Authorisation is the start of supervision, not the end of the project. An authorised payment institution (API) must keep meeting the conditions it was authorised on, every day, under the Payment Services Regulations 2017 (the PSRs) and the FCA rules that apply to its status and services. A small payment institution (SPI) works under a lighter registration regime but must still meet the rules for the services it provides.
Three changes define 2026. The FCA's supplementary safeguarding rules in CASS 15 have applied since 7 May 2026, bringing a monthly safeguarding return and an annual safeguarding audit. The FCA's first annual Regulatory Priorities report for payments, published in March 2026, replaced more than 40 portfolio letters and sets four priorities for boards. And HM Treasury's consultation on modernising payment services regulation closed on 6 October 2026, opening the way for the detailed rules to move into the FCA Handbook.
The FCA's four priorities for payment firms in 2026 are:
Compliance mapping starts with the PSRs and the FCA's Payment Services and Electronic Money Approach Document, which was updated alongside the safeguarding rules on 7 May 2026. Not every Handbook sourcebook applies to a payment institution as it would to an investment firm, so each obligation should be traced to its legal source.
| Area | Main source | What it requires |
|---|---|---|
| Authorisation conditions and conduct | PSRs 2017 | Governance, controls, capital, safeguarding, information and execution rules |
| Safeguarding | PSRs regulation 23, CASS 15, CASS 10A | Segregation, reconciliations, records, resolution pack |
| Safeguarding audit | SUP 3A | Annual external audit above £100,000 safeguarded |
| Regulatory returns | SUP 16 | Capital, fraud, operational risk and monthly safeguarding returns |
| Consumer outcomes | Consumer Duty (PRIN 2A) | Good outcomes for retail customers, annual board report |
| Financial crime | Money Laundering Regulations 2017 | Risk-based anti-money laundering, sanctions and fraud controls |
| Operational resilience | SYSC 15A | Important business services, impact tolerances, testing |
| Complaints | DISP | Payment services deadlines and Financial Ombudsman Service access |
| Authentication and security | PSRs and FCA technical standards | Strong customer authentication and incident reporting |
Most of this guide applies to both authorised and small payment institutions, but the prudential and safeguarding obligations differ. A small payment institution that grows towards the €3 million monthly average must apply for authorisation within 30 days of becoming aware it no longer meets the conditions, so its compliance programme should be built with the authorised regime in view.
| Obligation | Authorised payment institution | Small payment institution |
|---|---|---|
| Initial capital and own funds | Required | Not required |
| Safeguarding under CASS 15 | Mandatory where it holds customer funds | Optional; full rules apply once elected |
| Safeguarding audit | Annual, above £100,000 | Only if it safeguards and is above the threshold |
| Fraud return (REP017) | Half-yearly | Two half-year reports, filed annually |
| Transactions report | Capital adequacy return (FSA056) | FSA057, by the end of January |
| Financial crime, Consumer Duty, complaints | Apply in full | Apply in full |
Safeguarding protects customers if a payment firm becomes insolvent, and it is the FCA's fourth priority for 2026. The FCA estimates that payment institutions safeguarded around £6 billion a day in 2024. An API that receives funds for payment transactions must comply with regulation 23 of the PSRs and CASS 15; an SPI may elect to safeguard and then follows the same rules.
The board approves the safeguarding policy and the choice of safeguarding banks and auditor, and receives regular management information: the safeguarding requirement against funds held, reconciliation breaks and how long they took to clear, unidentified receipts, and any breach. Material breaches are notified to the FCA promptly, and a small payment institution that starts or stops safeguarding notifies the FCA using the SUP 15 form.
A reconciliation should establish independently what the firm owes customers and compare it with what is held in safeguarding. Any shortfall is investigated, corrected and documented, never adjusted manually to force agreement. Recurring breaks and their root causes go to the board. Safeheld, the firm's own safeguarding platform, is built to run these reconciliations and prepare the monthly return for payment and e-money firms.
Our article on what payment firms must be doing now that CASS 15 is in force sets out the operating model in detail.
Every safeguarding institution submits the REP027 safeguarding return through the FCA's reporting system within 15 business days of the end of each calendar month, under SUP 16.14A. A firm does not file for the month in which it first becomes a safeguarding institution. Each data item should be traceable to the same records used for daily reconciliations, with an owner, a documented derivation and review before submission.
Authorised payment institutions that hold customer funds appoint an external auditor to report to the FCA each year on their safeguarding. The audit is a reasonable assurance engagement: the auditor reports on whether the firm's systems were adequate throughout the period and whether it complied at the period end, and lists individual breaches.
| Point | Rule |
|---|---|
| Who must be audited | APIs holding relevant funds and all EMIs, unless exempt |
| Exemption | Not required to safeguard more than £100,000 at any time in at least 53 weeks |
| Period covered | Ends no more than 53 weeks after the previous period |
| First report due | Within 6 months of the end of the first audit period |
| Later reports due | Within 4 months of each period end |
The safeguarding audit is separate from the statutory accounts audit, although the same firm can carry out both. Senior management must check on a continuing basis whether an exempt firm has moved above the threshold. The FCA said in its 2026 priorities that it expects a short-term rise in adverse audit opinions as the new rules bed in, so findings should be tracked, remediated and retested.
An API must hold own funds at all times at or above the higher of its initial capital (€20,000, €50,000 or €125,000 depending on its services) and the requirement calculated under Method A, B or C of Schedule 3 to the PSRs. The FCA can direct an amount up to 20% higher or lower. Firms that provide only payment initiation or account information services hold their initial capital only.
The FCA expects more than a capital formula. Its good and poor practice findings on risk management and wind-down planning, and its 2026 priorities, note that some firms have underdeveloped risk frameworks and wind-down plans. Boards should know which events could make the firm unviable, how much capital and cash it would need to keep operating or to close in an orderly way, and which early warning indicators trigger action.
Payment institutions are not under the senior managers and certification regime (SM&CR), which applies to firms with permissions under the Financial Services and Markets Act 2000 (FSMA). A payment institution that also holds FSMA permissions, such as consumer credit, follows SM&CR for that business. The FCA assesses the directors and managers of a payment institution through the PSD Individual form, and they must remain of good repute and suitably experienced.
The absence of SM&CR does not reduce what the FCA expects. Clear individual ownership of compliance, safeguarding, financial crime, risk and operations should be written down, and board minutes and management information should show real oversight, challenge and follow-through. HM Treasury's July 2026 consultation asked whether enhanced senior manager accountability should be introduced at payment and e-money firms, so firms should expect this area to develop.
Payment institutions sit in the movement of funds, so they face money laundering, fraud, sanctions evasion and money mule risk. The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (the MLRs) apply in full, and protecting the integrity of the financial system is the FCA's third priority for 2026. The FCA also reports that payment firm applications it did not approve most often showed gaps in senior manager competence and in systems and controls, including financial crime controls.
Fraud and anti-money laundering overlap in payments: an account that receives the proceeds of authorised push payment (APP) fraud becomes a money laundering concern as soon as the funds move on. Fraud and financial crime teams should share intelligence, and onboarding data, device data, linked beneficiaries and transaction velocity should feed mule detection. Firms that send Faster Payments reimburse APP fraud victims under the mandatory scheme in force since 7 October 2024, up to £85,000 per claim, with the cost shared between the sending and receiving firms. The law also allows a firm to delay an outbound payment by up to 72 hours where it has reasonable grounds to suspect APP fraud.
Our guide to payment institution financial crime controls covers transaction monitoring in depth.
The Consumer Duty applies to payment services provided to retail customers. It requires good outcomes in four areas: products and services, price and value, consumer understanding and consumer support. The FCA's 2026 priorities focus on two Duty topics for payment firms: transparency of international payment pricing and the treatment of customers in vulnerable circumstances.
Cross-border firms earn through explicit fees and through the margin within the exchange rate. The FCA's good and poor practice findings on international payment cost communication look at whether customers understand the total cost, not only whether fees appear somewhere in the terms. Reviews should cover how rates are presented, which reference rate is used for comparison and whether claims such as "zero fee" are accurate when revenue sits within the rate.
Outcomes are affected by fees, exchange rates, rejected payments, fraud handling, account restrictions, complaints and support. Monitoring should use operational data, and the annual board assessment should show differences in outcomes by customer group, product or channel, and the action taken. Business customers outside the Duty are still covered by the PSRs' information and contract requirements. Our article on implementing the Consumer Duty in payment and e-money firms explains the evidence the FCA expects.
The PSRs contain detailed conduct rules: information before and after a payment, consent, execution times, value dating, charges, refunds and liability for unauthorised and incorrectly executed payments. These should be mapped to the real customer journey so that each screen, notification and process can be traced to the rule it meets.
| Rule | PSRs reference | What it requires |
|---|---|---|
| Execution time | Regulation 86 | Funds reach the payee's provider by the end of the next business day for sterling and euro payments in the UK |
| Unauthorised payments | Regulation 76 | Refund by the end of the business day after the firm becomes aware, unless fraud is suspected |
| Customer liability | Regulation 77 | Capped at £35 for lost or stolen instruments, unless the customer acted fraudulently or with gross negligence |
| Notification by the customer | Regulation 74 | Within 13 months of the debit date for unauthorised or incorrect payments |
Under the framework contract rules, a firm closing a payment account must give the customer at least 90 days' notice and explain the reason, subject to limited exceptions such as financial crime concerns. Account restrictions and closures are a frequent source of complaints, so the decision process and the customer communication should both be documented.
Strong customer authentication (two independent checks, such as a device and a fingerprint) applies to electronic payments and account access. Firms should understand when it applies and when an exemption, such as transaction risk analysis, is available, and use an exemption only where its conditions are met. The Government has committed to revoking the technical standards in the PSRs so the FCA can set outcomes-based authentication rules, but the current rules apply until they change.
Payment services depend on banks, processors, card platforms, cloud providers and identity verification vendors. The FCA's operational resilience rules in SYSC 15A have applied in full since 31 March 2025: firms identify their important business services, set impact tolerances (the maximum disruption they will accept), map the people, processes and suppliers behind each service, and test severe but plausible scenarios.
The FCA's PS26/2, published on 18 March 2026, introduces single operational incident reporting and material third-party reporting from 18 March 2027. Payment service providers fall within the incident regime, and authorised payment institutions within the third-party regime: they notify the FCA of new or significantly changed material third-party arrangements and submit an annual register. Until then, the existing PSRs duty to report major operational or security incidents continues, and 2026 is the year to map processes and data for the new regime.
Outsourcing an important operational function does not transfer responsibility. Due diligence, contracts, oversight and exit plans should match the dependency, sub-outsourcing and concentration on one provider should be mapped, and contracts should give the firm, its auditors and the FCA access. A material change to an important outsourcing arrangement must be notified to the FCA in advance.
Payment institutions handle complaints under the FCA's dispute resolution rules (DISP). For payment services complaints, the firm sends a final response within 15 business days, or up to 35 business days in exceptional circumstances with a holding reply, and eligible complainants can refer the complaint to the Financial Ombudsman Service. The FCA reports that complaints to the Ombudsman about payment firms fell by 9% between 2024 and 2025.
Complaints are regulatory intelligence. Root-cause analysis should test whether one complaint reveals a process affecting many customers, and complaint data should be read alongside incident, fraud and Consumer Duty information. New FCA complaints reporting rules (PS25/19, published on 3 December 2025) apply from 1 January 2027, with the first reporting period running from 1 January to 30 June 2027.
A payment institution can provide services through agents registered with the FCA, and remains responsible for everything they do. Each agent needs due diligence on ownership, management, competence and financial crime risk before it is registered, and can act only within its registered scope.
The FCA uses regulatory data to target supervision, so late, inaccurate or repeatedly corrected returns draw attention. A regulatory obligations register should record every return, its owner, its source data and its internal review. Our guide to FCA regulatory reporting for payment and e-money firms covers each return in detail.
| Return | Applies to | Timing |
|---|---|---|
| REP027 safeguarding return | Safeguarding institutions | Monthly, within 15 business days |
| REP017 payment fraud report | APIs | Half-yearly, within 2 months of each period end |
| REP018 operational and security risk report | All payment service providers | At least annually |
| FSA056 capital adequacy return | APIs | Annually |
| Annual financial return | APIs and SPIs | Annually |
| FSA057 payment transactions report | SPIs | Annually, by the end of January |
| Payment services complaints return | Payment service providers | Under DISP 1.10B |
Event-driven notifications matter as much as scheduled returns: major incidents, safeguarding breaches, material changes to the business or to important outsourcing, and anything that could affect the authorisation conditions should be escalated and notified promptly.
| Activity | Frequency | Owner |
|---|---|---|
| Safeguarding reconciliations | Each reconciliation day | Finance and operations |
| Own funds and liquidity monitoring | Monthly, and continuously | Finance lead |
| Safeguarding return | Monthly | Safeguarding director |
| Board compliance and risk reporting | Quarterly | Compliance officer |
| Fraud return | Half-yearly | Fraud lead |
| Safeguarding audit | Annually, unless exempt | Safeguarding director |
| MLRO annual report and risk assessment review | Annually | MLRO |
| Consumer Duty board report | Annually | Board |
| Operational resilience self-assessment and testing | Annually | Operations lead |
| Wind-down plan review | Annually | Board |
An annual policy review does not show whether controls work. A monitoring programme should test the areas that matter most at a frequency matched to the risk: safeguarding, financial crime, Consumer Duty, payment conduct, complaints, agents, outsourcing, resilience, reporting and capital.
Firms that are growing should also test whether their permissions still match the business. Adding a service or a new type of payment flow may need a variation of permission before launch.
Supervisory reviews of payment firms concentrate on a small number of areas, and the evidence the FCA asks for is predictable. A firm that can produce it on request is in a strong position.
Where the FCA has concerns it uses a graduated set of tools: written feedback with remediation expectations, information requests, requirements such as restrictions on onboarding higher-risk customers, and reviews by an independent skilled person at the firm's cost. Early, open engagement and a credible remediation plan, owned by a named director and tracked to completion, keep matters within normal supervision.
HM Treasury consulted from 14 July to 6 October 2026 on modernising payment services regulation. It proposes moving detailed technical requirements from the PSRs and the Electronic Money Regulations into FCA rules, restructuring the list of payment activities, bringing UK-issued stablecoins used for payments into the payments regime, and asking how authentication and liability should work for payments made by AI agents. The changes will be made through secondary legislation, with implementation details to follow the consultation.
The Payment Systems Regulator's functions are also being consolidated into the FCA, ahead of legislation where possible. Until the new framework is in place, the current PSRs and FCA rules apply in full, and compliance teams should keep proposals separate from live obligations in their regulatory change log.
The firm supports authorised and small payment institutions across the full compliance programme: CASS 15 safeguarding and audit readiness, regulatory returns, financial crime frameworks, Consumer Duty evidence, operational resilience, governance and board reporting, agents and outsourcing. It also supports remediation after FCA engagement or audit findings, and advises when growth needs a variation of permission. Details are on our regulatory compliance page and our safeguarding page.
The Payment Services Regulations 2017 are the core framework, supported by the FCA's Approach Document and the Handbook rules that apply to payment firms: CASS 15, SUP 3A, SUP 16, the Consumer Duty, DISP and SYSC 15A. The Money Laundering Regulations 2017 apply to financial crime.
The CASS 15 safeguarding rules came into force. Firms now reconcile at least once each reconciliation day, file a monthly REP027 safeguarding return and, above £100,000 safeguarded, obtain an annual safeguarding audit.
Yes, where an authorised payment institution holds customer funds. A firm is exempt if it has not been required to safeguard more than £100,000 at any time in at least 53 weeks; the first report is due within 6 months of the period end and later reports within 4 months.
No. The senior managers and certification regime applies to firms with FSMA permissions, not to payment institutions authorised under the PSRs. A payment institution that also holds FSMA permissions follows SM&CR for that business.
Yes, to payment services provided to retail customers. The FCA's 2026 focus for payment firms is the transparency of international payment pricing and the treatment of vulnerable customers.
Own funds at all times at or above the higher of its initial capital (€20,000, €50,000 or €125,000 depending on services) and the amount calculated under Method A, B or C. The FCA can adjust the result by up to 20%.
Continuously, through a risk-based monitoring programme, with annual reviews of the financial crime risk assessment, Consumer Duty outcomes, operational resilience and the wind-down plan. Testing should increase when products, volumes, agents or risks change.
From 18 March 2027, under FCA PS26/2. Authorised payment institutions will notify material third-party arrangements and submit an annual register, alongside the new operational incident reports.
Buckingham Capital Consulting has obtained FCA payment institution licences for firms including Nexpay, Orbital, Oval and Global Send since 2013. It supports payment institutions after authorisation with CASS 15 safeguarding, regulatory reporting, financial crime controls and Consumer Duty evidence.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.