FCA Regulatory Reporting for Payment and E-Money Firms 2026: What PIs and EMIs Must Submit

Why regulatory reporting matters for payment and e-money firms

Payment institutions (PIs) and electronic money institutions (EMIs) report to the Financial Conduct Authority (FCA) on their capital, transactions, fraud, operational risk, safeguarding and financial crime exposure. The FCA uses this data to decide where to focus supervision, compares it across returns and over time, and asks questions when the figures do not reconcile.

A firm can look compliant on paper and still draw supervisory attention if its returns do not agree with its finance records, safeguarding calculations or transaction systems. Reporting belongs inside the control framework, with owners, data sources and review, not in an administrative filing process. In 2026 the stakes rose: the monthly REP027 safeguarding return has applied since 7 May 2026, and new incident and third-party reporting rules follow on 18 March 2027.

Which returns apply to which firm

Obligations depend on the firm's status, permissions and activities. The rules are in chapter 16 of the FCA's Supervision manual (SUP 16): SUP 16.13 for the Payment Services Regulations 2017, SUP 16.15 for the Electronic Money Regulations 2011 and SUP 16.14A for safeguarding. The tables below summarise the main returns.

Authorised payment institutions

Small payment institutions and RAISPs

Electronic money institutions

Other returns can apply: REP020 for firms that provide open banking interfaces, the annual financial crime report (REP-CRIM) for firms that meet the SUP 16.23 criteria, and the payment services and e-money complaints return. The FCA's reporting system shows each firm's scheduled returns, but the firm remains responsible for identifying every obligation that applies to it.

FSA056: the authorised payment institution return

FSA056 gives the FCA the firm's capital position and core business information, so it can test whether the firm still meets its authorisation conditions. It is filed annually within 30 business days of the accounting reference date.

• Own funds and the requirement under Method A, B or C should match the firm's prudential calculation and the audited or management accounts.
• Payment volumes and income used in the calculation should come from the same data as the finance ledger.
• Any shortfall against the requirement is a matter for prompt notification, not something to be left for the return.

FSA057: the small payment institution return

FSA057 reports the services a small payment institution provides and its transaction volumes for the previous calendar year, filed within one month of 31 December. The FCA uses it to test whether the firm still meets the registration conditions, including the limit of an average of €3 million of payment transactions a month.

Volumes should be monitored monthly, not only when the return is prepared. A small payment institution that no longer meets the conditions must apply for authorisation within 30 days of becoming aware of it, so a firm approaching the limit should plan its application well ahead.

FIN060 and FSA065: e-money reporting

FIN060 is the annual questionnaire for authorised and small EMIs, covering e-money issuance, payment services, financial position and capital. It is due within 30 business days of the accounting reference date. EMIs often combine e-money, cards and unrelated payment services, and the return should separate them where required, because capital and safeguarding are treated differently: own funds for e-money follow Method D (2% of average outstanding e-money), while unrelated payment services follow Method A, B or C.

Small EMIs also file FSA065, reporting total outstanding e-money at 31 December, within one month. A small EMI is limited to an average of €5 million of outstanding e-money, so it should track the figure through the year and plan any move to authorisation before growth forces it.

REP027: the monthly safeguarding return

REP027 is the most significant reporting change of 2026. Since the CASS 15 safeguarding rules came into force on 7 May 2026, every safeguarding institution submits it within 15 business days of the end of each calendar month under SUP 16.14A. That covers authorised payment institutions holding customer funds, authorised and small EMIs, and small payment institutions that elect to safeguard. A firm does not file for the month in which it first becomes a safeguarding institution.

The return covers the amount of customer money safeguarded, the methods and accounts used, reconciliation results and the wider arrangements. Because it is monthly, the FCA can compare positions month to month and see changes quickly.

• Reconcile every figure to the reconciliations performed at least once each reconciliation day, to bank and custodian balances and to management information.
• Document how each data item is derived and who owns the source data.
• Give the return senior review in proportion to the funds it covers, usually by the director responsible for safeguarding.
• Record the reason for any manual adjustment.

Our practical guide to the monthly safeguarding return walks through each section.

REP017: payment fraud reporting

REP017 reports statistics on payment transactions and fraudulent transactions by payment type, authentication method and channel, following the template in SUP 16 Annex 27ED. Authorised PIs and authorised EMIs report every six months, for 1 January to 30 June and 1 July to 31 December, within two months of each period end. Small PIs, RAISPs and small EMIs file two half-year reports together within two months of the calendar year end.

The main challenge is data. Fraud information sits in fraud systems, transaction systems, chargeback records, customer service logs and bank and scheme reports, which may classify the same event differently. A documented methodology should identify, classify and reconcile fraud to payment volumes using the FCA's definitions rather than internal categories. A change in methodology can move fraud rates sharply, so changes should be approved and recorded.

REP018: operational and security risk

REP018 is the payment service provider's assessment of its operational and security risks and of whether its mitigating measures and controls remain adequate. It is submitted at least once each calendar year; the rules allow more frequent submission, up to quarterly.

The assessment should describe the firm's actual technology, systems, outsourced providers, cyber risks and dependencies. A common weakness is a business that has changed its core platform, cloud provider, processor or channels while the assessment still describes the old set-up. Compliance, technology, information security and operational risk teams should prepare it together and revisit it when material changes occur.

REP020: open banking interface statistics

REP020 applies to account servicing payment service providers that offer a dedicated interface for open banking under the strong customer authentication technical standards. It reports daily statistics on the availability and performance of the interface, such as uptime, downtime and response times, compared with the interface customers use directly. It is filed quarterly, within one month of each quarter end.

Incident records, published availability figures, REP020 data and any FCA notifications about the interface should tell the same story. Interface performance is likely to stay in focus as the Government develops the next phase of open banking regulation under the Data (Use and Access) Act 2025.

Financial crime, controllers and complaints returns

Annual financial crime report (REP-CRIM)

The SUP 16.23 rules on the annual financial crime report apply to payment institutions and EMIs that meet the criteria. The report covers the nature and scale of financial crime exposure: customer types, jurisdictions, politically exposed persons and other risk indicators. It should agree with the business-wide financial crime risk assessment, customer data and monitoring information. A return showing significant exposure to higher-risk jurisdictions alongside a risk assessment that rates geographic risk as low will prompt questions.

Controllers and close links

Authorised payment institutions file the annual controllers report and close links report under SUP 16.4 and SUP 16.5. These are separate from the duty to obtain FCA approval before anyone acquires 10% or more of the firm.

Complaints

Payment service providers report complaints under DISP 1.10B. New FCA complaints reporting rules from PS25/19, published on 3 December 2025, apply from 1 January 2027, with the first reporting period running from 1 January to 30 June 2027. Firms should map their complaint categories and data to the new return during 2026.

Coming next: incident and third-party reporting from 18 March 2027

FCA policy statement PS26/2, published on 18 March 2026 with the Bank of England and the PRA, introduces single regimes for operational incident reporting and material third-party reporting from 18 March 2027.

• Operational incidents: payment service providers fall within the incident regime. The rules define an operational incident, set reporting thresholds and provide for standard or enhanced incident reports, with guidance in FG26/3.
• Material third parties: authorised payment institutions and authorised EMIs notify the FCA of new material third-party arrangements and significant changes to them, keep a register of material third-party arrangements and submit it to the FCA annually.

Until the new rules apply, the existing duty under the Payment Services Regulations to notify the FCA of major operational or security incidents without undue delay continues. Firms should use the remaining months of 2026 to build the register, set incident classification thresholds and confirm how the new reports sit alongside their existing payment incident process.

A reporting calendar for the year

For a firm with a 31 December accounting reference date, the fixed deadlines fall as follows. Firms with a different year end move the FSA056 and FIN060 dates accordingly.

Worked example

An authorised payment institution with a 31 December 2026 year end counts 30 business days from 1 January 2027, excluding the New Year bank holiday and weekends, which gives a deadline of 12 February 2027 for its FSA056. Its REP017 for July to December 2026 is due by 28 February 2027, and its REP027 for January 2027 is due 15 business days after 31 January. Building these dates into a calendar at the start of the year, with internal deadlines a week earlier for review, avoids late filing.

Data foundations for accurate returns

Most reporting errors trace back to data rather than to the form itself. Three foundations make returns reliable.

• A single ledger of customer balances. Safeguarding, e-money outstanding and payment volumes should all be drawn from one controlled source, so REP027, FIN060 and FSA056 agree by design.
• Agreed definitions. What counts as a payment transaction, a fraud case or a reconciliation break should be defined once, in writing, and used by every team.
• Controlled cut-offs. Period ends, time zones and value dates should be fixed so that each return captures the same transactions as the ledger for the same period.

Where data is assembled manually, the extraction queries and spreadsheets should be versioned and reviewed, and the reviewer should re-perform a sample of the figures before sign-off.

Returns should reconcile with each other

Returns overlap. Transaction volumes, customer funds and the business profile appear in prudential, fraud, safeguarding and financial crime submissions. Differences can be legitimate, because definitions and periods vary, but each should be explainable.

Unexplained differences usually mean teams are using different datasets, definitions or cut-off times. The FCA compares returns with each other and with prior periods to identify trends.

Reporting in the first year after authorisation

Newly authorised and registered firms often find their first reporting deadlines arrive sooner than expected. The FCA's reporting system sets up the firm's schedule after authorisation, and the firm should check it against its own obligations register in the first weeks.

• REP027: no return is due for the month in which the firm first becomes a safeguarding institution; the first return covers the following month.
• Safeguarding audit: the first auditor's report is due within 6 months of the end of the first audit period, and later reports within 4 months.
• FSA056 or FIN060: the first return follows the first accounting reference date after authorisation, so a firm authorised in the autumn with a 31 December year end files within weeks of its first year end.
• REP017: the first return covers the half-year in which the firm began providing payment services.
• Fees: the first annual FCA periodic fee is pro-rated for the months remaining in the FCA's fee year, and the FCA contacts the firm about it directly.

Appointing owners for each return before authorisation, and running a trial REP027 from the firm's own data in the first month, keeps the first year on schedule.

Governance before the filing deadline

Each return needs a named preparer, data owners and a reviewer. Finance typically owns capital data, operations owns transaction data, the fraud team owns fraud classification and technology owns operational risk and interface data. Compliance coordinates interpretation and challenges the submission, but business functions remain accountable for their data.

• Keep a regulatory obligations register mapping each return to its rule, frequency, deadline, data source, owner and reviewer.
• Update it whenever permissions, products, agents, banks, currencies or countries change.
• Put spreadsheets and data transformations under version control, with review evidence and an audit trail.
• Match the depth of review to the return's significance: a monthly safeguarding return covering substantial customer funds needs meaningful senior review.

What the FCA looks for in a firm's returns

Timely filing is the baseline. What the FCA values more is returns that are complete, consistent and correctly interpreted, filed with few amendments. The features of a strong reporting framework are:

• shared definitions across finance, operations and compliance;
• documented logic, with changes approved and recorded;
• new products brought into reporting data before launch;
• manual adjustments reviewed and explained; and
• methodologies refreshed as the business grows.

When a return is found to be wrong, the firm assesses the error promptly, corrects it and considers whether a separate notification is needed. Repeated corrections can indicate governance or systems weaknesses.

Notifications are separate from periodic returns

Event-driven notifications sit outside the reporting calendar. Information that will appear in a later return does not remove the duty to notify the FCA promptly. Examples include:

• a material safeguarding breach or shortfall;
• a major operational or security incident;
• a shortfall in own funds;
• a proposed change in control, or a change of directors or managers;
• a change to important outsourcing arrangements; and
• a small payment institution or small EMI starting or stopping safeguarding, notified on the SUP 15 form.

Firms should maintain a notification framework alongside the reporting calendar, so staff escalate events to compliance quickly and notification decisions are taken and recorded.

What to review now

1. Confirm every applicable return has an owner, reviewer, data source and documented methodology.
2. Test whether the figures trace to source systems and reconcile across returns.
3. Give particular attention to REP027, REP017 and REP018, which draw on several functions.
4. Check the framework has kept pace with growth: new products, agents, banks, currencies, countries and customer types.
5. Prepare for the complaints return from 1 January 2027 and the incident and third-party regime from 18 March 2027.

Our guides to FCA compliance for payment institutions and FCA compliance for e-money institutions place reporting within the wider compliance programme.

How Buckingham Capital Consulting helps

The firm reviews reporting frameworks for payment and e-money firms: mapping obligations and data sources, testing individual returns, and reconciling regulatory data to financial, operational and safeguarding records, covering REP027, FSA056, FSA057, FIN060, fraud, operational risk and financial crime reporting. Remediation focuses on methodology and ownership so that every future return is right, not only the next one. Details are on our regulatory compliance page and our safeguarding page.

Frequently asked questions

References

1. FCA Handbook SUP 16.13: Reporting under the Payment Services Regulations
2. FCA Handbook SUP 16.15: Reporting under the Electronic Money Regulations
3. FCA Handbook SUP 16.14A: Safeguarding return
4. FCA: Safeguarding requirements for payment institutions and e-money institutions
5. FCA PS26/2: Operational incident and third party reporting
6. FCA PS25/12: Changes to the safeguarding regime for payments and e-money firms

Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.

This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.