diff --git a/proxies/live/apiproxy/policies/RaiseFault.403NoPointers.xml b/proxies/live/apiproxy/policies/RaiseFault.403NoPointers.xml
new file mode 100644
index 0000000..43b28b8
--- /dev/null
+++ b/proxies/live/apiproxy/policies/RaiseFault.403NoPointers.xml
@@ -0,0 +1,28 @@
+<RaiseFault async="false" continueOnError="false" enabled="true" name="RaiseFault.403NoPointers">
+    <FaultResponse>
+        <Set>
+        <Payload contentType="application/json"> {
+            "resourceType": "OperationOutcome",
+            "issue": [
+                {
+                "severity": "error",
+                "code": "403",
+                "details": {
+                    "coding": [
+                    {
+                        "code": "403",
+                        "display": "Forbidden"
+                    }
+                    ]
+                },
+                "diagnostics": "Provided ODS code has no pointers within requesting app"
+                }
+            ]
+        }</Payload>
+            <StatusCode>403</StatusCode>
+            <ReasonPhrase>Forbidden</ReasonPhrase>
+        </Set>
+    </FaultResponse>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+    <DisplayName>RaiseFault.403NoPointers</DisplayName>
+</RaiseFault>
\ No newline at end of file
diff --git a/proxies/live/apiproxy/resources/jsc/ConnectionMetadata.SetRequestHeaders.js b/proxies/live/apiproxy/resources/jsc/ConnectionMetadata.SetRequestHeaders.js
index c83b704..91a0293 100644
--- a/proxies/live/apiproxy/resources/jsc/ConnectionMetadata.SetRequestHeaders.js
+++ b/proxies/live/apiproxy/resources/jsc/ConnectionMetadata.SetRequestHeaders.js
@@ -24,14 +24,14 @@
     // Read the 'NHSD-End-User-Organisation-ODS' header
     var odsCode = context.getVariable('request.header.NHSD-End-User-Organisation-ODS');
     if (!odsCode || odsCode.trim().length === 0) {
-        context.setVariable("badRequest", true);
+        //This will trigger RaiseFault.400BadRequest.xml - see proxies/deafult.xml in the DefaultFaultRules
         return;
     }
 
     // Read the associated `nrl-ods-<ods_code>` custom attribute from the APIGEE app
     var nrlPointerTypes = context.getVariable('app.nrl-ods-' + odsCode);
     if (!nrlPointerTypes) {
-        context.setVariable("badRequest", true);
+        //This will trigger RaiseFault.403NoPointers.xml - see targets/target.xml
         return;
     }
 
diff --git a/proxies/live/apiproxy/targets/target.xml b/proxies/live/apiproxy/targets/target.xml
index 62c3343..8379daf 100644
--- a/proxies/live/apiproxy/targets/target.xml
+++ b/proxies/live/apiproxy/targets/target.xml
@@ -16,6 +16,10 @@
       <Step>
           <Name>Javascript.AddConnectionMetadataHeader</Name>
       </Step>
+      <Step>
+          <Condition>request.header.NHSD-Connection-Metadata = null</Condition>
+          <Name>RaiseFault.403NoPointers</Name>
+      </Step>
     </Request>
   </PreFlow>
   <FaultRules>
diff --git a/proxies/sandbox/apiproxy/policies/RaiseFault.403NoPointers.xml b/proxies/sandbox/apiproxy/policies/RaiseFault.403NoPointers.xml
new file mode 100644
index 0000000..43b28b8
--- /dev/null
+++ b/proxies/sandbox/apiproxy/policies/RaiseFault.403NoPointers.xml
@@ -0,0 +1,28 @@
+<RaiseFault async="false" continueOnError="false" enabled="true" name="RaiseFault.403NoPointers">
+    <FaultResponse>
+        <Set>
+        <Payload contentType="application/json"> {
+            "resourceType": "OperationOutcome",
+            "issue": [
+                {
+                "severity": "error",
+                "code": "403",
+                "details": {
+                    "coding": [
+                    {
+                        "code": "403",
+                        "display": "Forbidden"
+                    }
+                    ]
+                },
+                "diagnostics": "Provided ODS code has no pointers within requesting app"
+                }
+            ]
+        }</Payload>
+            <StatusCode>403</StatusCode>
+            <ReasonPhrase>Forbidden</ReasonPhrase>
+        </Set>
+    </FaultResponse>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+    <DisplayName>RaiseFault.403NoPointers</DisplayName>
+</RaiseFault>
\ No newline at end of file
diff --git a/proxies/sandbox/apiproxy/resources/jsc/ConnectionMetadata.SetRequestHeaders.js b/proxies/sandbox/apiproxy/resources/jsc/ConnectionMetadata.SetRequestHeaders.js
index e4d8843..310852c 100644
--- a/proxies/sandbox/apiproxy/resources/jsc/ConnectionMetadata.SetRequestHeaders.js
+++ b/proxies/sandbox/apiproxy/resources/jsc/ConnectionMetadata.SetRequestHeaders.js
@@ -38,13 +38,13 @@ const nrlPointers = {
     "request.header.NHSD-End-User-Organisation-ODS"
   );
   if (!odsCode || odsCode.trim().length === 0) {
-    context.setVariable("badRequest", true);
+    //This will trigger RaiseFault.400BadRequest.xml - see proxies/deafult.xml in the DefaultFaultRules
     return;
   }
 
   var nrlPointerTypes = nrlPointers[odsCode];
   if (!nrlPointerTypes) {
-    context.setVariable("badRequest", true);
+     //This will trigger RaiseFault.403NoPointers.xml - see targets/target.xml
     return;
   }
 
diff --git a/proxies/sandbox/apiproxy/targets/sandbox.xml b/proxies/sandbox/apiproxy/targets/sandbox.xml
index 0c339fe..2b2920e 100644
--- a/proxies/sandbox/apiproxy/targets/sandbox.xml
+++ b/proxies/sandbox/apiproxy/targets/sandbox.xml
@@ -26,6 +26,10 @@
           <Step>
               <Name>Javascript.AddConnectionMetadataHeader</Name>
           </Step>
+          <Step>
+              <Condition>request.header.NHSD-Connection-Metadata = null</Condition>
+              <Name>RaiseFault.403NoPointers</Name>
+          </Step>
         </Request>
         <!-- <Response>
           <Step>