that book as it stands at the moment of the transaction. Reference of this kind is an ordinary drafting technique. Maintenance of the text by a private body is, on the instruments examined here, less ordinary. The direction identifies the book and the moment. It does not require a record of which edition was in force, and it does not establish that the maintainer’s practice supplies one. A payment may therefore comply with the direction and remain incapable of reconstruction. The article reads the Confirmation of Payee directions as a specimen of that construction, and considers what a later instrument would have to add if the duty extended beyond a name.

1. Why the edition matters

A customer supplies a name and an account number. The firm asks whether they correspond. That enquiry is Confirmation of Payee. It answers one question about one field. For the firms the regulator has directed, the obligation to make it arises under the direction, not under the text of the check. The text sits in a rule book maintained by Pay.UK. The direction requires compliance with that book as it stands when the request is made.

The same construction could carry a duty broader than a name, and it is in a broader duty that the absence of an edition becomes material. A payer may authorise a series of transactions by a standing instruction specifying a limit, a merchant and a description of what is to be bought, and software may execute purchases under it. Where an item is unavailable, the software may substitute a larger quantity at the same merchant, within the limit, using the same payment details. On a reading of the Payment Services Regulations 2017, such a payment is authorised under regulation 67 and correctly executed under regulation 90(1) where the instruction constitutes consent to a series and the payment fields are intact. Those provisions do not require retention of the instruction, the execution, and the relation between them.[1] A name check can be repeated. A subsequent dispute about whether the execution fell within the description cannot be resolved unless the text that governed it has been kept. The example indicates why the edition matters. It is not the subject of the article.

An instrument of this shape has been in force in the United Kingdom since 2019, under successive directions. The shape is older than its use in payments. The payments specimen leaves the content of the duty with a private maintainer, and does not require a record of the edition in force at the transaction. The record is difficult to obtain because the person who holds it is not the person the direction binds.

The question would arise for any published definition at which a direction pointed. One candidate, not developed here, is a set of measures for whether an automated execution remained within its instruction.[2] The argument does not depend on that candidate.

2. The shape, already in use

Putting a technical definition into legislation has an obvious defect. Unless the instrument itself provides a dynamic reference, it pins a version. The definition of what counts as conforming freezes at the moment of drafting, and changing it means going through the process that produced the instrument. Payments standards do not move at that speed. The usual way out is to write the obligation in the instrument and the definition somewhere else.

Confirmation of Payee is that pattern, already deployed.

Specific Direction 10, in force from 2 August 2019 and as varied from 18 February 2020, created the obligation. After 31 December 2019 a directed firm had to respond to every Confirmation of Payee request that complied with the rules and standards, and the response had to comply with them. The sending duty was the mirror: the firm had to send a request for the account the customer’s unique identifiers related to, and the request had to comply.[3] The direction was revoked by Specific Direction 11 on 30 June 2022. It is quoted as the origin of the construction, not as a live instrument.

The direction defined the standard by pointing away from itself, with one clock for each duty. The rules and standards meant the rule book developed by Pay.UK, as they stood when the request was received, for the responding duty, or when the firm received the customer’s information, for the sending duty.[4]

Specific Direction 17, in force from 24 October 2022, carries the same construction forward. The system must send and respond in compliance with the rules and standards. Those rules and standards mean the rule book developed by Pay.UK, as they stand at the time the request is received, or at the time the firm receives the customer’s information.[5]

Three properties are worth separating, because they are easy to blur.

The reference is dynamic. Compliance is measured against the rule book as it stands at the moment of the transaction. The regulator does not reissue the direction when the standard changes. The maintainer does not have to seek an amendment to improve it.

The definition is maintained by someone who is not the regulator. Pay.UK writes the rule book. The direction supplies the obligation and the enforcement. It does not reproduce the technical text. The directed firm is neither the author of the duty nor the author of the book.

It has teeth, of a particular kind. On 19 February 2026 the Payment Systems Regulator imposed a penalty of £3,779,300 on Bank of Ireland (UK) plc for failing to comply with the send requirements of Specific Direction 17. Full implementation came on 7 January 2025, more than fourteen months after the deadline of 31 October 2023. The safeguard was not applied to transactions involving more than 1.14 million new payees, payments of about £6.9 billion.[6] An obligation defined by reference to someone else’s rule book is not a soft obligation. The qualification matters, and a regulator’s lawyer would make it first. The notice is a deadline case. The system was late, so the check was not applied. The fine shows teeth for the presence of the system, not for the truth of any response measured against the rule book. Whether the quality of an evaluation would be enforced the same way is not established by this notice.

The same shape has carried a liability, not only a check. Specific Direction 20, made under the same power, says the sending firm must reimburse the victim in full, and points to Specific Requirement 1 and the Faster Payments rule book for the content.[7] What that overlay reaches is a separate question. Here the direction is cited for its shape. An obligation in a direction, a definition in a rule book maintained by someone else, measured as that rule book stands at the time, with a penalty attached. The regulator has used the construction three times in the same domain: two Confirmation of Payee directions, and one reimbursement direction.

A mandate-conformance requirement could be made operative the same way: an instrument that obliges named firms to evaluate against a definition maintained and published elsewhere, and to report the result. Nothing here says the Payment Systems Regulator would do that, or should, or is likely to. That is a judgment for a regulator with the powers and the evidence.

3. What the specimen writes, and what it does not

Set Specific Direction 17 against the construction and it comes apart into five pieces: the obligation, the pointer, the maintainer, the moment at which conduct is assessed, and a record of which edition of the target was live.

The direction writes the first four. It writes the obligation. It writes the pointer, and it names the maintainer: the rule book developed by Pay.UK. It writes the moment at which conduct is assessed — two moments, one for responding and one for sending, carried forward from Specific Direction 10. The fifth piece is a record of which edition was live when the request was received. The direction does not write that at all. “As they stand at the time” is a rule for choosing. It is not a record of the choice.

There is a second clock, and it is easy to miss because the direction seems to have answered it. Section 306A(5) of the Merchant Shipping Act 1995 is the sentence a maker can use when it wants to say when a change to the target becomes the target. Specific Direction 17 does not leave that clock blank. It settles it by deferring. Whatever the rule book says at the moment the request is received, under whatever commencement practice the book itself applies, is what binds. The direction adds no notice period and no commencement clause of its own. Section 5 of the direction, “Exemptions and changes to deadlines,” lets the regulator exempt a firm or move an applicable date. No paragraph speaks to changes, versions, notice or commencement of the rules and standards themselves. That negative is from a full read of the direction on 21 September 2026, not from a search.[5]

That is a choice, not an omission, and it is the most deferential position available. It is also what makes the fifth piece load-bearing. With nothing in the instrument between a revision and its bindingness, the record of which edition was live is the only way anyone can later say what the duty was on a given day. A conformance instrument can copy this pointer exactly — a defined term, a book, a maintainer, a moment — and still leave the duty unreconstructable, because the pointer selects a rule for finding the text and does not keep the result of applying the rule.

The person who could keep that result is the maintainer, and the direction does not bind the maintainer. How a firm or an examiner reconstructs the rule book as it stood when a given request was received is a fact about Pay.UK’s publishing practice, and it sits outside the direction. Pay.UK says it “has created the rules and standards for the Confirmation of Payee overlay service, and owns the product.” The service’s page and its frequently-asked-questions page, both read in full, publish neither those rules and standards nor any version, edition or date for them; what they offer is an access address and a route into the service by contract, direct with Pay.UK or through an aggregator.[8] What this maintainer’s commencement practice looks like where it has written one down can be seen in another of its schemes. Under the Image Clearing System Manual, changes “are formally made when a member of the ICS Operator’s legal team authorises the changes in writing and take effect on the date of authorisation, or such later date as is stated in the authorisation”; changes the operator judges clarificatory or minor are made without consultation or separate notification, “by updating the version of this ICS Manual available on the ICS Operator’s website.”[9] That is the shape of what the direction defers to: a moment fixed by an internal signature, and a class of change that arrives by replacing a file. The Image Clearing System is not Confirmation of Payee, and nothing here says the two books are written alike. Naming Pay.UK identifies who could keep the fifth piece. It does not make them keep it. A private maintainer of that kind is not, on the instruments opened below, an ordinary feature of an ambulatory reference.

Specific Direction 17 is the specimen. It is not the claim. Its status on 21 September 2026 was this. It was in force under paragraph 7.2, which provides that it ceases to be in force on 1 November 2026. A consultation on removing that expiry, CP26/2, had closed on 20 August 2026, and no outcome had been published. A bill before the House of Commons would abolish the Payment Systems Regulator and hand its directions to the Financial Conduct Authority; the bill’s schedule answers succession, not expiry. The consultation page, opened in a browser on 8 October 2026, still showed no outcome.[10] This paragraph will be confirmed or revised when an outcome is published, or on 1 November 2026, whichever is first. The rest of the paper does not depend on which of those happens.

4. The pattern is ordinary. The maintainer is not.

Ambulatory reference — an obligation here, a text somewhere else, read as it stands from time to time — is an ordinary drafting tool. Four instances, opened for this paper, sort by who maintains the text.

The FCA Handbook points at the Handbook, at the PRA Rulebook, and at enactments, as they have effect from time to time. GEN 2.2.13R is the default, with a carve-out for rules made by the Financial Ombudsman Service. The maintainer is the regulator, or Parliament.

Section 137T of the Financial Services and Markets Act 2000 lets either regulator’s rules read an enactment as it has effect from time to time. The ambulatory paragraph was inserted by section 66 of the 2023 Act. The target is a public instrument. The section says nothing about when an amendment takes effect, and nothing about readability, because for an enactment neither question arises.

Section 306A of the Merchant Shipping Act 1995 lets subordinate legislation refer to an international instrument as modified from time to time. Subsection (5) is the sentence Specific Direction 17 does not have: the making instrument may say when a modification is to be treated as taking effect. The maintainer is a treaty body. Parliament has said the pointer may fix its own clock.

United States federal regulations may incorporate a publication only in the edition that is approved. Future amendments are not included. The approved edition is filed with the Office of the Federal Register. Reconstructability is bought by forgoing the update. The contrast shows that the ambulatory choice is a choice, and that the reasons a system might refuse it — notice, delegation, the ability to find the text later — are the reasons the fifth piece exists. The same body of rules requires that matter incorporated by reference be reasonably available to the class of persons affected. “Reasonably available” is not “free.” The litigation over standards held behind a paywall is not opened here. When it is, it will either confirm the readability requirement in section 6 or narrow it.[11]

In none of the four is the maintainer a private body. The Handbook points at the Handbook, the other regulator, or Parliament. Section 137T points at Parliament or the other regulator. Section 306A points at a treaty body. The Federal Register points at a filed edition. What Specific Directions 10, 17 and 20 do is point a public obligation at a rule book maintained by Pay.UK, which is none of those. Ambulatory reference is ordinary. Ambulatory reference to a privately maintained definition is what these three directions do, and on the evidence opened here it is the unusual part.

5. The other way to put the definition

The payments directions separate three roles. The regulator imposes the duty. Pay.UK maintains the text the duty is measured against. The directed firm is neither. It must meet a book it does not write.

There is a second way to place the definition, and it collapses the second role into the third. United States securities law, in the examination of nationally recognised statistical rating organisations, asks not whether the firm met a text the regulator pointed at, but whether the firm did what the firm had said it would do. Section 15E(p)(3)(A) of the Securities Exchange Act of 1934 requires the Office of Credit Ratings to examine each such organisation at least annually. Section 15E(p)(3)(B)(i) requires that examination to review whether the organisation conducts business in accordance with its own policies, procedures and rating methodologies. The 2025 staff report says the examinations included a review of a sample of rating actions for that purpose.[12] The maintainer in this template is the obliged firm. The definition is the method the firm declared. The examination is adherence to that declaration. Nothing here says the regime transfers. It is cited for the placement of the definition, and for no other purpose.

The two templates need the same things from a definition: a text that exists, that can be found, and that can be identified as the text in force on the day. They do not put the fifth piece in the same hands.

Under the payments template the fifth piece is a fact about the industry body. Which edition of Pay.UK’s rule book was live when the request was received is a fact about the maintainer’s publishing, and the directed firm may not be the person who has it. A direction that binds only the firm does not bind the person who holds the record.

Under the rating-agency template the fifth piece is a fact about the firm. Which version of its own method was the method on the day is in the firm’s possession, and an examination can ask for it. The gap is different. The firm can amend the method, and unless the instrument requires the declared text to be fixed as at the transaction, the firm can meet the examination against a text written afterwards. The 2025 staff report records an instance of the revision, not of the after-the-fact text: in implementing a revised methodology, one smaller organisation did not ensure that the revision was consistent with its other methodologies and with the meaning of its rating scale and definitions. Staff called the finding a material regulatory deficiency. The organisation’s response was that the revised methodology was consistent. The report does not say the revision was written to fit an examination.[12]

A conformance instrument has to be one of these or the other. It can point at a definition maintained outside the obliged firm, as Confirmation of Payee does, in which case the duty to keep the edition has to reach the maintainer. Or it can point at a method the firm declares, as the rating-agency examination does, in which case the duty is to keep the declaration that was live, not a declaration revised to fit the outcome. Neither puts the definition in the regulator. Both still need the record of the edition, which is the next question, and both still have to say who keeps it.

6. What the definition has to be

Whichever placement is chosen, the duty is examinable only if the text can be found, and only if the edition that bound on the day can be named. The requirement is the same for a book maintained outside the firm and for a method the firm declares. Who keeps the record is a separate question.

The definition needs a text that exists, is maintained, and can be cited by an address the obliged firm and the examiner both resolve to the same words. A definition available only inside a commercial relationship is a poor candidate, because the firm would have to buy the rule it was required to meet. Public, permissionless access is stated here as a design choice of this paper, not as a finding that the subjects of an incorporated standard cannot read it. The payments instruments point at a definition the obliged firm can read. One legal system wrote availability into its incorporation rule. An instance of an obligation that pointed at a definition its subjects could not read has not been opened. The reserved sentence stands.

The industry side supplies a reason of a different kind. UK Finance’s response to the Bank of England’s consultation on the design of future retail payments infrastructure, dated 11 September 2026, names “a risk of fragmentation from the development of proprietary standards for third-party identity, mandates and proof of intent, such as competing scheme- and platform-level protocols,” and says that governance, rulebooks and scheme-level protections “will need to be developed, and this process should be led by industry.”[15] A proprietary definition of mandate conformance is one instance of the risk the trade body names. An industry-led rulebook that pointed at a definition no proprietor held would be one more instrument of the shape section 2 describes. This is a trade body’s consultation position, not an adopted one.

Versioning has three parts, and none of them is a mechanism. The definition needs an edition identifier, so that “as it stands at the time” names one text rather than a family. The instrument needs a moment for the target as well as a moment for the conduct. Section 306A(5) of the Merchant Shipping Act 1995 is a clause that writes the target’s moment. Specific Direction 17 settles that moment by deferring to the maintainer, which makes the third part load-bearing: a record of which edition was live when the transaction was evaluated, so that a later dispute is about whether the firm met the definition and not about what the definition was.

Which record that is depends on the choice in section 5, and the requirement does not. If the definition is maintained outside the firm, the record is the maintainer’s edition, and it has to be producible by someone other than the directed firm. If the definition is the firm’s own declaration, the record is the declaration that was live at the transaction, and not a text revised afterwards. In both cases the instrument has to require the record. Naming the maintainer, or naming the firm, does not require it. Specific Direction 17 names Pay.UK and does not require it.

Mechanisms that already identify an edition and retain it are familiar: a statute database that serves each historical slice at a dated address; a rule book with a date picker; a filing of the approved edition; a digest of the file printed with the citation. Any of them would serve. Which one, and where the record lives, this paper does not specify.

A direction in the grammar of the existing instruments can state the requirement in four sentences. A directed person must evaluate each relevant transaction against the definition and report the result. The definition means the text published at a named address, as it stands when the transaction is committed, identified by the edition then current. A record must be kept, for each evaluated transaction, of the edition against which it was evaluated. The maintainer must publish each edition with the date from which it applies, and must not withdraw an edition from access after a transaction has been evaluated against it.

Specific Direction 17 answers those four unevenly. The first sentence’s duty is there, in the narrower form of send and respond rather than evaluate and report. The second sentence has three elements — a named text, the moment at which that text is taken, and an edition identifier. The direction supplies the first, though it names a book and its maintainer rather than an address at which the text is published. It supplies the second, and supplies it twice: the request received, and the information received. It supplies no third at all, and the edition identifier is the first of the three parts of versioning named above. It contains neither part of the fourth sentence. It does not require each edition to be published with the date from which it applies — which is where the deferral described in section 3 lands, because the direction leaves the moment a revision becomes the book to the book — and it does not forbid withdrawal of an edition after a transaction has been evaluated against it. The third sentence it does not contain in any form, and that sentence is the fifth piece. The illustration shows that the gap is writable in the direction’s own form. It does not say who keeps the record, and it is not a draft direction.

7. Recommendation

Specific Direction 17 names the maintainer and binds the firm. A later instrument should require the record the direction does not write, without changing what the direction itself requires. The duty should lie on whoever holds the facts. Where the definition is maintained outside the firm, that person is the maintainer. Where the definition is the firm’s own declaration, that person is the firm. In neither case is it the payment service provider merely because the provider is the person a Confirmation of Payee direction already names.

If the instrument points at a definition maintained outside the firm, the edition is the maintainer’s. A direction that binds only the directed firm copies the gap Specific Direction 17 leaves: Pay.UK is named, and nothing requires Pay.UK, or anyone else, to keep the edition that was live. The duty to keep that edition should reach the maintainer. The duty to keep the authority under which the transaction was executed, and the result of the evaluation, should reach whoever holds those, which may be the firm, a platform, or an agent operator, and may not be the provider.

If the instrument points at a method the firm declares, the edition is the firm’s. The duty should reach the firm, and it should be a duty to keep the declaration that was live at the transaction. An examination that asks only whether the firm now conforms to its current method can be satisfied by a method written afterwards. That is the gap on this branch, and the recommendation closes it the same way: keep the text that bound, and keep it capable of being joined to the authority and the result.

In both branches the recommendation requires the record and the join. It does not specify how either is built. The decline in section 6 stands.

Three actions already described are not this one.

A specific direction can require a firm to have a system, to send a request, or to reimburse. Specific Directions 10, 17 and 20 do those things. None requires anyone to keep the grant, the close and the edition.

A penalty can enforce a deadline. The Bank of Ireland notice did. It enforces the presence of the system. It does not enforce the truth of a response measured against the rule book, and it does not enforce a record of which edition was live.

An examination can ask whether a firm did what its declared method said. That is the rating-agency review. It is adherence. It is not, by itself, a requirement to keep the declaration that was live, and nothing here says the regime transfers.

The action that would reach the fifth piece is still a direction: an obligation, in the instrument, to keep the authority, the evaluation and the edition, owed by whoever holds them. Consultation on whether Specific Direction 17 should lose its expiry date is not that action. CP26/2 asks about duration and about who is directed. It does not ask about the record. A penalty for a missed deadline is not that action either.

A document that is not the instrument can still be what binds. The District of Columbia Circuit said of an agency guidance document that, “except the last paragraph,” it “reads like a ukase. It commands, it requires, it orders, it dictates.” The excepted paragraph was a disclaimer: the policies were “intended solely as guidance,” did “not represent final Agency action,” and could not “be relied upon to create any rights enforceable by any party.” Even if rights are not created, the court answered, “obligations certainly are.”[13] A document can say in its closing paragraph that it binds nobody and still be what binds. The court was describing an agency’s own guidance, binding the parties that agency regulates; the carry across to a rule book a private body maintains, binding by direction and by contract, is this paper’s and not the court’s. It is a reason to write the duty in the instrument rather than to leave it to the maintainer’s website. It is not a design.

Nothing in this recommendation says the Payment Systems Regulator will do this, or is likely to. The Bank of Ireland penalty did not establish enforcement of the quality of an evaluation. Whether the power reaches a maintainer, a platform or an agent operator is a question of statutory scope, taken up below. The recommendation is about the record the construction does not write.

8. Limits

Confirmation of Payee answers one question about one field. Whether a definition of this size can be carried the same way is not established by the fact that a smaller one was.

The Financial Ombudsman Service publishes its final decisions. Two of them are adjacent to the opening example without being it. One pattern is a continuous payment authority the payer asked to cancel. DRN-4351525, NewDay Ltd trading as John Lewis Partnership Card, was upheld: the firm failed to attempt cancellation of the authority when asked on 5 April 2023, and gave incorrect advice. Three payments totalling £3,731.40 were taken on 9 April. The regulation that names this event is regulation 67(4), which permits the payer to withdraw consent to a series, with prospective effect only, subject to regulation 83(3) to (5). Whether the Ombudsman decided that case on that regulation is not stated here. The other is a Confirmation of Payee name check. DRN-4819858, National Westminster Bank Plc, was not upheld: the request returned a mismatch and the sender did not proceed. The sender had entered a professional account name rather than the full personal name. The bank did not stop the payment. Neither is the opening example. Whether a complaint of that shape has been decided is a question this paper does not answer: the published decisions have not been searched for it with an instrument this paper would rely on.[14]

The directions are made under a specific power over designated payment systems and named firms. Whether any comparable power reaches the parties who hold mandate evidence — merchants, platforms, agent operators, not only payment service providers — is a question about the scope of the regulator’s powers. The place to begin is Part 5 of the Financial Services (Banking Reform) Act 2013. The answer decides which form of the recommendation can be written as a direction at all. Specific Directions 10, 17 and 20 bind named firms. They name Pay.UK. They do not oblige Pay.UK. If Part 5 does not reach the maintainer, the branch that copies Confirmation of Payee cannot be done with a direction of the kind this paper has been reading, and the branch that remains is the one in which the firm keeps its own declaration, because that duty runs against a person the existing power already names.

The four instances in section 4 establish that ambulatory reference is an ordinary drafting tool. They do not establish that pointing a public obligation at a privately maintained rule book is ordinary. On the evidence opened here that configuration is three directions, from one regulator, in one domain, about one rule book maintainer: Specific Directions 10 and 17 for Confirmation of Payee, and Specific Direction 20 for reimbursement, cited here for its shape.

The rating-agency regime is a United States securities regime. Nothing here says it transfers.

The mechanisms named for identifying an edition and recording which was live are named, not specified. This paper takes no position on who would build such a thing, or on what terms.

Confirmation of Payee had something a wider duty does not yet have: a rule book already written, by an organisation already constituted to write it. A published definition is not a rule book.

Notes

[1] Kirby, M. T. (2026) A liability rule aimed at the wrong control: what the law offers when a delegate exceeds its instruction, paper no. 5, version 1, 24 September 2026, published 25 September 2026. https://driftlayer.org/papers/liability-rule/ The author has set the authorisation reading out elsewhere. It is cited here as the example in section 1, not as a premise the reader must accept.

[2] Kirby, M. T. (2026) Four Measures for Mandate Conformance, version 1, 10 September 2026. https://driftlayer.org/papers/definitions/ Version 2 was published on 8 October 2026. This draft cites version 1, which is retained. The author maintains these measures. The argument does not depend on them.

[3] Payment Systems Regulator, Specific Direction 10, as varied February 2020, paragraphs 4.1, 4.2, 4.5, 4.6 and 6.1. In force 2 August 2019; in force as varied 18 February 2020. The regulator’s page records that it was given on 1 August 2019, issued in varied form on 14 February 2020, and revoked by Specific Direction 11 on 30 June 2022. The revocation date in the text is the page’s. The text uses the instrument. Opened 21 September 2026. PDF: https://www.psr.org.uk/media/gp2juzmq/psr-specific-direction-10-confirmation-of-payee-february-2020.pdf Page: https://www.psr.org.uk/publications/legal-directions-and-decisions/specific-direction-10-confirmation-of-payee-varied-february-2020/

[4] Specific Direction 10, paragraph 4.28, including the parentheticals attaching one clock to paragraph 4.1 and one to paragraph 4.5.

[5] Payment Systems Regulator, Specific Direction 17, October 2022, paragraphs 3.1, 3.2, 7.1, 7.2 and 9.9, and section 5. Opened 21 September 2026, sections 1 to 9 and the Schedule enumerated. The statement that the direction contains no provision on changes, versions, notice or commencement of the rules and standards is a negative on that read: “CoP rules and standards,” “rule book” and “Pay.UK” occur only at paragraph 3.2 and in the paragraph 9.9 definitions. PDF: https://www.psr.org.uk/media/zxgkagpj/psr-specific-direction-17-expanding-confirmation-of-payee-oct-2022.pdf Page: https://www.psr.org.uk/publications/legal-directions-and-decisions/specific-direction-17/

[6] Payment Systems Regulator, Decision Notice, Bank of Ireland (UK) plc, 19 February 2026, and the press notice of the same date. The figures for payees and value are from the press notice. Opened 20 September 2026. https://www.psr.org.uk/media/d4ml5d5d/psr0013-project-chiswick-decision-notice.pdf https://www.psr.org.uk/news-and-updates/latest-news/news/psr-fines-bank-of-ireland-uk-over-37m-for-failing-to-implement-confirmation-of-payee/

[7] Payment Systems Regulator, Specific Direction 20 and Specific Requirement 1, July 2024. Opened 19 September 2026. https://www.psr.org.uk/media/rqrpnb0w/amended-specific-direction-20-july-2024.pdf https://www.psr.org.uk/media/xenefhgp/amended-specific-requirement-1-july-2024-corrected.pdf

[8] Pay.UK, Confirmation of Payee, https://www.wearepay.uk/what-we-do/overlay-services/confirmation-of-payee/ and its FAQs page, https://www.wearepay.uk/what-we-do/overlay-services/confirmation-of-payee/faqs/ The service page was opened 21 September 2026. Both pages were read in full on 8 October 2026 from captures supplied by the author (785 and 1,574 words; SHA-256 ae11343ea4798ca26632f07c83128b24ff9898e6aa12416d2b62d8535518cb9a and f620efb8ba0e6e00b92fa2c5860526d035c28c548410447df26296e4cf98e711). The quoted sentence is from the FAQs page. Neither page carries the rules and standards, a version or edition identifier for them, a date, a change record, or terms on which a person who is not a participant might obtain them; the access route given is an email address, and participation is by contract with Pay.UK as a Direct Participant or with an aggregator as an Indirect Participant. That is a negative on a full read of those two pages, not a statement about documents published elsewhere.

[9] Pay.UK, ICS Manual, Version 3.0, pages 11, 37 and 248. Read 8 October 2026 from a copy supplied by the author: 269 pages, 2,228,394 bytes, SHA-256 1e5af14744fc6978fb0e347274c39d6a21fae1a97fc05347732da28d92f962b8, PDF created 23 December 2025. The Image Clearing System is a different scheme from Confirmation of Payee and this manual is not the Confirmation of Payee rule book; it is cited for how this maintainer writes a change regime where it writes one. Page 11 records that the ICS User Documents are “not made available to the public”; page 37 defines the ICS Rules as those made by the operator “as in force from time to time.” Every page is footed “Classification: Restricted” while page 10 describes the manual as published “in a document which is publicly available”; both are reported here and neither is resolved.

[10] Payment Systems Regulator, CP26/2, July 2026. https://www.psr.org.uk/media/ugtogbad/cp26-2-extending-specific-direction-17-july-2026.pdf Consultation page: https://www.psr.org.uk/publications/consultations/cp262-specific-direction-17-confirmation-of-payee-removing-the-expiry-date-and-expanding-the-scope-of-directed-firms/ Both opened 20 September 2026. The consultation page was opened again in a browser on 8 October 2026 and showed the consultation document, the 20 August closing date and one supplementary file; no outcome and no policy statement.

[11] 1 CFR Part 51 (Title 1, Chapter II). https://www.ecfr.gov/current/title-1/chapter-II/part-51 Opened 21 September 2026. The litigation over standards incorporated by reference is not opened for this paper and is not characterised here.

[12] Securities Exchange Act of 1934, section 15E(p)(3)(A) and (B)(i), codified at 15 U.S.C. § 78o-7. https://www.law.cornell.edu/uscode/text/15/78o-7 Securities and Exchange Commission, Office of Credit Ratings, 2025 staff report (published 24 April 2026). https://www.sec.gov/files/2025-ocr-staff-report-compliant-4-24-26.pdf The report says the staff reviewed a sample of rating actions. The methodology-revision finding described in section 5 is item g(1), under the heading for the first smaller organisation, within the summary of essential findings and responses to material regulatory deficiencies; the report records that staff identified that essential finding as a material regulatory deficiency. No page pin is given; the finding was read from the report PDF on 8 October 2026. Cited for that review and that finding, not for a transfer of the regime.

[13] Appalachian Power Co. v. Environmental Protection Agency, 208 F.3d 1015 (D.C. Cir. 2000) (Randolph, J.). The document was the Environmental Protection Agency’s Periodic Monitoring Guidance for Title V Operating Permits Programs (September 1998). The quoted sentences are the court’s, of that guidance, excluding its last paragraph. The disclaimer quoted from that last paragraph, and the answer that obligations are created even where rights are not, are also the court’s. No star page is given; the opinion was opened at https://openjurist.org/208/f3d/1015 on 8 October 2026. Cited for the proposition that a document which is not the instrument can still be what binds, including where its closing paragraph says that it does not, and for no other purpose.

[14] Financial Ombudsman Service, DRN-4351525 (continuous payment authority; upheld) and DRN-4819858 (Confirmation of Payee name mismatch; not upheld; the complainant’s window to accept or reject ran to 28 August 2024). Both decision documents opened 8 October 2026. https://www.financial-ombudsman.org.uk/decision/DRN-4351525.pdf https://www.financial-ombudsman.org.uk/decision/DRN-4819858.pdf The two decisions were located and opened individually; the published decisions database was not searched systematically for this paper, and no claim is made about what such a search would return. Payment Services Regulations 2017, regulations 67 and 83. https://www.legislation.gov.uk/uksi/2017/752/regulation/67 https://www.legislation.gov.uk/uksi/2017/752/regulation/83 Opened 8 October 2026. The legislation.gov.uk copy consulted was the revised text recorded as in force on or before 22 September 2026; that date is the site’s revision marker, not the date of the search.

[15] UK Finance, Response to the RPIB consultation on the design of future retail payments infrastructure, p. 83 (“Interoperability, governance and fragmentation”). https://www.ukfinance.org.uk/system/files/2026-09/UK%20Finance%20response%20RPIB%20consultation%20future%20infrastructure%2011092026.pdf Opened 24 September 2026: PDF of 90 pages, 1,202,784 bytes, text extracted from the file, two independent extractions in agreement; printed page numbers. UK Finance’s consultation-responses page carries the entry dated 11/09/2026 and does not distinguish the document’s date from the date it was posted; the consultation closed on 11 September 2026. That page opened 8 October 2026: https://www.ukfinance.org.uk/policy-and-guidance/consultation-responses/boe-rpib-consultation-design-future-retail-payments The same page of the response records that members “express an equal preference for agentic payments to evolve within a new, dedicated scheme or to evolve through existing schemes.” A trade body’s consultation response — not an instrument, and not an adopted position.

Other instruments opened for section 4 and not quoted at length: FCA Handbook GEN 2.2.13R, https://www.handbook.fca.org.uk/handbook/GEN/2/2.html ; Financial Services and Markets Act 2000, section 137T, https://www.legislation.gov.uk/ukpga/2000/8/section/137T ; Merchant Shipping Act 1995, section 306A, https://www.legislation.gov.uk/ukpga/1995/21/section/306A . All opened 21 September 2026.