An authorised electronic money institution (EMI) issues electronic money: a prepaid balance, held for the customer and redeemable at face value, that the customer spends through a wallet, card or account. Once authorised by the Financial Conduct Authority (FCA), an EMI must keep meeting its authorisation conditions under the Electronic Money Regulations 2011 (the EMRs), together with the Payment Services Regulations 2017 (the PSRs) for its payment services and the FCA rules that apply to its status.
A small electronic money institution (small EMI) is registered rather than authorised. It works under a lighter regime with limits on outstanding e-money, but it still safeguards customer funds, meets the anti-money laundering rules and files returns.
The bar rose in 2026. The FCA's CASS 15 safeguarding rules have applied since 7 May 2026, adding a monthly safeguarding return and an annual safeguarding audit. The FCA estimates that EMIs safeguarded around £26 billion in 2024, up from £11 billion in 2021, and keeping customers' money safe is one of its four priorities for payment and e-money firms this year.
In March 2026 the FCA published its first annual Regulatory Priorities report for payments and e-money, replacing more than 40 portfolio letters. It is addressed to boards and chief executives and sets four priorities.
| Priority | What it means for an EMI |
|---|---|
| Preparing for the future | Keep pace with regulatory change, including stablecoins, open banking and AI-driven payments |
| Consumer Duty | Fix gaps promptly, with focus on international payment pricing and vulnerable customers |
| Financial system integrity | Governance, financial crime and operational resilience controls, and readiness for incident and third-party reporting |
| Keeping customers' money safe | CASS 15 safeguarding, financial resilience and wind-down planning |
The FCA has said it will act against firms that consistently fall short of its standards, using requirements such as restrictions on higher-risk activity and independent skilled person reviews.
Compliance should be mapped to the actual products and flow of funds. A simple prepaid card and a multi-currency wallet with cards, transfers and merchant services carry very different obligations.
| Area | Main source | What it requires |
|---|---|---|
| Issuance, redemption, capital | EMRs 2011 | Authorisation conditions, redemption at par, €350,000 initial capital, own funds |
| Payment services and conduct | PSRs 2017 | Information, consent, execution, liability and security rules |
| Safeguarding | EMRs regulation 20, CASS 15, CASS 10A | Segregation, reconciliations, records, resolution pack |
| Safeguarding audit | SUP 3A | Annual external audit above £100,000 safeguarded |
| Regulatory returns | SUP 16 | FIN060, fraud, operational risk and monthly safeguarding returns |
| Consumer outcomes | Consumer Duty (PRIN 2A) | Good outcomes for retail customers, annual board report |
| Financial crime | Money Laundering Regulations 2017 | Risk-based anti-money laundering, sanctions and fraud controls |
| Operational resilience | SYSC 15A | Important business services, impact tolerances, testing |
| Complaints | DISP | Payment and e-money deadlines, Financial Ombudsman Service access |
The FCA's Payment Services and Electronic Money Approach Document, updated alongside the safeguarding rules on 7 May 2026, sets out how the FCA interprets the EMRs and PSRs and is the first reference for any interpretation question.
E-money is issued when the EMI receives funds, and the EMI must issue it at par value: £100 received creates £100 of e-money. Every event that creates, moves or extinguishes an e-money balance, such as wallet funding, card loads, refunds, chargebacks and transfers between customers, has an accounting and safeguarding effect and should be recorded consistently in the ledger.
Terms must match how the product actually works. Compliance monitoring should test live redemption cases, including dormant accounts and closed accounts, not only the wording of the terms. Delays in returning balances are a frequent source of complaints and Consumer Duty concern.
An EMI safeguards the funds it receives in exchange for e-money under regulation 20 of the EMRs and CASS 15. It does so either by segregating them in a designated safeguarding account at a bank (or investing them in secure, liquid assets) or by covering them with an insurance policy or bank guarantee. Small EMIs safeguard e-money funds in the same way; a small EMI providing payment services unrelated to e-money may choose whether to safeguard those funds.
Complex models need particular care. E-money balances, pending payments, card settlement and unrelated payment services must each be counted once, without omission or double counting. Our guide to internal and external safeguarding reconciliations sets out the calculation in detail, and Safeheld, the firm's own safeguarding platform, is built to run these reconciliations and the monthly return for e-money firms.
CASS 15 requires due skill, care and diligence in choosing and reviewing each bank, custodian or insurer that holds or protects relevant funds: its financial strength, regulatory status, reputation and the legal protection it gives. Due diligence is refreshed periodically and whenever circumstances change, and each account needs an acknowledgement letter confirming it holds customer funds. Concentration on a single safeguarding bank should be understood and justified, and a second bank considered as the EMI grows.
Every EMI, authorised or small, submits the REP027 safeguarding return through the FCA's reporting system within 15 business days of the end of each calendar month, under SUP 16.14A. The figures should come from the same ledger, reconciliations and methodology used to run the business, with any difference resolved before submission. In a group, each data item should have an owner and an approval step, and any manual adjustment a recorded reason.
EMIs appoint an external auditor to report to the FCA each year on their safeguarding. The auditor gives reasonable assurance on whether the systems were adequate throughout the period and whether the EMI complied at the period end, and lists individual breaches.
| Point | Rule |
|---|---|
| Exemption | Not required to safeguard more than £100,000 at any time in at least 53 weeks |
| Period covered | Ends no more than 53 weeks after the previous period |
| First report due | Within 6 months of the end of the first audit period |
| Later reports due | Within 4 months of each period end |
Evidence should be kept year-round so the auditor can review it without reconstruction: reconciliations, break investigations, due diligence files, account documents, the resolution pack, the breach log and board papers. The FCA has said it expects a short-term rise in adverse audit opinions as the new rules bed in, so findings should be fixed at root cause, retested and, where required, notified to the FCA.
An authorised EMI must hold initial capital of at least €350,000, held by the firm and not paid to the FCA. After authorisation it must hold own funds at all times at or above the higher of that initial capital and its calculated requirement.
| Business line | Own funds method | Calculation |
|---|---|---|
| Issuing e-money and related payment services | Method D | 2% of average outstanding e-money |
| Payment services unrelated to e-money | Method A, B or C, as the FCA directs | Overheads, payment volume or income |
| Small EMI with average outstanding e-money of €500,000 or more | Method D | 2% of average outstanding e-money |
Average outstanding e-money is the average of the total e-money in issue at the end of each calendar day over the preceding six months. A firm without enough history uses the projections in its business plan.
An EMI with an average of £30 million of e-money outstanding (roughly €34.5 million at €1.15 to the pound) has a Method D requirement of 2%, about €690,000. That is higher than its €350,000 initial capital, so €690,000 is its requirement, plus any Method A, B or C amount for unrelated payment services. Each business line should be modelled; the requirement rises with growth.
The FCA looks at capital, liquidity, risk management and wind-down planning together, and its good and poor practice findings noted that some firms' wind-down plans and risk frameworks are underdeveloped. The plan should explain how the EMI would stop issuing e-money, keep redemption and essential payments running, return balances and meet its obligations during an orderly exit, with the staff, banking and technology that requires and the cost of running until the end. The decision to start a wind-down should be taken while the firm still has the cash and people to carry it out, so triggers should be agreed by the board in advance.
EMIs authorised under the EMRs are not under the senior managers and certification regime (SM&CR), which applies to firms with permissions under the Financial Services and Markets Act 2000 (FSMA). An EMI that also holds FSMA permissions, such as consumer credit, follows SM&CR for that business. The FCA assesses directors and managers of an EMI through the EMD Individual form, and they must remain of good repute and suitably experienced.
The FCA still expects clear ownership. Senior individuals should own safeguarding, financial crime, risk, compliance, finance and operational resilience, with the authority and resources to do so, and board minutes should show challenge and action. HM Treasury's July 2026 consultation asked whether enhanced senior manager accountability should be introduced at payment and e-money firms, so this area is likely to develop.
EMIs are supervised under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (the MLRs) and need a risk-based framework: a business-wide risk assessment, customer due diligence, enhanced due diligence, sanctions screening, transaction monitoring and suspicious activity reporting through the money laundering reporting officer (MLRO).
Freezing or closing accounts protects customers and the firm, but restrictions that are slow, opaque or left open too long create complaints and Consumer Duty concerns even where the underlying concern was valid. The framework should set who may restrict an account, what may be said to the customer within the tipping-off rules, how cases are reviewed and how long they may stay open. When closing a payment account under a framework contract, the firm gives at least 90 days' notice and an explanation, subject to limited exceptions such as financial crime concerns. Our guide to financial crime controls for payment and e-money firms covers monitoring in detail.
The Consumer Duty applies to e-money and payment services provided to retail customers. Wallets, prepaid cards and accounts raise particular questions on fees, exchange rates, restrictions, support and vulnerable customers. The FCA's 2026 priorities single out the transparency of international payment pricing and the treatment of customers in vulnerable circumstances.
Outcome monitoring should use operational data: rejected withdrawals, freezes and how long they last, complaints, call waiting times, fraud cases, dormancy fees and outcomes for vulnerable customers. The annual board assessment should show what was learned and what changed. Our article on implementing the Consumer Duty in e-money and payment firms sets out the evidence the FCA expects.
EMIs that provide payment services follow the PSRs' conduct rules. Each payment function, whether card payments, bank transfers or direct debits, should be mapped to the rules on information, consent, execution and liability.
| Rule | PSRs reference | What it requires |
|---|---|---|
| Execution time | Regulation 86 | Funds reach the payee's provider by the end of the next business day for sterling and euro payments in the UK |
| Unauthorised payments | Regulation 76 | Refund by the end of the business day after the firm becomes aware, unless fraud is suspected |
| Customer liability | Regulation 77 | Capped at £35 for lost or stolen instruments, unless the customer acted fraudulently or with gross negligence |
Strong customer authentication (two independent checks, such as a device and a fingerprint) should be built into product design, with exemptions used only where their conditions are met and fraud rates monitored. The Government has committed to replacing the technical standards with outcomes-based FCA rules, but the current standards apply until then.
EMIs depend on core ledgers, card processors, sponsor banks, cloud providers, identity verification vendors and payment schemes. Under SYSC 15A, in force in full since 31 March 2025, the EMI identifies its important business services, sets impact tolerances (the maximum disruption it will accept), maps the dependencies behind them and tests severe but plausible scenarios. Planning should centre on what the customer experiences, such as access to funds and the ability to pay, not only on IT recovery times.
Under FCA PS26/2, published on 18 March 2026, new operational incident reporting and material third-party reporting apply from 18 March 2027. Authorised EMIs are named in the third-party regime: they notify the FCA of new or significantly changed material third-party arrangements and submit an annual register.
The EMI remains responsible for every regulated activity it outsources, whether to a technology provider, card programme manager, processor, distributor or group company. The FCA looks for an EMI that controls its programme, not a licence lent to a business run by an unregulated partner. Contracts should define roles, give audit, data and regulator access, require incident notification and provide for exit, and the EMI must be able to intervene. Oversight should measure outcomes, such as complaints, reconciliation differences, fraud and service issues, not only system uptime.
EMIs use two kinds of intermediary, and each is classified and registered correctly. Agents provide payment services on the EMI's behalf and must be registered with the FCA. Distributors distribute or redeem e-money, for example by selling prepaid cards in shops, but cannot issue it, and the EMI remains responsible for what they do.
EMI reporting is broader than safeguarding. Outstanding e-money and capital should be calculated the same way in the finance ledger and in every return. Our guide to FCA regulatory reporting for payment and e-money firms covers each return.
| Return | Applies to | Timing |
|---|---|---|
| REP027 safeguarding return | Authorised and small EMIs | Monthly, within 15 business days |
| FIN060 EMI and small EMI questionnaire | Authorised and small EMIs | Annually, within 30 business days of the accounting reference date |
| FSA065 e-money outstanding at 31 December | Small EMIs | Annually, within one month |
| REP017 payment fraud report | Authorised EMIs (small EMIs annually) | Half-yearly, within 2 months of each period end |
| REP018 operational and security risk report | All payment service providers | At least once a calendar year |
| Payment services and e-money complaints return | EMIs | Under DISP 1.10B; new rules from 1 January 2027 |
Event-driven notifications are separate from scheduled returns. Changes to controllers, important outsourcing, directors and managers, the business model or anything affecting the authorisation conditions need FCA engagement, in some cases before the change takes effect.
EMIs handle complaints under the FCA's dispute resolution rules (DISP). For payment services and e-money complaints, the final response is due within 15 business days, or up to 35 business days in exceptional circumstances with a holding reply, and eligible customers can refer the complaint to the Financial Ombudsman Service. New complaints reporting rules (PS25/19) apply from 1 January 2027, with the first reporting period running from 1 January to 30 June 2027. Complaint data should be read with fraud, restriction and Consumer Duty data to find root causes.
| Point | Authorised EMI | Small EMI |
|---|---|---|
| Limit on outstanding e-money | None | Average of €5 million |
| Initial capital | €350,000 | 2% of average outstanding e-money once it reaches €500,000 |
| Safeguarding of e-money funds | Mandatory, CASS 15 | Mandatory, CASS 15 |
| Safeguarding audit | Annual, above £100,000 | Annual, above £100,000 |
| Annual returns | FIN060 | FIN060 and FSA065 |
A small EMI that expects to exceed its limits should prepare for authorisation well ahead of reaching them, because moving to an authorised EMI is a new application.
Many EMIs are assessing stablecoin and tokenised payment products. The boundary matters: a fiat-backed token issued by a UK firm may be e-money, a cryptoasset or both, and the permissions needed follow from that analysis. The FCA's new cryptoasset regime under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 opened its application window on 30 September 2026, running to 28 February 2027, and commences on 25 October 2027. Until then the existing cryptoasset registration under the MLRs applies.
HM Treasury's July 2026 consultation proposed bringing UK-issued qualifying stablecoins used for payments within the payments regime and asked whether stablecoin safeguarding should eventually sit there rather than in the cryptoasset rules. An EMI planning a stablecoin product should map it against both regimes before launch.
| Activity | Frequency | Owner |
|---|---|---|
| Safeguarding reconciliations | Each reconciliation day | Finance and operations |
| Own funds and average outstanding e-money | Monthly | Finance lead |
| REP027 safeguarding return | Monthly | Safeguarding director |
| Fraud return | Half-yearly | Fraud lead |
| FIN060 return | Annually | Finance lead |
| Safeguarding audit | Annually, unless exempt | Safeguarding director |
| MLRO report and risk assessment review | Annually | MLRO |
| Consumer Duty board report | Annually | Board |
| Resilience testing and wind-down plan review | Annually | Board |
A risk-based monitoring plan tests issuance and redemption, safeguarding, capital, Consumer Duty, payment conduct, financial crime, complaints, agents and distributors, outsourcing, resilience and reporting, with frequency rising when products or risks change.
Recurring manual adjustments, alerts or complaints point to a control design issue even when each case is closed, and should be fixed at source.
Supervisory reviews of e-money firms concentrate on a handful of areas, and the evidence requested is predictable. An EMI that can produce the following on request is well placed:
An EMI that also runs a business unrelated to e-money or payments, such as a retailer or software company issuing its own prepaid product, must keep e-money funds and records separate from the rest of the business, and the FCA can require the e-money activity to be carried on in a separate legal entity where the other activities could affect its financial soundness or supervision.
The firm supports authorised and small EMIs across the full compliance programme: CASS 15 safeguarding and audit readiness, reconciliations, capital and own funds, regulatory returns, financial crime, Consumer Duty evidence, outsourcing and programme manager oversight, resilience and wind-down planning. It also manages new FCA EMI applications; details are on our UK EMI licence page.
Principally the Electronic Money Regulations 2011, with the Payment Services Regulations 2017 for payment services. CASS 15, SUP 3A, SUP 16, the Consumer Duty, DISP, SYSC 15A and the Money Laundering Regulations 2017 also apply.
€350,000 of initial capital. Own funds must then stay at or above the higher of that amount and 2% of average outstanding e-money under Method D, plus any Method A, B or C amount for unrelated payment services.
Yes. Since 7 May 2026, authorised and small EMIs reconcile at least once each reconciliation day, file a monthly REP027 return within 15 business days and, above £100,000 safeguarded, obtain an annual safeguarding audit.
No. The EMRs prohibit paying interest or any benefit linked to the time a customer holds e-money. The customer can redeem at par value at any time.
No. EMIs authorised under the EMRs are outside the senior managers and certification regime unless they also hold FSMA permissions. Directors and managers are assessed through the EMD Individual form.
Yes, where they are provided to retail customers. Firms assess the target market, price and value, understanding and support, and monitor real outcomes such as restrictions, fees and redemption times.
Both share the payment conduct, safeguarding, financial crime and Consumer Duty requirements. EMIs also meet the EMR rules on issuance, redemption and interest, hold €350,000 initial capital and calculate own funds under Method D.
Buckingham Capital Consulting has obtained FCA electronic money institution licences for firms including Dzing Finance, Hryze, HFS and EuroPanPay since 2013. It supports e-money institutions after authorisation with CASS 15 safeguarding, capital, regulatory returns, financial crime controls and Consumer Duty evidence.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.