← Papers

A liability rule aimed at the wrong control

what the law offers when a delegate exceeds its instruction

Abstract

Part 7 of the Payment Services Regulations 2017 allocates loss on unauthorized and incorrectly executed payments through a burden rule, a notification window, a refund and a chain of recourse, and every one of those parts is wired to authentication or to the rail fields. For a software delegate acting on a standing instruction, authentication and consent come apart: the credential was used correctly, by the right person, against a live authority, and the close is outside the description the payer gave. This paper reads regulations 67, 74, 75, 76, 77, 79 and 90, Philipp v Barclays, Hamblin v Moorwand in both courts, the attribution authorities, the APP-reimbursement overlay and Regulation E against that case. Four doors are opened and none reaches it. The finding is about evidence rather than remedy: whether anyone owes the payer a duty to construe the mandate is a question of obligation, and whether a breach could be shown is a question of evidence — and the record that would decide it, the grant, the close and the join between them, is one nothing examined requires anyone to keep. What kind of instrument could require it is a question about instruments, and is not answered here.

Related

The Drift Layer: the clean, fast session that is not proof of authority, paper no. 4, 14 September 2026. Response to the HM Treasury consultation on Modernising Payment Services Regulation, 13 September 2026. Response to the RPIB consultation, 9 September 2026. Four Measures for Mandate Conformance, 10 September 2026.

The files

Version 1 — 24 September 2026, published 25 September 2026. This file is the fixed, citable copy. It is not overwritten when a later version is published.

I am not a lawyer. Everything below is a reading of statutes, regulations and judgments as published, quoted with their paragraph numbers so that the reading can be checked; the questions it raises are questions for people who are.

Executive summary

Part 7 of the Payment Services Regulations 2017 is a working loss-allocation regime. It says who must prove what, how long the user has to notify, what the remedy is, and where the loss lands when a control fails. The difficulty is which control those parts are wired to.

The test that decides whether a payment was authorized is regulation 67: whether the payer consented to the transaction, or to a series of which it forms part. The evidence rules and the triggers that move the loss are about authentication — the credential, its recorded use, strong customer authentication performed or accepted. For a stolen instrument those two things fail together. For a software delegate acting on a standing instruction they come apart. Authentication was performed, correctly, by the right person, against a live authority. Regulation 77 allocates loss only on a transaction already found unauthorized, and its two limbs that turn on the credential are not engaged. The payer who says “I consented to a series, but not to this” is inside regulation 75(3), and is left arguing about scope with no access to the evidence that would settle it.

Regulation 74 names a second track in the same sentence: non-execution, defective execution, late execution. Regulation 90(1) is the correctness control on that track, and a substitution that still hits the named merchant with the named amount, on time, is not that case. Regulation 79, the one Part 7 door keyed to the scope of a consent, is keyed to amount alone. So there is a third branch: authorized under regulation 67, deemed correctly executed under regulation 90(1), the close outside the description of what the payer instructed the agent to do. Part 7 does not open on it. It is argued in the conditional — where a standing instruction constitutes consent to a series, and where the rail fields are intact — and the remaining question is construction of the mandate.

The United Kingdom has already walked around the authorized/unauthorized binary once. Philipp held that Part 7 does not reimburse a payment the payer authorized, even if the consent was procured by fraud. Section 72 of the Financial Services and Markets Act 2023 disabled regulation 90 as a defense to a separate Payment Systems Regulator requirement for Faster Payments orders executed subsequent to fraud or dishonesty. Specific Direction 20 and Specific Requirement 1 define authorization in regulation 67’s own words and reimburse anyway. Their definition of the eligible case is fraud or dishonesty; an agent that paid the intended merchant the intended amount for the wrong goods fails it at its first clause, and the regulator’s civil-dispute guidance is the official refusal of this paper’s case.

Hamblin supplies the other ledger. Punctilious observance of the agreed mechanics can satisfy the statutory authorization machinery while leaving a common-law inquiry standing. The Court of Appeal restored the trial judge on the facts of inquiry, reserved whether any such duty applies to payments processed with no human in the loop, and left the relationship between statutory authorization and the common-law duty undecided. Quincecare, as restated in Philipp, is the fraud-shaped instance of a general duty to interpret, ascertain and act in accordance with the customer’s instructions. A pack-size substitution may never engage the dishonesty trigger, and whether the general duty of construction sits on a sending provider that received only a clear payment order, rather than on the platform or operator that received the description, is left open. The attribution authorities — Singularis, Bilta, Meridian — explain why the same trust that makes the instruction look authorized cannot then make the miss the principal’s own act, and why a court needs an observable fact before it can say a provider was put on inquiry about an instruction no person saw. They do not invent that fact.

United States consumer-payment law has the same shape. Regulation E’s unauthorized-transfer definition and Comment 2(m)-2 supply an exclusion for transfers by a person furnished the access device, and an event that ends the exclusion: the consumer’s notice that the delegation has ended. None of the three sources examined — regulation 67(4), a live variable-recurring-payment product, Regulation E — forbids a narrow amendment of a standing grant. None provides for it, and none records what the payer agreed to when execution diverged.

The finding is about evidence, not remedy. Whether anyone owes the payer a duty to construe the mandate is a question of obligation, and no record creates an obligation that does not exist. Whether a breach could be shown, if the duty exists, is a question of evidence, and the record it needs — the grant, the close, and the join between them — is one nothing examined here requires anyone to keep. What kind of instrument could require it, and what such an instrument would need from the definition it points at, are questions about instruments, and they are not answered here.

1. The room

In 2018 Fiona Philipp and her husband were deceived by criminals into instructing Barclays to transfer £700,000 from her current account to bank accounts in the United Arab Emirates. She gave the instructions in person, at a branch, twice, and twice confirmed them when the bank telephoned to ask whether she wished to proceed. The money was lost.¹

Five years later the Supreme Court held that the bank had owed her no duty to refuse the instruction she herself had given. The reasoning that matters here is not about the bank’s duty of care, on which the case is usually cited. It is about the Payment Services Regulations. Lord Leggatt, for the court, described Part 7 of the Regulations as “largely concerned with establishing rights and obligations of payment service users and providers in relation to unauthorised payment transactions,” and then drew the line that this paper is about:

“They do not provide for reimbursement of any payments which the payer has authorised. They therefore do not offer any means of redress for a customer who is a victim of APP fraud. Indeed, they have been perceived as containing an obstacle to the imposition of a regulatory obligation on payment service providers to reimburse customers who are victims of APP fraud.”²

Mrs Philipp had consented. Regulation 67 was satisfied. Regulation 76, the refund provision, never opened. The fact that her consent had been procured by a fraud did not change which side of the line the payment fell on.

The court also recorded what Parliament had done about it. Thirteen days before the judgment was handed down, the Financial Services and Markets Act 2023 received Royal Assent. Section 72 amends regulation 90 of the Payment Services Regulations “to enable liability to be imposed ‘where the payment order is executed subsequent to fraud or dishonesty’” and requires the Payment Systems Regulator to impose a reimbursement requirement in such cases.³ The inserted text is short. Nothing in regulation 90 now “affects the liability of a payment service provider under a relevant requirement in a case where the payment order is executed subsequent to fraud or dishonesty.”⁴ That is how the United Kingdom got mandatory reimbursement for authorised push payment fraud: not by reading “authorised” differently, but by legislating around the Regulations’ own binary. The Supreme Court’s phrase for what the Regulations had been “perceived as containing” was an obstacle, and Parliament removed it for one class of case.

The sequel is a smaller case with a larger reservation, and the reservation is about software: whether the duty applies to payments processed with no human in the loop, and how authorization under the Regulations relates to the common-law duty at all. In 2017 Gareth Hamblin was invoiced £160,000, which he paid into an electronic wallet that a company called RND Global held with Moorwand, an FCA-regulated electronic money institution.⁵ The person controlling RND paid the money away. The Hamblins were not Moorwand’s customers. They sued in RND’s name, derivatively, arguing that Moorwand should have been put on inquiry before it acted on the pay-away instructions. At first instance the claim failed on the facts. On appeal, Marcus Smith J held that Moorwand had been on inquiry and allowed the appeal on that ground — the claim being one that obliges the provider “to restore or correct the balance” of the account, “not a claim that sounds in damages”⁶ — but dismissed the claim that the pay-aways had been “unauthorised” under the 2009 Regulations, and refused permission to appeal on that ground alone:

“Regulation 55(2)(b) imposes a purely mechanical requirement on the payment service provider to observe the procedures agreed between it and its customer. The Payment Services Regulations are concerned with transactional speed and efficiency. Payment service providers should execute payment instructions swiftly and in accordance with clear criteria.”⁷

“As the Judgments make clear, it cannot be said that the mechanical provisions regarding payment instructions were disregarded by Moorwand. To the contrary, they were (as the Judgment records) punctiliously observed. … The point is that a punctilious observance of the mechanics of a mandate does not absolve a payment service provider from observing the Quincecare duty where it arises, as it does here.”⁸

The Court of Appeal restored the trial judge in July 2026.⁹ Moorwand had not been put on inquiry, and the claim failed again. What the Court of Appeal did not do is the part that bears on what follows. An argument was advanced on appeal that the payments had been made “by computer and automatically.” Foxton LJ declined to decide what that would mean:

“In circumstances in which the trial judge was never asked to make any findings on whether payment requests were processed without human intervention and no argument was made by Moorwand that a Quincecare duty either did not apply (or applied only in some modified form) were that to be the case, nor were the Hamblins required to raise any counter-arguments as to what, if any, monitoring duty there might be in such circumstances (whether undertaken algorithmically or otherwise), these questions cannot fairly be addressed on this appeal, and I say nothing more about them.”¹⁰

And on the relationship between statutory authorization and the common-law duty, the court left the High Court’s holding standing without adopting it: “We received no argument on the significance, if any, of authority being established under the 2009 Regulations for the purposes of the Quincecare duty, and this issue does not arise on this appeal.”¹¹

So the position in the United Kingdom, as of the date of writing, is this. A payment the payer personally instructed is authorized, and the refund route for unauthorized payments under regulation 76 does not open, whatever the deception; Parliament has overlaid a reimbursement requirement for fraud by a separate instrument. Hamblin shows that a delegate’s punctilious compliance with the agreed mechanics can satisfy the statutory authorization machinery while leaving a separate common-law inquiry standing, and that whether the provider owed the principal a duty on that ledger is a different question. Whether that duty exists at all when no human is in the loop, and what a system would have to watch for to discharge it, is expressly open.

The case this paper is about is the next one. A payer signs a standing instruction — an agentic mandate, in the vocabulary of the earlier papers: a signed authority with enforceable fields such as a spending cap and a merchant, and a description of what is to be bought, under which software executes purchases without the payer present — to buy the weekly groceries from the usual supermarket, within a cap. An item is out of stock. The agent substitutes a pack four times the size, at the same merchant, with the same credential, inside the cap. Assume three things, each of which section 2 will examine rather than assert: that the standing instruction constitutes the payer’s consent to a series of payment transactions; that the agreed payment procedure was followed; and that the rail fields — unique identifier, amount, timing — are correct. The consent is real and was not procured by anyone. The delegate is software. And it executed something other than what the payer meant. On those assumptions, and on the current authorities, that payment is authorized and correctly executed as a payment. Logs may exist — the agent’s, the merchant’s, the platform’s — but nothing in the payment machinery requires a record of the grant, the evaluation and the close to be produced and joined to the transaction, and without that record no one can argue otherwise. This paper is about why the machinery produces that result, and why the same result appears in United States consumer-payment law.

2. The machinery, read directly

The tempting version of the argument is that the framework has no rule for an agent that spends inside its limits and outside its instructions. That version is wrong, and it is worth abandoning early, because the accurate account is more useful.

The Payment Services Regulations 2017 have a complete apparatus for allocating loss on an unauthorized payment. It says who must prove what, how long the user has to notify, what the remedy is, and where the loss lands when a control fails. All four parts work. The difficulty is which control they are wired to.

Who must prove what. Regulation 75(1) puts the burden on the payment service provider to prove that the transaction was authenticated and accurately recorded. Regulation 75(3) then refuses to let the record close the question:

“Where a payment service user denies having authorised an executed payment transaction, the use of a payment instrument recorded by the payment service provider, including a payment initiation service provider where appropriate, is not in itself necessarily sufficient to prove either that— (a) the payment transaction was authorised by the payer…”

How long the claim lives. Regulation 74 sets the window, and it sets it in a number:

“A payment service user is entitled to redress under regulation 76, 91, 92, 93 or 94 … only if it notifies the payment service provider without undue delay, and in any event no later than 13 months after the debit date, on becoming aware of any unauthorised or incorrectly executed payment transaction.”

Regulation 74(2) adds a condition that runs the other way: where the provider failed to supply the information Part 6 requires, the user gets redress notwithstanding that it failed to notify in time. Information failure and remedy are already linked in the instrument.

What the remedy is. Regulation 76(1), expressly subject to 74 and 75, keys the refund to the consent test in regulation 67, with no residual category between its two outcomes:

“Subject to regulations 74 and 75, where an executed payment transaction was not authorised in accordance with regulation 67 (consent and withdrawal of consent), the payment service provider must— (a) refund the amount of the unauthorised payment transaction to the payer…”

Where the loss lands. Regulation 77 moves it to whoever failed the control, and follows it along the chain:

“(4) Except where the payer has acted fraudulently, the payer is not liable for any losses incurred in respect of an unauthorised payment transaction— … (c) where regulation 100 (authentication) requires the application of strong customer authentication, but the payer’s payment service provider does not require strong customer authentication”

“(6) Where regulation 100 requires the application of strong customer authentication, but the payee or the payee’s payment service provider does not accept strong customer authentication, the payee or the payee’s payment service provider, or both … must compensate the payer’s payment service provider for the losses incurred…”

Read those four together and the shape is clear. This is not an absence. It is a working loss-allocation regime with a burden rule, a notification window, a remedy and a chain of recourse.

Now read what triggers it.

Regulation 77(4)(c) and 77(6) are both keyed to regulation 100 — to strong customer authentication, performed or not performed, accepted or not accepted. Regulation 75(3) is about “the use of a payment instrument recorded.” The evidential facts the machinery specifies — authentication, accurate recording, use of the instrument, whether strong customer authentication was applied or accepted — concern the credential and its presentation. Regulation 75(3) knows that those facts and consent are different things, which is why it says recorded use is not necessarily sufficient. But none of the specified facts is evidence of the scope of the consent, and nothing in the machinery requires anyone to produce such evidence.

Regulation 67 asks a different question. It asks whether the payer consented to the execution of the payment transaction, or to the execution of a series of which it forms part. That is a question about the scope of the payer’s consent to execution, not about the presentation of a credential. (The common law separately asks about the scope of the delegate’s authority; section 3 keeps the two apart.)

A practitioner reached the same seam from the liability side two months before this paper, and it should be said before the argument is made. Rob Bratby, a London solicitor writing on HM Treasury’s July 2026 consultation, Modernising Payment Services Regulation — the consultation the author’s own response, cited at the end of this paper, answers — states the precondition this paper relies on — the Regulations “do not require every payer to be an individual,” so “An AI system is therefore not required to become the statutory payer before it can initiate an instruction on someone’s behalf”¹² — and then, in a piece stated as the law at 22 July 2026, the constraint: “Authentication and authorisation are not the same question, and the distinction matters for an agent-initiated payment. Regulation 75 does not allocate the separate question of whether the instruction fell within the authority the payer conferred.” His three cases are factual scenarios, and this section’s branches are statutory tracks, but they map. Where the customer set the limits too loosely, “the payment will usually fall inside the consent.” Where an outside party subverts the agent, “the resulting payment may be unauthorised,” depending on how consent was given and what the mandate permitted. And “a model error, where the agent misreads its own instruction, falls between the two and depends on how the delegation was framed.” His conclusion is the one this paper starts from: “The constraint is evidential: a provider has to be able to show, after the event, what the payer delegated, and that depends on how well the consent, the limits and the authentication were recorded at the outset.”¹³ An earlier piece of his put the consent question first and answered it flatly — where “an autonomous agent decides the transaction, the payer has not consented to that specific payment”¹⁴ — and the July analysis is the refinement of that answer into the three cases above. This paper adopts the statutory-payer proposition, treats the flat answer as the first branch of the fork below rather than as a conclusion, and takes his “falls between the two” case as its subject.

What this paper adds is a specification of the record, and it is the one thing in this section that is not already in his. Recording the consent, the limits and the authentication at the outset fixes the grant. A model-error case is decided by comparing the grant to the close — what the agent actually bought, at what price, from whom, and what the evaluation against the grant said at the moment it committed — and nothing recorded at the outset contains the close. The record that makes the regulation 67 question adjudicable has three parts, not one: the grant, the close, and the join between them, produced at execution time by whichever party executed. The rest of this section is about why the machinery asks for none of the three.

So there is a seam inside the regime. The test that decides the case is in regulation 67 and is about the scope of consent. The evidence rules and the triggers that move the loss are about authentication. For a payment where those two things fail together — a stolen instrument, a credential used by somebody else — the seam never opens, because a failure of authentication is also a failure of authority. The regime was built for that case and handles it.

An agent acting on a standing instruction is the case where they come apart. Authentication was performed, correctly, days earlier, by the right person, against a live authority. Regulation 77 allocates loss on a transaction already found unauthorized — 77(1) applies to a provider “liable under regulation 76(1)” — so it does not decide whether this one was; and its two limbs that turn on the credential, 77(4)(c) and 77(6), are not engaged, because nothing about the authentication failed. Regulation 75(3) still says the record is not necessarily sufficient. A payer who says “I consented to a series, but not to this” is already inside that provision: they are denying having authorized this executed transaction, and the recorded use of the instrument is what the provider will offer in reply. But a provider that can show a correctly authenticated standing consent and an execution within its enforceable fields has said everything the machinery knows how to ask about, and the payer is left arguing about scope with no access to the evidence that would settle it.

That is the difficulty, and it is narrower than “no rule exists.” The machinery is sound and it is aimed at a control that is not the one failing.

Regulation 74’s thirteen months is worth holding onto here, because it converts a design preference into a number the instrument supplies. Regulation 74 is a notification and claim window, not a retention rule; it obliges no one to keep anything. But an evidence architecture that is meant to make the regulation 67 question adjudicable throughout that window has to keep the evidence available, or reconstructable, and joinable to the debit, thirteen months out — or regulation 76 cannot be operated on it in the last month of the window as it could in the first. The duty is the architecture’s. The number is the law’s, and any scheme, protocol or evidence service that cannot reach back across it has set its own retention shorter than the claim it exists to serve.

One qualification, which applies to everything in this section that is a number or a burden. Where the payer is not a consumer, a micro-enterprise or a charity, regulation 63(5) lets the provider agree that regulations 75, 77, 79, 80, 83, 91, 92 and 94 “do not apply,” and that “a different time period applies for the purposes of regulation 74(1).” Regulation 76 is not on that list.¹⁵ So for a payer outside the protected classes — consumers, micro-enterprises and charities keep all of them — the burden rule, the fourth door described below and the thirteen-month period may be modified by agreement, and the refund right for an unauthorized transaction may not. Where nothing is agreed, the Regulations apply as written.

Regulation 74 also names a second track in the same sentence. Redress under regulation 76 is the unauthorized track. Redress under regulations 91, 92, 93 or 94 is the other: non-execution, defective execution, late execution. A payments lawyer’s first move, faced with an agent that bought the wrong thing, will be to put the case on that second track. The instrument does not allow it, and the reason is the same shape as the reason the unauthorized track does not open.

Regulation 90(1) is the correctness control:

“Where a payment order is executed in accordance with the unique identifier, the payment order is deemed to have been correctly executed by each payment service provider involved in executing the payment order with respect to the payee specified by the unique identifier.”¹⁶

Lord Leggatt had already pointed at that provision. The sentence after the passage quoted in section 1 identifies the obstacle: regulation 90(1) deems a payment order executed in accordance with the unique identifier to have been correctly executed.¹⁷ Regulation 91 then makes the payer’s provider liable to the payer for “the correct execution of the payment transaction” unless it can prove that the payee’s provider received the amount.¹⁸ “Correct execution,” in this instrument, is a rail question. It asks whether the amount reached the account specified by the unique identifier, and when. It does not ask whether the goods were the goods, or whether the close was inside the description the payer gave the agent.

So there is a fork, and it should be stated as a fork rather than resolved.

The unauthorized track. Where a standing instruction to an agent constitutes the payer’s consent to a series under regulation 67(1)(b), and this close falls outside that consent, the case is on the unauthorized track. Regulation 76 is the remedy. The evidence that would settle it is the grant, the close, and a join between them. The point of this section stands: the authentication machinery does not produce that evidence.

The incorrect-execution track. Where the payment order was not executed in accordance with the unique identifier, or was defective or late in the sense regulations 91 to 94 use those words, the case is on the incorrect-execution track. The controls are already specified: for the identity of the payee, regulation 90(1) supplies the unique identifier; regulations 91 to 94 govern the remaining execution questions of receipt, amount and timing. None asks whether what was bought remained within the description in the mandate. A substitution that still hits the named payee with the named amount, on time, is not this case.

The case Part 7 does not reach. Where the payment is authorized under regulation 67 and deemed correctly executed under regulation 90(1) — same unique identifier, same amount, on time — but the close is outside the description of what the payer instructed the agent to do, Part 7 does not open. The remaining question is construction of the mandate, and whatever duty Philipp leaves standing when it describes a bank’s obligation “to interpret, ascertain and act in accordance with its customer’s instructions.”¹⁹ That is the case this paper is about.

There is one more door in Part 7, and it should be named, because it is the only one keyed to the scope of a consent rather than to a credential or a rail field. Regulation 79 entitles a payer to a refund of “any authorised payment transaction initiated by or through the payee” where “the authorisation did not specify the exact amount of the payment transaction when the authorisation was given in accordance with regulation 67” and “the amount of the payment transaction exceeded the amount that the payer could reasonably have expected taking into account the payer’s previous spending pattern, the conditions of the framework contract and the circumstances of the case.”²⁰ It is a narrow door. Regulation 79(3) separately gives an unconditional refund for euro direct debits under Regulation (EU) 260/2012; that is a direct-debit rule and is set aside here. Under 79(1)–(2) the door sees one field, amount. The request must be made within eight weeks of the debit; the provider may require the payer to prove the conditions; and the right can be contracted out of where the payer gave consent directly to the provider and the transaction information was made available four weeks ahead.²¹ For a payee-initiated agentic payment whose amount ran past what the payer could reasonably have expected, this is the track a payments lawyer would try first, and it may work. For the substitution this paper describes — same payee, same amount, wrong goods — it does not open, for the same reason as the other two: the field it checks is intact.

The thirteen-month window in regulation 74 sets the horizon for the first two branches: evidence meant to operate regulation 76 or regulations 91 to 94 has to remain available and joinable to the transaction for as long as the claim can be brought. The third branch is not a regulation 74 claim. The record it needs is a record with which a court could construe the grant. Nothing in Part 7 requires anyone to keep it.

Three things this section does not claim. It does not claim that a standing instruction to an agent is, as a matter of law, consent to a series under regulation 67(1)(b). Whether it is depends on the instruction and on facts a court would find. The first branch holds in the conditional: where such an instruction constitutes the payer’s consent to a series, the scope question is the one that decides the case, and the evidence to answer it is what is missing. It does not claim that a pack-size substitution, or any other semantic miss that leaves the rail fields intact, is “incorrectly executed” within the meaning of regulations 91 to 94. That reading is the one regulation 90(1) is there to prevent. And it does not claim that any of this is a defect in the drafting. Authentication is a good proxy for consent, and the unique identifier a good proxy for the payee, for as long as authentication, consent and execution stay close enough together for one to stand in for another. Delegated execution against a description separates them. The proxies are what have come apart, not the law.

3. Two ledgers

Hamblin says something about that seam that the Regulations do not say about themselves: that there are two ledgers, and that they can give different answers on the same payment.

On the statutory ledger, the question is whether the payer gave consent “in the form, and in accordance with the procedure, agreed” with the provider.²² The High Court called that requirement “purely mechanical,” and held that where the mechanics were “punctiliously observed” the statutory refund claim fails.²³ That is the reading the Court of Appeal left in place.²⁴ It is also, on its face, the right reading of a provision whose purpose the judge described as “transactional speed and efficiency”: a rule built so that providers “execute payment instructions swiftly and in accordance with clear criteria” cannot also be a rule that asks, at the moment of execution, whether the instruction meant what the principal meant.

On the common-law ledger, the question is whether the person giving the instruction had the principal’s authority to give it — and the Supreme Court in Philipp was explicit that authority is not the same thing as the credential. “Authority to act as agent includes only authority to act honestly in pursuit of the interests of the principal.”²⁵ The authority a customer confers on an agent to give payment instructions “does not include authority to act dishonestly in pursuit of the agent’s own interests and in fraud of the customer.”²⁶ A bank may rely on the appearance of authority — but “not if there are circumstances suggestive of dishonesty apparent to the bank which would cause a reasonable banker before executing an instruction to make inquiries to verify the agent’s authority.”²⁷ The duty that follows, in Lord Leggatt’s summary, “is simply an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions.”²⁸

Two ledgers, then. One asks whether the agreed procedure was followed. The other asks whether the instruction was the principal’s. A payment can pass the first and fail the second; Hamblin in the High Court is a case in which it did. The Court of Appeal was asked nothing about how the two relate and said so.

One point of vocabulary, so that a name does not do more work than the cases allow. The duty the cases call Quincecare is the fraud-shaped instance of the general duty Lord Leggatt describes at [97]: to interpret, ascertain and act in accordance with the customer’s instructions. For a delegate that has not been dishonest, the common-law ledger is that general duty and ordinary construction of the mandate. This paper calls it the construction ledger. The Quincecare cases are cited below for what they say about authority and attribution, not as a remedy for drift.

The common law is not going to rescue the payer in the case this paper is about, and section 3 does not ask it to; the honest limit is stated at the end of this section. What the authorities supply is three structural propositions about authority and attribution, and each creates a question when the delegate is software. Those questions are why the record matters to the common-law ledger as much as to the statutory one.

The trust that makes the instruction look authorized is the same fact that stops the delegate’s excess being the principal’s own act. Singularis is the case. Daiwa paid away a company’s money on the instructions of its chairman and sole shareholder, who was defrauding it. Daiwa’s defense was that the chairman’s fraud was the company’s fraud, so the company could not complain. The Supreme Court refused that attribution, and the reason it gave is the reason that matters here:

“The purpose of that duty is to protect the company against just the sort of misappropriation of its funds as took place here. By definition, this is done by a trusted agent of the company who is authorised to withdraw its money from the account. To attribute the fraud of that person to the company would be, as the judge put it, to ‘denude the duty of any value in cases where it is most needed’.”²⁹

The structure of that reasoning is what carries. The duty exists because the delegate is trusted; the trust is what makes the instruction look authorized; and the same trust cannot then be used to make the delegate’s departure from the grant the principal’s own act. For an agentic mandate the predicate is sharper still. The credential and the signed mandate are precisely what make the software a trusted delegate. If that trust is why the statutory ledger treats the close as authorized, Singularis says the same trust cannot, in a claim that the provider should have inquired, make the miss the principal’s fraud. Both answers at once. That is not a contradiction. It is the predicate on which the protective duty rests.

The same actor can bind and not bind, depending on who is asking. Bilta is the case, and its holding is a method rather than a result. Attribution of an agent’s conduct to the company “depends very much on the context in which the issue arises”: as between the company and a defrauded third party, the company is treated as the perpetrator; in a claim between the company and the directors who defrauded it, the directors cannot rely on their own breach to defeat provisions “intended to protect the company.”³⁰ Lord Neuberger put the general principle in a sentence: whether “to attribute an action by, or a state of mind of, a company director or agent to the company or the agent’s principal in relation to a particular claim against the company or the principal must depend on the nature and factual context of the claim in question.”³¹ Applied to a payment: as against the merchant and the scheme, the principal who held the agent out and signed the mandate may well be treated as having paid. As against a provider who should have stepped up, the principal may still be the party the agent exceeded. Both can be true. What makes them compatible in practice is a record — of the grant, the evaluation, and the miss — that lets a court ask Bilta’s question instead of collapsing both answers into “the credential moved.” Put the grocery substitution through it. As against the supermarket, which was paid the mandated amount under a live credential, the payer may well be treated as the buyer of the larger pack. As against the provider, if a duty of inquiry ever reached an automated close, the payer may be the principal whose delegate exceeded the description. Both answers are available in principle; on the current record neither can be proved, because nothing required the grant and the miss to be written down together.

Attribution is construction of the rule, not a search for a mind. The method behind all of this is Lord Hoffmann’s in Meridian, quoted in Bilta by Lord Sumption:

“This is always a matter of interpretation: given that it was intended to apply to a company, how was it intended to apply? Whose act (or knowledge, or state of mind) was for this purpose intended to count as the act etc. of the company? One finds the answer to this question by applying the usual canons of interpretation, taking into account the language of the rule (if it is a statute) and its content and policy.”³²

Meridian assumes the candidate whose act or knowledge might count is a natural person. Two consequences follow, neither of which is a holding. First, rules of authority still work: a principal can deploy software under a delegated technical authority, and apparent authority is a representation plus reliance, not a state of mind of the delegate; a signed mandate and an agent credential are ordinary facts on that ledger. Whether the software is itself an agent in law, or the operator’s instrument, can stay open, exactly as section 4 leaves it open for Regulation E. Second, any rule that turns on knowledge, notice, inquiry, or a state of mind becomes difficult to apply when no human observes the instruction, because the court needs an observable fact capable of being attributed to the provider. A court applying Meridian to a software delegate has to say either that the rule was not intended to reach this architecture, or that some human’s or system’s output is to count as that state of mind for this purpose. The second is a special rule, and it has to be built from the rule’s own policy — which requires something to build it from. When is a provider “put on inquiry” about an instruction no person saw? When there is a fact a reasonable provider would have seen, and that fact can be attributed to the provider. The common law can find such a fact in circumstances as well as in signals. But if the architecture produces no signal and surfaces no circumstance, there is nothing for the rule to attach to. Meridian supplies the method of attribution; it does not supply the signal, and without a signal the method has nothing to work on. That is the cleanest company-law reason to require the record now, rather than wait for the next Hamblin to discover that there is nothing to interpret.

The honest limit, stated rather than buried. The duty the courts have been describing is triggered by an attempt to defraud or misappropriate. Philipp defines actual authority as authority “to act honestly in pursuit of the interests of the principal,” and the inquiry it describes is into “circumstances suggestive of dishonesty.”³³ An agent that substitutes a four-times-larger pack because the item is out of stock is not defrauding anyone. It is executing badly, or outside the description. If the dishonesty trigger holds, a semantic miss without fraud never engages the duty, and the principal’s common-law claim is at most ordinary skill and care in reading the mandate — a much weaker claim — or nothing, because Philipp also says that where a bank “receives a valid payment order which is clear and leaves no room for interpretation or choice,” its “duty is simply to execute the order.”³⁴ That limit cuts deeper for a sending provider than for a bank at a branch counter. The description the agent departed from was given to the agent, or to the platform that runs it; the payment order the sending provider receives is clear, and the provider may never have seen the description at all. Whatever duty to construe the mandate survives runs, if it runs anywhere, against the party that received the description — and in the architectures the protocols describe that party is not necessarily a payment service provider. Bratby makes the same point from the other side: “Neither regime allocates loss to the supplier of the agent,” and neither “creates a liability rule that bites on a person merely because it supplied the software.”³⁵ Whether any regulator’s power reaches that party is a question about instruments rather than about Part 7, and it is not answered here. Nothing here proposes the Quincecare duty as the answer to agentic drift. What the two ledgers show is narrower. The unauthorized track and the incorrect-execution track each have a control — the credential, the unique identifier — and neither control produces a record of the grant and the close. The common-law inquiry would need that record too. The case that remains, once both statutory tracks are satisfied, is the one Part 7 does not reach; and the common-law inquiry, if it ever reached an automated close, would need the same record the statutory tracks do not produce. Section 6 says what follows from that, once.

4. The United States: the same shape

Paper 4 set out the United States position in one passage and this paper does not repeat it.³⁶ Regulation E relies on a proxy of the same shape as the UK machinery: where the Regulations put authentication in place of the scope of consent, Regulation E puts the furnishing of an access device in place of the scope of the authority given with it. The short form is that Regulation E excludes from “unauthorized electronic fund transfer” a transfer initiated by a person who was furnished the access device by the consumer, unless the consumer has notified the institution that transfers by that person are no longer authorized; that the official interpretation says a consumer who grants transfer authority to a person “who exceeds the authority given” is “fully liable for the transfers” until such notice; that Regulation Z says the same of credit cards and sends the prior question of whether authority existed to state law; and that the Bureau’s 2021 FAQs, a Compliance Aid rather than an official interpretation, read “furnished” not to include credentials obtained by fraud or later theft, and say nothing about a delegate who exceeds a grant.³⁷

What this paper adds is the Meridian consequence, stated for that law. A court applying Regulation E to a software delegate must decide whether the delegate is a “person … furnished the access device,” whether an agent credential is an “access device,” and whether a capped natural-language mandate is the grant of authority Comment 2(m)-2 describes. The definitions cut both ways and settle nothing. “Person” means “a natural person or an organization,”³⁸ so the operator of an agent is plainly one; whether the agent is a person, or the operator’s instrument, the rule does not say. An “access device” is “a card, code, or other means of access to a consumer’s account … that may be used by the consumer to initiate electronic fund transfers”;³⁹ an agent credential may constitute a code or other means of access, and if it does, it is one the consumer never uses directly. None of those questions is answered in Supplement I. The court would have to hold either that the exclusion does not reach this architecture, or construct from the exclusion’s policy an account of what counts as the consumer’s grant and what counts as exceeding it. And it would face the same vacuum: the exclusion’s only operative event is the consumer’s notice that the delegation has ended. There is no event in the rule for a narrowing, a single-transaction correction, or an amendment with a link to what it replaced. In the case the rule recognizes, the control it supplies is termination.

Three sources, the same shape: each supplies an express revocation, and none supplies an express narrow amendment. Regulation 67(4) in the United Kingdom permits withdrawal of consent to a series prospectively; a UK bank’s published guidance for a live variable recurring payment says an active permission cannot be amended and must be revoked and set up again;⁴⁰ Regulation E’s exclusion ends when the consumer says the delegation has ended. None of the three forbids amendment. None provides for it, and none records what the payer agreed to when execution diverged. How an operative definition should treat amendment of a live grant is not resolved here.

5. The overlay

Section 1 recorded what Parliament did about Philipp. What the regulator then did with the duty section 72 created is the last door to check, because it is the only United Kingdom instrument that reimburses a payment the Regulations call authorized. Specific Direction 20, given under section 54 of the Financial Services (Banking Reform) Act 2013 to discharge the duty in section 72 of the 2023 Act, states its obligation in one sentence — “When a victim reports a reimbursable FPS APP scam payment to their sending PSP, the sending PSP must reimburse the victim in full” (¶3.1) — and points elsewhere for its content — the requirement applies “in line with the exceptions and additional provisions set out at paragraphs 4.2 to 5.23 of Specific Requirement 1” (¶3.3), and Specific Requirement 1 obliges Pay.UK to “insert and not alter” that requirement in the Faster Payments rulebook.⁴¹ The direction has no expiry.⁴² Specific Requirement 1 defines authorization in regulation 67’s own words — the payer “has given their explicit consent to: the execution of the payment transaction, or the execution of a series of payment transactions of which that payment transaction forms part”⁴³ — and reimburses anyway. So a liability has already been placed on a payment the Regulations call authorized, by an instrument outside Part 7.

Its definition of the eligible case is also why it does not reach the case in this paper. An APP scam is “where a person uses a fraudulent or dishonest act or course of conduct to manipulate, deceive or persuade a consumer into transferring funds from the consumer’s relevant account to a relevant account not controlled by the consumer, where: the recipient is not who the consumer intended to pay, or the payment is not for the purpose the consumer intended.”⁴⁴ The purpose limb looks, on a skim, as if it might reach a substitution. It cannot on its own: the mismatch has to be the product of fraud or dishonesty, and the funds have to reach an account the consumer does not control. An agent that paid the intended merchant the intended amount for the wrong goods fails the definition at its first clause, and the regulator’s own policy statement treats a dispute with a legitimate supplier as a civil dispute outside the scheme.⁴⁵ That is the nearest UK instrument to the case this paper describes, and it refuses the case by definition. It is the fourth door, and it is shut for the same reason as the other three: the field it checks — here, fraud or dishonesty operating on the consumer — is intact.

6. The finding, and what it hands on

Four doors were opened above and none of them reaches the case. Regulation 76 is keyed to consent under regulation 67, and on the assumptions stated in section 1 the consent is real. Regulations 91 to 94 are keyed to the unique identifier, the amount and the timing, and all three are intact. Regulation 79 is keyed to amount alone. Specific Direction 20 is keyed to fraud or dishonesty operating on the consumer, and there was none. Each door checks a field, and every field it checks is as the payer left it. What moved is the thing no door checks: whether the close was inside the description the payer gave the agent.

The finding is therefore narrow, and it is about evidence rather than remedy. Two questions are left, and they are different. Whether any party — the sending provider, the platform, the agent’s operator — owes the payer a duty to construe the mandate is a question of obligation, and no record creates an obligation that does not exist. Whether a breach of such a duty could be established, if one exists, is a question of evidence, and on the current record it could not be, against anyone. The record that would make the regulation 67 question adjudicable has three parts: the grant, the close, and the join between them, produced at execution time by whichever party executed. Nothing in Part 7, nothing in the common-law ledger as the courts have so far described it, and nothing in Regulation E requires any party to produce or keep it. That is what this paper establishes, and it is all it establishes.

The obligation half of that finding has since been stated by the industry, and it should be recorded here rather than left to the reader to find. UK Finance’s response to the Bank of England’s consultation on the design of future retail-payments infrastructure, published on 11 September 2026, names the case in terms: “Where a PSP correctly executes an apparently valid agent-generated instruction, but the agent has exceeded the end user’s intended authority, responsibility should be determined through a clear legal and regulatory liability framework and should not automatically transfer to the executing PSP solely because it has processed a technically valid instruction.” Its list of the scenarios such a framework must address ends with this paper’s: “where an agent acts within the technical parameters of a mandate but outside the end user’s intended authority or reasonable expectations.”⁴⁶ That is a call for an allocation rule, and it sits one step downstream of the finding above. An allocation rule needs a breach to allocate, and on the present record a breach could not be shown against anyone. What the trade body proposes should travel with a payment is instructive on exactly that point. It asks that the message “include a reference to a verifiable mandate, to verify that the third-party acted within its permitted payment parameters, limits and restrictions,” and “data required for traceability and audit”; it places the creation and storage of mandates, and “documented rationale for a third-party’s reasoning,” outside the core infrastructure; and, read in full, it proposes no duty on any party to keep either.⁴⁷ The reference travels. The grant, the close and the join between them do not, and nobody is obliged to keep them. The industry’s own proposal, in other words, carries the pointer and leaves the record where this paper found it — which is the same passage that says technical validation “should not, by itself, determine whether a transaction is legally authorised,” and is right to say so, since a pointer to a mandate is not a record of what was done under it.

What kind of instrument could require anything of anyone, and what such an instrument would need from a definition kept elsewhere so that a duty measured against it could be examined, are questions about instruments rather than about Part 7. They are not answered here.

7. Limits

I am not a lawyer, and nothing above is legal advice.

The standing-instruction case is argued in the conditional. Whether an instruction to an agent is consent to a series under regulation 67(1)(b), whether a software agent is a “person” for the purposes of Regulation E, whether an agent credential is an access device, and whether a capped mandate is the grant Comment 2(m)-2 describes, are all undecided, and each determines whether any of this reaches the liability layer in its jurisdiction at all.

The incorrect-execution track is the other statutory exit. Whether a close that hits the unique identifier and the amount can ever be “defective” under regulations 91 to 94 is a question regulation 90(1) appears to close. This paper does not reopen it. Regulation 79 is the one Part 7 provision keyed to the scope of a consent rather than to a credential or a rail field; it is keyed to amount alone, and the case described here leaves the amount intact. For a payer outside the protected classes, regulation 63(5) lets the burden rule, the amount door and the notification period be modified by agreement; this paper’s numbers are the protected-class numbers. The case it describes is the one in which all three doors are satisfied and Part 7 does not open.

The common-law duty described in section 3 is triggered by dishonesty. A pack-size substitution may never engage it. The Court of Appeal has expressly reserved whether the duty applies to automated processing at all, and what monitoring would discharge it; this paper cites that reservation as a reservation and not as a holding in either direction. Whether the general duty of construction is owed by a sending provider that received only a clear payment order, rather than by the platform or operator that received the description, is a question Philipp at [63] bears on and this paper does not decide.

What was left out: the trust-law tail of the Hamblin litigation — who owns money in a mule company’s wallet, and who may sue in the company’s name — which concerns victims of fraud vehicles and does not reach the payer whose agent bought the wrong thing; every figure about disputes, chargebacks and first-party misuse that has been suggested to me and that I have not opened at its source; and any characterization of what a court would hold.

Endnotes

Statutes and directions quoted

Payment Services Regulations 2017 (SI 2017/752), regs. 63, 67, 74, 75, 76, 77, 79, 80, 83, 90, 91, 92, 93, 94 and 100 — https://www.legislation.gov.uk/uksi/2017/752/contents (regs. 90 and 91 opened 19 September 2026; regs. 63, 79 and 80 opened 20 September 2026; the others as read for the author’s response to HM Treasury, 13 September 2026). Financial Services and Markets Act 2023, ss. 72 and 86. Payment Systems Regulator, Specific Direction 20 (July 2024) and Specific Requirement 1 (July 2024, corrected); PS25/5 (May 2025). NatWest, “How do I amend a VRP (variable recurring payment) or sweeping payment?”, read 13 September 2026, cited as one institution’s description of its own product.