On this page
Real-time payments and mandatory fraud reimbursement have turned outsourcing from a cost decision into a supervisory one. Here is how fintechs on both sides of the Atlantic are restructuring their Philippine operations in response.
The short answer: In 2026, US and UK fintechs outsource customer support, fraud response, and dispute handling to the Philippines because regulators now judge these functions by execution evidence, not policy documents. The providers winning that business can prove, case by case, that the right action was taken inside the regulatory clock.
Why outsourcing became a regulatory question
In the UK, an independent review published by the Payment Systems Regulator in July 2026 found firms now reimburse 97 percent of in-scope authorized push payment (APP) scam claims, and that mandatory reimbursement has cut losses by an estimated £73 million a year. Since October 2024, sending and receiving firms have split that liability, and the clock to reimburse runs in business days.
In the US, instant payments have reached scale. FedNow passed 1,800 live banks and credit unions in July 2026, and The Clearing House’s RTP network processed 142 million transactions worth $576 billion in the second quarter alone. Once a payment settles in seconds, a missed fraud call or a mishandled dispute becomes a loss the firm owns.
Both markets have concluded the same thing: the moment a customer reaches a human is where harm is prevented or crystallized. If that human sits in Manila or Cebu, the regulator’s expectations travel with the work.
Figure 1. Mandatory reimbursement in the UK and instant-payment scale in the US have moved fraud and dispute handling into the regulator’s line of sight. Sources: PSR/Frontier Economics, July 2026; Federal Reserve Financial Services.
“When an examiner asks for the case file, they do not care whether the agent sat in London or Manila. They care whether the timestamps hold up,” said John Maczynski, CEO of PITON-Global, a BPO advisory firm specializing in the fintech sector. “That is the standard we tell every fintech to hire against.”
What UK fintechs are being asked to prove
The FCA has told payment-firm CEOs that a customer falling victim to a scam can constitute foreseeable harm under the Consumer Duty. Add mandatory reimbursement, and the outsourced fraud desk becomes a liability control.
The bigger change is visibility. On July 13, 2026, the UK’s Critical Third Parties regime became operational with the designation of AWS, Google Cloud, Microsoft, and Oracle. From March 18, 2027, in-scope firms must file an annual register of every material third-party arrangement, outsourced or not, with the FCA, PRA, and Bank of England.
A BPO handling disputes, KYC remediation, or fraud triage will be on that register. Boards now ask whether the partner maps to the firm’s important business services, stays within impact tolerances, and reports incidents on the regulator’s timetable.
What has changed for US fintechs
The US shift is less about one rule than about where supervision sits. The CFPB has proposed raising the thresholds that bring nonbank fintechs under direct supervision, states such as New York have written their own rules, and the OCC, FDIC, and Federal Reserve have pushed oversight of fintech partners onto sponsor banks.
That makes an offshore BPO a “fourth party.” The sponsor bank must be able to see through the fintech into the vendor: who touched the account, when, and on what authority. Regulation E dispute windows and a $10 million FedNow transaction limit leave no room for a handoff that cannot be reconstructed.
Table 1. What regulators now expect from an outsourced fintech operation
| Expectation | United Kingdom | United States | What it means for the BPO |
| Fraud-loss liability | Mandatory APP reimbursement since October 2024; 97% of in-scope claims now reimbursed | Regulation E error resolution; sponsor banks liable for fintech programs | The fraud desk is a liability control, staffed and measured as one |
| Third-party visibility | Material third-party register from March 18, 2027; Critical Third Parties regime live since July 2026 | Interagency third-party guidance; banks accountable for their fintech partners’ vendors | Provider must supply register-grade data: subcontractors, concentration, exit plans |
| Customer outcomes | Consumer Duty foreseeable-harm standard | UDAAP enforcement; state rules filling federal gaps | Vulnerable-customer handling and complaint outcomes are auditable |
| Speed of resolution | Five business days to reimburse in-scope APP claims | Ten business days to investigate a Regulation E dispute or issue provisional credit | 24/7 coverage on both countries’ regulatory calendars |
How Philippine fintech BPO has adapted
The Philippine IT-BPM industry closed 2025 at $40.3 billion in export revenue and 1.89 million full-time employees, holding 17 percent of global industry headcount and the top position in customer-experience delivery, according to industry body IBPAP, and AI pressure is pushing serious providers up the value chain.
Three changes stand out. Fraud and dispute teams run on US and UK regulatory calendars, with 24/7 coverage. Every interaction is logged at the transaction level, with timestamps, classifications, and actions exportable for an examiner or the Financial Ombudsman. And AI handles triage and drafting while a trained specialist owns the decision and its documentation.
“The question US and UK fintechs ask us is no longer ‘what does a seat cost in Manila,’” Maczynski said. “It is ‘can this provider produce the evidence my regulator will ask for, on the day they ask for it.’ That is a different vendor, priced differently.”
Three questions to ask before signing
Can the provider map to your regulatory obligations? Not “PCI DSS certified,” but which important business services this team supports and what happens to your impact tolerance if it goes down.
Can it produce transaction-level evidence on demand? Ask for a sample case file from intake to closure and check its timestamps against the five-business-day APP reimbursement window or the ten-business-day Regulation E window.
How is AI governed in the loop? Which decisions can the model take alone, which require a human, and how are overrides recorded?
Table 2. Weak versus strong answers in vendor diligence
| Question | Weak answer | Strong answer |
| Can you map to our regulatory obligations? | “We are PCI DSS and ISO 27001 certified.” | “Here is how this team maps to your important business services and impact tolerances, and our incident-notification SLA.” |
| Can you produce transaction-level evidence? | “We record all calls.” | “Here is a sample case file: intake timestamp, classification, actions taken, closure, exportable within 24 hours.” |
| How is AI governed in the loop? | “Our AI assistant improves handle time.” | “These decisions are model-only, these require a human, and every override is logged with a reason code.” |
“Cheap capacity is easy to find. Defensible execution is not,” Maczynski said. “A provider that cannot explain, in writing, how a fraud flag moved from an algorithm to a human to a customer is a liability you have offshored, not a cost you have saved.”
Independent advisors increasingly run this diligence, because vendor decks rarely answer these questions and a wrong choice now costs a regulatory finding.
Cost still matters, but it comes second
Labor savings from the Philippines remain substantial and are why the conversation starts. In 2026, they are no longer why it closes. Firms scaling successfully treat the Philippine operation as part of their control environment, keep risk ownership in-house, and outsource execution to partners built for the evidence standard both regulators enforce.
Key takeaways
- UK mandatory APP reimbursement, the Consumer Duty, and the 2027 third-party register put outsourced fraud and dispute functions in the regulator’s line of sight.
- In the US, sponsor-bank oversight and instant-payment scale mean a BPO must be auditable through the fintech to the bank.
- Philippine providers that compete on transaction-level evidence and governed AI, not seat price, are winning US and UK fintech mandates.
FAQ
Is outsourcing fraud and dispute handling to the Philippines permitted under UK rules? Yes. UK rules allow outsourcing but hold the regulated firm accountable for outcomes; material arrangements must be notified and, from 2027, reported annually.
What should a US fintech’s sponsor bank be able to see in its BPO? Case-level logs of who acted, when, and under what authority, plus incident reporting that reaches the bank on its timetable.
What is the biggest mistake fintechs make when selecting a Philippine BPO? Selecting on hourly rate and certifications instead of testing whether the provider can produce regulator-ready evidence for a live case.
