Navigating the Public Authorities (Fraud, Error and Recovery) Act 2025: key implications and challenges for deposit takers

The Public Authorities (Fraud, Error and Recovery) Bill was introduced to UK Parliament on 22 January 2025. It received Royal Assent on 2 December 2025 and became the Public Authorities (Fraud, Error and Recovery) Act 2025 (the Act). The Act intends to safeguard public money by reducing public sector fraud, error and debt. To do so, the Act includes powers to better identify, prevent and deter public sector fraud and error and enable the better recovery of money owed to the taxpayer where public money has been stolen or overpaid.

It introduces new powers to the Public Sector Fraud Authority (“PSFA”), within the Cabinet Office, to investigate public sector fraud (outside of tax and social security) and to the Department for Work and Pensions’ (“DWP”) to tackle fraud and error in the social security system.

Some of these new powers will impact authorised deposit takers i.e., banks and building societies as the Act creates several compliance requirements for these institutions to help the authorities to counter public sector fraud. 

Information requirements

Part 1 of the Act provides the PSFA civil information gathering and information sharing powers that will enable the PSFA to compel information holders to provide information as part of a fraud investigation and lawfully share it. Section 19 sets out requirement for banks to provide information to the PSFA. These include ‘account information notices’ which would impose a requirement on banks and building societies to provide account statements, and ‘general information notices’ which impose a requirement to provide details of every account that a liable person holds with the bank or building society. 

The financial institution must comply with the requirements set out in the notices including the timeline within which the information needs to be provided. This section also sets out that financial institutions may be subject to a penalty under section 54 for non-compliance without reasonable excuse. There are also restrictions set out for banks from 'tipping off' the account holder (the liable person) by notifying them of these notices. 

Recovery powers

PSFA also has powers to recover fraud-related debt directly from individuals’ earnings or bank accounts. Section 17 sets out details on 'Direct deduction orders' that the PSFA can issue against the liable person. Section 26 introduces restrictions on accounts to maintain the balance required for deduction orders, with provisions to prevent closure or transactions that would reduce the balance below specified amounts. This imposes obligations on banks including ensuring that the account in question is not closed. For lump sum direct deduction orders, the bank must also ensure that the amount in the account does not fall below the specified amount. 

Data examination requirements

Part 2 of the Act gives the DWP powers to address fraud and error in the benefits system and recover overpayment debt. These include ‘eligibility verification’ powers to allow the DWP to require banks and other financial institutions to examine their data to help identify benefit fraud and allowing the DWP to recover debts from individuals not on benefits or in PAYE employment by direct deductions from their bank accounts without having to go to court. The specific obligations for financial institutions are detailed in Schedules 3 and 5 of the Act, and any failure to comply with these requirements may result in liability for penalties.

Next steps and considerations for deposit takers

The PSFA and DWP will also introduce new Codes of Practice on these measures, which will inform the rules which the Government, third parties and industry must follow when the powers come into force.

It is anticipated that the Government will begin implementing the Act’s measures from 2026 (see here).

Here are some of the steps that banks and building societies should consider taking in the run up to the implementation of the measures under the Act:

• Enhanced due diligence: the need to strengthen processes for identifying and freezing suspicious payments, particularly those originating from public authorities, to mitigate the risk of inadvertently facilitating the retention or dispersal of recoverable funds.
• Operational and systems changes: the need to update systems to enable rapid identification and segregation of funds that may be subject to recovery under the Act, and to respond promptly to recovery requests from public authorities, including the ability to trace, freeze, and return funds as required. Firms may also need to assess any necessary changes to their controls and processes to provide adequate support to vulnerable customers and other customers affected by severe financial hardship arising from direct deduction orders.  
• Record keeping: maintain detailed records of transactions involving public authority payments, including the origin, destination, and any subsequent movement of funds, to facilitate compliance with recovery actions.
• Staff training: relevant staff should be trained to recognise and appropriately handle recovery requests, including understanding the legal basis for such requests under the Act.
• Reviewing customer agreements and existing policies: the need to review and, if necessary, update customer terms and conditions to ensure they can lawfully freeze or return funds in response to recovery requests, and to notify customers of such actions. Firms may also want to review existing policies and procedures relating to erroneous or fraudulent payments from public authorities.

Banks and building societies should monitor progress including the Government’s implementation of the measures under the Act and any guidance and Codes of Practice issued by regulators or industry bodies.