Payment institutions (PIs) and electronic money institutions (EMIs) move money quickly, onboard customers digitally and often operate across borders. Those features make them attractive to criminals, and the FCA expects controls designed for the specific way each firm's money moves. The components below should work as one connected framework, not as separate documents.
| Control area | What the FCA expects to see |
|---|---|
| Business-wide risk assessment | Specific analysis of the firm's customers, corridors, products and channels |
| Customer due diligence (CDD) | Verified identity and ownership, and a recorded purpose for the relationship |
| Enhanced due diligence (EDD) | Measures aimed at the particular higher risk, with real senior approval |
| Ongoing monitoring | Periodic reviews plus event triggers that keep profiles current |
| Transaction monitoring | Scenarios that reflect the firm's actual payment flows, calibrated and tested |
| Sanctions | Screening of customers, owners and payment data, with tested calibration |
| Fraud and mule risk | Shared intelligence between fraud and AML teams, including receiving-side controls |
| Governance | An MLRO with authority and resources, and board challenge |
| Suspicious activity reports | Documented investigation and timely reports to the NCA |
| Agents and third parties | Due diligence before appointment and ongoing oversight |
| Compliance monitoring | Testing of how controls operate in practice |
| Regulatory reporting | Accurate regulatory returns and prompt notifications to the FCA |
This article applies the FCA's general expectations, covered in the firm's guide to FCA financial crime compliance for all regulated firms, to the operating models of payment and e-money businesses.
The FCA's Payments Regulatory Priorities report, published in March 2026, lists protecting financial system integrity as a priority. The FCA states it will tackle financial crime, including money laundering, and slow the growth of fraud, including authorised push payment (APP) fraud. It expects effective governance, systems and controls, and staff with the skills to identify, assess and mitigate risk, and says it will act against firms that consistently fall short.
The same report records how fast the sector has grown: EMIs safeguarded about £26 billion in 2024, up from £11 billion in 2021. Growth at that rate puts pressure on onboarding, monitoring and investigation teams, and the FCA tests whether control capacity has kept pace.
Where it finds weaknesses, the FCA can require remediation, agree voluntary requirements that restrict onboarding or certain activity, impose formal requirements, or commission a skilled person review under section 166 of FSMA at the firm's cost. The wider priorities for the sector are covered in the firm's article on FCA regulatory priorities for payment firms in 2026.
| Publication | Date | Relevance to PIs and EMIs |
|---|---|---|
| Payments Regulatory Priorities | March 2026 | Sets financial crime and APP fraud as supervisory priorities |
| Customer due diligence processes and controls: findings | 8 April 2026 | Good and poor practice on CDD, EDD and ongoing due diligence |
| Sanctions systems and controls: findings | 28 May 2026 | Payments is one of the largest sources of breach reports |
| Money Laundering and Terrorist Financing (Amendment) Regulations 2026 | In force 30 June 2026 | Sterling thresholds, FATF call for action countries, pooled accounts |
| Money mules: activity and cashing out findings | 23 September 2026 | Survey included PIs and EMIs; early closure data by firm type |
The business-wide risk assessment, required by regulation 18 of the Money Laundering Regulations 2017 (MLRs), should cover the risk from customers, countries, products, transactions and delivery channels. It should separate inherent risk, before controls, from residual risk, after controls, and explain the reasoning behind each rating.
It should be reassessed whenever the business changes: a new corridor, a new customer segment, a card programme, an agent network or a step change in volumes. A risk assessment that is reviewed only on an anniversary date tends to describe the business as it was, not as it is.
Statements such as "cross-border payments carry money laundering risk" add little. A useful assessment says which corridors, which customer types and which product features create the exposure, and how controls address each one. For a payment firm, that typically means addressing third-party funding of accounts, immediate onward movement of value, agent-originated transactions, and customers who have been declined by banks.
Boards should challenge the assessment before approving expansion into new markets or products, and the minutes should show that challenge.
CDD is more than document collection. It means identifying and verifying the customer and any beneficial owner, understanding the purpose and intended nature of the relationship, and recording enough information to assess risk and monitor activity later.
The FCA's April 2026 findings on customer due diligence describe the gaps it sees most often: firms not recording the purpose and intended nature of the relationship, EDD measures not evidenced, no clear point at which senior approval is required, and periodic reviews not carried out. The FCA also noted cases where firms did not follow their own procedures, which is why testing matters as much as policy.
Verification on its own does not establish commercial rationale. A business customer that passes identity and company checks still needs a clear profile: what it sells, who pays it, who it pays, in which currencies and through which countries. Since 18 November 2025, Companies House identity verification for directors and persons with significant control is an additional data point to record for UK corporate customers.
Risk models should use customer type, ownership, jurisdiction, product use, channel, source of funds and expected activity. A model that rates almost everyone as medium risk does not direct effort. A model that over-flags ordinary customers creates queues that slow genuine investigations. Manual overrides should be controlled, explained and reviewed.
EDD is required for higher-risk relationships and in the circumstances the MLRs specify, including relationships involving a FATF call for action country, politically exposed persons and transactions that are unusually complex or unusually large. The 2026 amendments replaced the term "high-risk third country" with "FATF call for action country", so policies and screening rules should use the new term.
Measures should target the particular risk. A complex ownership chain calls for verified mapping to the controlling individuals. Unusual wealth calls for evidence of source of wealth. Payments through higher-risk jurisdictions call for analysis of the routes and counterparties. Collecting more documents without analysing them is not enhanced due diligence.
Senior approval should be a real assessment that records why the firm accepts the risk, not an automatic sign-off. EDD customers should then receive more frequent reviews and tighter monitoring thresholds.
The 2026 amendments add specific due diligence for pooled client accounts, which payment firms often provide to platforms, marketplaces and other regulated businesses. The firm must understand the account's purpose and manage the money laundering risk, and the customer must keep records and provide information on request.
Ownership changes, activity grows and adverse information appears after onboarding. Firms should combine periodic reviews, scheduled by risk rating, with event-driven triggers such as a change of director or beneficial owner, a new corridor in the customer's activity, adverse media or a sanctions match.
Transaction alerts should prompt an update to the customer profile, not simply be closed. If an alert reveals that the customer's business has changed, the profile, risk rating and monitoring thresholds should change with it.
There is no FCA-prescribed scenario set. Monitoring should be designed around the firm's products, customers, corridors and settlement patterns, and off-the-shelf platforms are adequate only once configured for that activity.
| Business model | Typical monitoring focus |
|---|---|
| Money remittance | Structuring below thresholds, many senders to one beneficiary, high-risk corridors, rapid repeat transfers |
| Merchant acquiring | Transaction laundering, sudden volume changes, refund and chargeback patterns, mismatched merchant category |
| EMI wallets and cards | Rapid load and spend, third-party funding, cash withdrawals abroad, many cards on one device |
| Business-to-business payments | Payments inconsistent with the stated trade, circular flows, unrelated third-party payers |
| Open banking payment initiation | Unusual payee patterns, high-value first payments, links to known mule accounts |
Thresholds set too high miss activity. Thresholds set too low create false-positive backlogs that bury genuine alerts. Rules should be tested on the firm's own transaction data before go-live and after every material change, with each change documented and approved.
Monitoring findings should feed back into customer risk. A customer onboarded to make occasional domestic payments who starts receiving third-party funds and forwarding them overseas should be re-rated and reviewed, not just cleared alert by alert. Investigators should be able to trigger a review, EDD, account restrictions or exit.
Money mules are people whose accounts are used to receive and pass on criminal funds. They may use their own genuine identity, a synthetic identity or a compromised one. The FCA's September 2026 money mule findings show why payment firms are in focus.
Indicators include shared devices, addresses, IP addresses and beneficiaries, rapid pass-through of funds and new accounts receiving many small credits. The FCA expects firms to look beyond the first receiving account and to use the information-sharing provisions of the Economic Crime and Corporate Transparency Act 2023. Fraud and AML teams should share data on the same cases.
The APP scams reimbursement requirement has applied to Faster Payments since 7 October 2024. Sending firms must reimburse eligible victims up to £85,000 per claim, and the cost is shared equally between the sending and receiving firms. That gives the receiving firm, often a PI or EMI, a direct financial interest in keeping mule accounts off its books.
Since 9 October 2024, payment service providers may delay an outbound payment by up to four business days where they have reasonable grounds to suspect fraud or dishonesty, subject to conditions in the Payment Services Regulations 2017 as amended. The firm must inform the customer, investigate and either execute or refuse the payment within that period.
The common thread is preventing harm before money leaves the firm. Onboarding controls stop mule accounts opening, monitoring detects them early, and payment interventions stop the onward movement of funds.
The FCA's sanctions systems and controls findings, published on 28 May 2026, state that most breach reports come from payments, retail banking and wholesale markets. The most common root causes were weaknesses in due diligence, alert management, screening, frozen asset management and licence compliance.
Screening should consider ownership and control, payment message fields, counterparties, vessels and jurisdictions, not only the customer's name at onboarding. Tuning a system hard to reduce alert volumes creates exposure, so firms should test calibration with variant spellings and non-Latin names, and keep evidence of the configuration and the assurance testing behind it.
Where the firm knows or suspects that a person is designated or a breach has occurred, it must report to OFSI. Asset freezes and licence conditions need clear procedures so that frozen funds stay frozen.
The FCA considers the MLRO's experience, seniority and the support the MLRO receives from management. In fast-growing payment firms, compliance staffing often lags behind customer numbers, and the MLRO should be able to say so to the board and be heard.
PIs and EMIs are not under the senior managers regime, but the FCA assesses the MLRO and directors at authorisation and in supervision. The MLRs also require a board member or senior manager to be responsible for compliance with the regulations, where appropriate to the firm's size and nature.
Management information should show trends and emerging concerns: high-risk customer numbers, EDD volumes, alert backlogs and ageing, sanctions cases, mule offboarding, SARs and overdue reviews. The board should challenge it and record that challenge.
Smaller firms sometimes use an interim or outsourced MLRO while they recruit. This works where the individual has the time, the access to systems and data, and the standing with the board to perform the role, and where the firm still owns its framework. An MLRO shared across several firms should be able to show how time is allocated to each.
Staff report suspicions internally, and the MLRO, as nominated officer, decides whether to make a disclosure to the National Crime Agency. Defensive or excessive reporting, where reports are filed without real analysis, does not help law enforcement and does not demonstrate good control.
Where the firm wants to proceed with a suspected transaction, it requests a defence against money laundering (DAML). The NCA has seven working days to respond, and if it refuses, a 31-day moratorium follows. Decisions, including decisions not to report, should be recorded, and case access controlled so that tipping-off restrictions are respected.
Financial crime controls often end in a decision to restrict an account, refuse a payment or exit a customer. These decisions should follow a documented process with clear authority levels, so that the same facts lead to the same outcome.
For retail customers, the Consumer Duty applies to these decisions. Restrictions that are disproportionate, unexplained or slow to resolve can cause foreseeable harm, so the firm should review restricted accounts promptly and record the outcome.
A PI or EMI that uses agents or e-money distributors remains responsible for their activity. Agents must be registered with the FCA before they provide payment services. Pre-appointment due diligence should cover the agent's owners, fitness and propriety, and their own controls.
Ongoing oversight should include monitoring of agent transaction patterns, mystery shopping or site visits where appropriate, and a clear process for suspending an agent. Delegating CDD to an agent or partner does not transfer the regulatory responsibility for it.
Using a vendor for screening, identity verification or transaction monitoring does not outsource the obligation. The firm should understand the vendor's data inputs, configuration, model limits and update process, and retain enough internal expertise to oversee a managed service. Contracts should cover regulatory access, audit rights, data protection, business continuity and exit.
Payment service providers must make sure that transfers of funds carry the required information on the payer and the payee, under the retained Funds Transfer Regulation that the MLRs supervise. The payer's provider attaches and verifies the information. The payee's provider, and any intermediary, must have procedures to detect missing or incomplete information and decide whether to execute, reject or suspend the transfer.
Repeated missing information from the same provider should be escalated and can lead to restricting or ending the relationship with that provider. The same data feeds sanctions screening and transaction monitoring, so data quality in payment messages is a financial crime control, not only an operations matter. For cryptoasset transfers, the equivalent travel rule has applied since 1 September 2023.
Dear CEO letters, multi-firm reviews and enforcement cases point to the same recurring themes in payment and e-money firms. Each is straightforward to test for internally before a supervisor does.
The Starling (£28,959,426, September 2024) and Monzo (£21,091,300, July 2025) penalties both concerned controls that did not keep pace with rapid customer growth. Fast-growing payment firms are in the same position and the lesson applies directly.
The MLRs require CDD records and transaction records to be kept for five years after the end of the business relationship, or after an occasional transaction. Records should be retrievable quickly enough to respond to the NCA, the FCA or a court order.
The wider point is evidence. Supervisors test what the firm can show: the rationale for a risk rating, the analysis behind an EDD approval, the reason an alert was closed, the board's challenge of management information. A control that operates but leaves no record is treated as a control that did not operate.
Merchant acquirers carry the risk that a merchant is not what it says it is. Due diligence should cover the nature of the business, its owners, its sales channels and its sector risk, and the website and product range should match the declared activity.
Monitoring should detect transaction laundering, where illicit sales are processed through a legitimate-looking merchant, and changes in the merchant's business model. Refund rates, chargeback ratios, card-not-present patterns and volumes out of line with the merchant's size are useful indicators.
Country risk should draw on authoritative sources: UK and other sanctions regimes, FATF lists, corruption indices, national risk assessments and the firm's own experience. The 2026 MLR amendments now refer to "FATF call for action countries" for the mandatory EDD trigger.
Corridor behaviour matters as much as country ratings. Repeated routing through intermediate jurisdictions, round-tripping and payments to destinations unrelated to the customer's business all deserve attention. Risk appetite for each new market should be defined and approved before launch, not after the first alerts arrive.
Machine learning models can identify complex patterns, such as networks of linked mule accounts, that rules miss. They need validation before use, ongoing performance monitoring and documented limits.
Human judgement remains essential for high-risk decisions such as exits, SARs and sanctions escalations. Vendor updates that change detection logic should go through the firm's change management, with testing before release.
Policy updates and training completion rates do not prove that controls work. Compliance monitoring should use risk-based samples of customer files, alerts, sanctions cases and SAR records, and test whether each control operated as designed. The FCA's April 2026 CDD findings highlighted firms where the same staff onboarded and reviewed customers, with no independent second-line assurance.
The MLRs require an independent audit function where appropriate to the firm's size and nature. The audit should cover the full framework and be independent of the activities it tests. Repeated findings that remain open are more concerning to the FCA than a single isolated issue, so remediation should be retested and closed only on evidence.
An application for a UK payment institution licence or an EMI authorisation is assessed on whether the risk assessment, policies and monitoring match the regulatory business plan. The FCA looks for operational credibility: monitoring and investigation resources sized for the projected volumes, a named and experienced MLRO, and a screening and monitoring stack already contracted.
Directors should understand the framework well enough to explain it at interview. The FCA's service standard for a complete application for authorisation is three months, and twelve months for an incomplete one; the firm plans PI and EMI authorisations at six to eight months after submission.
Signs that controls are under strain include growing alert backlogs, frequent manual overrides, delayed periodic reviews and rising EDD volumes without extra staff. Each should trigger a resourcing review.
New products and markets bring new typologies. A card programme, stablecoin conversion, a new corridor or a business-to-business offer each change the risk profile and should go through financial crime review before launch. Compliance is continuous; it is not achieved once at authorisation.
Buckingham Capital Consulting carries out financial crime gap assessments, transaction monitoring and sanctions reviews, and remediation programmes for PIs, EMIs and payment fintechs. For applicants, it builds the financial crime framework as part of the authorisation project so the controls match the business plan. Details are on the firm's financial crime page.
A business-wide risk assessment, customer risk assessment, CDD and EDD, ongoing monitoring, transaction monitoring, sanctions controls, SAR processes, competent MLRO oversight and compliance monitoring, all proportionate to the firm's risks and working together.
Yes. Ongoing monitoring under the MLRs includes scrutiny of transactions, and it should be tailored to the firm's products, customers, corridors and flows, with tested data quality and thresholds.
Periodically and whenever the business changes materially, for example a new product, customer type, corridor, agent network or rapid growth. The review should be substantive, not a date update.
The March 2026 Payments Regulatory Priorities name money laundering and fraud, including APP fraud. The FCA's 2026 findings on CDD, sanctions and money mules show where it tests firms in practice.
Under the APP scams reimbursement requirement, in force since 7 October 2024, the sending firm reimburses eligible victims up to £85,000 and the cost is shared equally with the receiving firm.
Yes. Since 9 October 2024, a payment service provider may delay an outbound payment by up to four business days where it has reasonable grounds to suspect fraud, subject to conditions in the Payment Services Regulations 2017.
Yes. The principal PI or EMI remains responsible for its agents and distributors, and delegating CDD does not transfer the regulatory responsibility.
Buckingham Capital Consulting has obtained FCA payment institution and e-money authorisations for firms including Orbital, Global Send and HFS since 2013, writing the risk assessment, transaction monitoring rules and MLRO arrangements that the FCA tests at authorisation. It also carries out independent AML reviews and remediation programmes for authorised payment and e-money firms.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.