In March 2026 the Financial Conduct Authority (FCA) published its Regulatory Priorities report for payments, the first of a new series of annual sector reports. It applies to every firm authorised or registered under the Payment Services Regulations 2017 (the PSRs) or the Electronic Money Regulations 2011 (the EMRs): authorised and small payment institutions (PIs), authorised and small electronic money institutions (EMIs) and registered account information service providers. It replaces more than 40 portfolio letters and is addressed to boards and chief executives.
The report sets four priorities. Each one connects to the others: weak governance usually shows up at the same time in safeguarding, financial crime, Consumer Duty monitoring and resilience, so boards get the best result by treating them as one programme.
| FCA priority | What the FCA expects | What boards should be able to show |
|---|---|---|
| 1. Preparing for the future | Keep pace with regulatory change and invest where needed; prepare thoroughly for authorisation | A regulatory change plan covering payments reform, open banking, stablecoins and AI |
| 2. Consumer Duty | Assess products continuously and fix gaps immediately | Outcome data, especially on international payment pricing and vulnerable customers |
| 3. Financial system integrity | Effective governance, financial crime and fraud controls, operational resilience | Controls that scale with volumes, and readiness for incident and third-party reporting |
| 4. Keeping customers' money safe | Comply with the safeguarding regime in force since 7 May 2026; sound financial resilience | Reliable reconciliations, audit results and a credible wind-down plan |
The annual report is a forward-looking signal of how the FCA will assess firms over the year. Supervision is increasingly data-led: regulatory returns, monthly safeguarding returns, safeguarding audit findings, complaints, financial crime intelligence and incident notifications are combined to identify the firms that need attention.
Where standards are not met, the FCA uses a graduated set of tools, which the report describes:
Boards should benchmark the firm against the priorities themselves and close material gaps before the FCA asks. A firm that has identified its own weaknesses and is fixing them under a named owner is in a very different position from one whose weaknesses are found by an audit or an information request.
The FCA's report and its safeguarding work give a clear picture of the scale of the sector and why its priorities fall where they do.
| Measure | Figure | Source |
|---|---|---|
| Customer funds safeguarded by EMIs | About £26 billion in 2024, up from £11 billion in 2021 | FCA payments priorities, March 2026 |
| Customer funds safeguarded by PIs | An estimated £6 billion a day in 2024 | FCA payments priorities, March 2026 |
| Open banking users | More than 16 million people and businesses in 2025, over 29 million payments a month | FCA payments priorities, March 2026 |
| Ombudsman complaints about payment firms | Down 9% from 2024 to 2025 | FCA payments priorities, March 2026 |
| Insolvent firms that safeguarded funds | 12 between Q1 2018 and Q2 2023, with an average shortfall of 65% | FCA CP24/20 |
The insolvency figures are the reason for the strengthened safeguarding regime: when a payment firm became insolvent, customers were on average owed far more than had been safeguarded, and waited while the insolvency ran its course.
The FCA expects firms to keep up with regulatory change, invest where it is needed and respond to consultations. It does not expect firms to predict final rules, but it does expect them to be able to adapt.
HM Treasury's consultation on modernising payment services regulation ran from 14 July to 6 October 2026. It proposes moving detailed technical requirements from the PSRs and EMRs into FCA rules, restructuring the list of payment activities, bringing UK-issued qualifying stablecoins used for payments within the payments framework and requiring a variation of permission before existing firms offer tokenised payment services. It also asks about authentication and liability for AI agent payments and about enhanced senior manager accountability. The Government will set out implementation details after considering responses. Our guide to the proposed UK payment services reforms covers each proposal.
The FCA's report sets out its own programme: Future Entity workshops through the second half of 2026, an open finance roadmap, and a framework for the first open finance scheme expected by the end of 2027. On stablecoins it is running a sandbox cohort, held a Tech Sprint in March 2026, planned a trade payments roundtable and expects to finalise its stablecoin issuance rules in 2026. Firms with products in either area should follow these workstreams and respond to the related papers.
The FCA encourages firms to use its innovation services where they meet the criteria, to take part in Tech Sprints and Policy Sprints, and to prepare thoroughly before applying for authorisation or registration, including through its pre-application support service. Firms testing AI-driven products can apply to its AI Live Testing programme.
Reform can change business models, technology, partners, capital and product design, so horizon scanning cannot sit with compliance alone. A structured change process identifies each development, assesses its effect, assigns an owner and keeps consultations, final rules and rules in force clearly separate. Boards need short assessments: what has changed, what it affects, what decision is needed and by when.
Where the Consumer Duty applies, the FCA expects firms to assess their products, services and processes on an ongoing basis and fix poor outcomes immediately, and says it will act against firms that do not. Its two focus areas for payment firms in 2026 are the transparency of international payment pricing and the treatment of customers in vulnerable circumstances.
A customer may see a transfer fee but not the exchange rate margin or intermediary charges that reduce what the beneficiary receives. The FCA's good and poor practice findings on international payment cost communication look at whether the customer understands the total cost, and can compare providers, before committing. Pricing models can differ, but none should give the impression that a transfer is cheaper than it is. Boards of firms with significant remittance or foreign exchange activity should see pricing transparency as a standing item in Consumer Duty monitoring.
Payment firms often serve customers who have been declined by banks, who are financially stretched, who have been victims of fraud, or who face digital or language barriers. Many customers also confuse e-money with bank deposits. Communications should explain plainly how customer funds are protected through safeguarding, that the Financial Services Compensation Scheme does not apply to e-money and payment balances, what the fees are and how to get help.
The FCA asks payment firms to review four sets of published findings against their own practice: implementing the Consumer Duty, international payment pricing transparency, the treatment of vulnerable customers, and cryptoasset promotions and fiat-to-crypto on-ramps and off-ramps. A short gap analysis against each, recorded and reported to the board, is a practical way to show the firm has acted on them.
Monitoring should cover complaints, rejected payments, support contacts, pricing outcomes, service availability, fraud cases and the journeys of vulnerable customers. Management information should explain causes and differences between products and customer groups, not only report a status. The Duty works best when it is built into product design rather than reviewed shortly before launch.
Payment firms sit at the points where money laundering, fraud, sanctions evasion and money mule activity pass through the financial system. The FCA expects governance, skilled staff and controls that identify, assess and mitigate these risks, and it will assess firms' governance, oversight and financial crime controls this year. Financial crime is a board matter, not only a matter for the money laundering reporting officer (MLRO), because weaknesses can lead to restrictions on growth or on particular activities.
Sanctions screening should cover customers, beneficial owners, counterparties and payments, with alert backlogs tracked and cleared. Suspicious activity reports to the National Crime Agency should be timely and of good quality, and the MLRO should be senior, adequately resourced and reporting to the board at least annually with meaningful information: alert volumes and ageing, reports filed, high-risk customers, and the findings of any assurance testing.
Slowing the growth of fraud, including authorised push payment (APP) fraud, is part of the FCA's integrity priority. Since 7 October 2024, firms sending Faster Payments have reimbursed APP fraud victims under the mandatory scheme, generally within five business days, up to £85,000 per claim, with the cost split equally between the sending and receiving firms. Firms can delay an outbound payment by up to 72 hours where they have reasonable grounds to suspect APP fraud. Receiving firms bear half the cost of fraud that passes through mule accounts they hold, so onboarding checks, mule detection (rapid movement in and out, structured amounts, dormant accounts suddenly active), effective warnings and intelligence sharing all reduce losses directly. The FCA is exploring greater data sharing between industry, regulators and law enforcement.
Our guide to financial crime controls for payment institutions sets out what the FCA expects of transaction monitoring.
Payments depend on cloud infrastructure, core payment platforms, banking partners, card processors and application programming interface (API) providers. A disruption anywhere in that chain can stop customers reaching their money or making time-critical payments. The FCA expects firms to invest in resilience, including in the design of new products.
The FCA, the Bank of England and the PRA published PS26/2 on 18 March 2026. From 18 March 2027 payment service providers report operational incidents under a single new regime with defined thresholds and standard or enhanced reports, and authorised PIs and EMIs notify the FCA of new or significantly changed material third-party arrangements and submit an annual register of them. The months before March 2027 are the time to align incident classification, escalation and reporting systems with the new rules.
Outsourcing is not a weakness in itself, but the regulated firm stays responsible. Boards should know which third parties are critical, what happens if one is disrupted and whether a credible alternative exists, with contracts, data access, monitoring and exit plans to match. Concentration risk can sit below the first contract: several vendors may depend on the same cloud provider, sponsor bank or platform.
Many payment firms sit in fintech groups and rely on a parent or affiliate for capital, technology, staff or operations. A parent's funding commitment is not the same as cash or capital in the regulated entity, and a shared group platform is a vulnerability if the regulated firm cannot keep running when another group company is in difficulty. The FCA expects these dependencies to be understood and tested at the level of the regulated firm.
The FCA's supplementary safeguarding regime (PS25/12 and CASS 15) came into force on 7 May 2026 for authorised PIs, authorised and small EMIs, and small PIs that elect to safeguard. The focus has moved from implementation to evidence that the controls work every day. The FCA will assess financial resilience and safeguarding controls and review safeguarding audit outcomes this year.
Firms that protect funds with an insurance policy or guarantee must ensure it pays out without restriction other than confirmation of insolvency, and must have a contingency plan in place three months before the policy expires. Firms using segregation should have a documented process for unidentified receipts and for funds received outside business hours, because these are frequent sources of reconciliation breaks.
Reconciliation results are the clearest sign of control over customer money. Boards should look at trends in breaks, manual adjustments and the time taken to clear shortfalls, not only at whether each day's reconciliation was completed. Recurring breaks point to data, systems or governance issues that need root-cause fixes. Reconciliations, REP027 and audit evidence should tell the same story. Where reliable daily data still needs heavy manual work, investment should come before volumes grow. Our article on what payment firms must be doing now that CASS 15 is in force sets out the operating model.
The first safeguarding audits under the new rules are now under way. The FCA has said it expects a short-term rise in adverse audit opinions as the stronger standard exposes issues that were previously hidden; that is a signal of scrutiny, not tolerance. The speed and quality of remediation will matter as much as the finding itself. Our guide to safeguarding audits under CASS 15 explains what auditors test.
The FCA's analysis of the 12 payment firms that became insolvent between 2018 and 2023 explains the design of the new rules. Each requirement answers a weakness seen when firms entered insolvency.
| What was seen in insolvencies | CASS 15 response |
|---|---|
| Customer funds mixed with the firm's own money | Designated safeguarding accounts, acknowledgement letters and daily segregation |
| Records that could not show who was owed what | Reconciliations each reconciliation day and records kept for five years |
| Shortfalls discovered only at insolvency | Monthly REP027 return and annual safeguarding audit |
| Long delays returning funds | A resolution pack ready for an insolvency practitioner |
| Unclear ownership inside the firm | A single director or senior manager responsible for safeguarding |
Boards can use the same table as a test: for each row, the firm should be able to produce the evidence that the control is working today.
The FCA's report notes that some firms still have underdeveloped risk management frameworks and wind-down plans, a point it has made repeatedly in its good and poor practice findings. Firms can look healthy in normal conditions and become unviable quickly if volumes fall, a major banking partner exits, liquidity tightens or an operational event occurs.
Payment institutions and EMIs are not under the senior managers and certification regime, which applies to firms with permissions under the Financial Services and Markets Act 2000. HM Treasury's consultation asked whether enhanced senior manager accountability should be introduced for payment and e-money firms, given the financial crime risks in the sector. Whatever the outcome, the FCA already expects clear individual ownership and real board oversight, and CASS 15 already requires one director or senior manager to own safeguarding compliance.
A board information pack that covers the four priorities in one place lets directors see connections between them.
| Management information | What it shows the board |
|---|---|
| Reconciliation breaks, ageing and manual adjustments | Control over customer money |
| Own funds and liquidity headroom against triggers | Financial resilience and distance from wind-down |
| Monitoring alerts, sanctions hits and backlog ageing | Capacity of financial crime controls |
| APP fraud sent, received and reimbursed | Fraud exposure and cost |
| Complaints, rejected payments and restricted accounts | Consumer Duty outcomes |
| Incidents and third-party service issues | Operational resilience |
| Open audit, review and FCA actions | Progress of remediation |
The four priorities apply to every payment firm, but the emphasis differs by model.
The FCA reports that approval rates for payment firm applications were higher in its latest period, and that applications it did not approve most often showed gaps in senior manager competence and in systems and controls, including financial crime controls. The same standard applies to existing firms seeking new permissions through a variation.
The FCA expects applicants to be ready to operate compliantly on the day of authorisation, with the governance, business plan, forecasts, safeguarding, financial crime framework and operational systems all describing the same business. It also offers a pre-application support service for eligible firms. Our guides to the UK payment institution licence and the UK EMI licence set out the current requirements.
| Date | Event | Status |
|---|---|---|
| 7 May 2026 | CASS 15 safeguarding rules and monthly REP027 return | In force |
| 30 September 2026 | FCA cryptoasset regime application window opened | Open until 28 February 2027 |
| 6 October 2026 | HM Treasury payment services consultation closed | Response awaited |
| End of 2026 | Open banking statutory instrument under the Data (Use and Access) Act 2025 | Due |
| 1 January 2027 | New complaints reporting rules (PS25/19); first period to 30 June 2027 | Coming into force |
| 18 March 2027 | Operational incident and third-party reporting (PS26/2) | Coming into force |
| 25 October 2027 | FCA cryptoasset regime commences | Coming into force |
Start with a candid assessment of exposure against the four priorities, judged by customer harm, the likelihood of regulatory intervention and the sustainability of the business, not by a checklist.
The incident and third-party reporting regime under PS26/2 is the next hard deadline for most payment firms. Five steps, completed during the remaining months of 2026 and early 2027, put a firm in a good position.
A focused review connects the FCA's priorities to the firm's actual model and ends with a plan the board can own.
The output is a prioritised remediation and change plan with named senior owners, deadlines and board oversight.
The firm assesses payment and e-money firms against the FCA's 2026 priorities across governance, Consumer Duty, financial crime, operational resilience, safeguarding and financial resilience, and turns the findings into a prioritised remediation plan. It supports CASS 15 reviews and audit readiness, financial crime frameworks, wind-down planning, regulatory reporting and FCA supervisory engagement, as well as variation of permission applications, stablecoin and open banking structuring and new PI and EMI applications.
Preparing for the future, implementing the Consumer Duty, protecting the integrity of the financial system and keeping customers' money safe. They are set out in the FCA's Regulatory Priorities report for payments, published in March 2026.
All firms authorised or registered under the Payment Services Regulations 2017 or the Electronic Money Regulations 2011, including small payment institutions, small EMIs and account information service providers. It replaces more than 40 portfolio letters.
Yes. The FCA will assess safeguarding controls and review audit outcomes, and it expects a short-term rise in adverse audit opinions as the rules bed in. The focus is evidence that controls work every day.
From 18 March 2027, under PS26/2. Payment service providers report operational incidents under the new regime, and authorised PIs and EMIs notify material third-party arrangements and submit an annual register.
Governance and oversight, financial crime systems and controls, money laundering and fraud, including authorised push payment fraud. Risk assessments and controls must reflect the firm's actual customers, products, countries and volumes.
No. It closed on 6 October 2026, and the PSRs and EMRs remain in force. Changes will follow through secondary legislation and FCA rules after the Government responds.
As a framework to test whether controls and resources remain appropriate, focusing on evidence of outcomes rather than policies. The result should be a prioritised remediation plan with named owners and deadlines.
Buckingham Capital Consulting has obtained FCA payment and e-money licences for firms including Nexpay, Orbital, Global Send, Dzing Finance and HFS since 2013. It assesses payment and e-money firms against the FCA's priorities and supports CASS 15 safeguarding, financial crime controls and wind-down planning after authorisation.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.