The FCA authorises an electronic money institution (EMI) under the Electronic Money Regulations 2011 (EMRs) and an authorised payment institution (API) under the Payment Services Regulations 2017 (PSRs) when it is satisfied the applicant meets the conditions for authorisation. Those conditions cover the firm's people, owners, capital, governance, safeguarding, financial crime controls and business plan. The FCA refuses an application when, on the information it has, it cannot be satisfied that one or more conditions is met.
Three areas account for most of the FCA's concerns with EMI and API applications in 2026: the skills of the key people, how the firm will deliver good outcomes for customers under the Consumer Duty, and the safeguarding of customer funds. Each is set out below with what the FCA looks for, followed by the other areas it examines and how the refusal process works. The full EMI procedure is in our UK EMI licence guide and the API route in our UK payment institution licence guide.
| Area | What the FCA looks for |
|---|---|
| Key people | Directors, compliance officer and MLRO with relevant experience, time and a UK base |
| Consumer Duty | Products, pricing, communications and support designed for good customer outcomes |
| Safeguarding | A named bank, daily reconciliation and CASS 15 procedures from day one |
| Business model and permissions | Each service mapped to the permission applied for |
| Financial resources | Capital, realistic forecasts with a downside case and evidence of funding |
| Financial crime | A risk assessment and controls that fit the firm's actual customers and flows |
| Ownership | A clear chain to the ultimate owners and documented source of funds |
| Completeness | Tailored, consistent documents and full answers to the FCA's questions |
The EMRs and PSRs require the directors and the people managing the payment or e-money business to be of good repute and to have appropriate knowledge and experience. The FCA registers each of them through its individuals form and reviews their CVs, past roles, references and regulatory history. It places particular weight on the CEO, the compliance officer and the money laundering reporting officer (MLRO).
In September 2025 the FCA published good practice notes for applicants. It looks for firms that provide their own suitability assessment of each key individual, recognise any staffing gaps and explain how and when they will be filled, and show how people with several roles will divide their time. It also looks for a team that understands its regulatory obligations itself, rather than relying on its consultants to explain them. In interview, the CEO and MLRO should be able to describe the business, its risks and its controls in their own words.
Recruiting an experienced MLRO or compliance officer before submission is often the most effective change an applicant can make. Our article on hiring MLROs and heads of compliance sets out what the FCA expects of each role.
The Consumer Duty has applied to open products since 31 July 2023 and to closed products since 31 July 2024. It requires firms to act to deliver good outcomes for retail customers across four areas: products and services, price and value, consumer understanding, and consumer support. It applies to EMIs and APIs serving consumers and small businesses.
The FCA's good practice notes ask applicants to build the Consumer Duty into their policies, procedures, systems and controls, rather than treat it as a standalone document. In practice the application shows:
The FCA's payments portfolio letter and its multi-firm review of the Consumer Duty in payments set out the outcomes it expects from payment and e-money firms. Our guide on how EMIs and payment institutions implement the Consumer Duty covers each outcome.
Safeguarding protects customer money so it can be returned in full if the firm becomes insolvent. Shortfalls in customer funds at payment firms that entered insolvency led the FCA to strengthen the regime, and its CASS 15 rules, introduced by Policy Statement PS25/12, have applied since 7 May 2026. The FCA now assesses safeguarding at application against those rules.
The account does not have to be open at submission, but the application names the intended bank and shows the onboarding is under way. A plan that says the bank will be chosen after authorisation leaves the FCA without evidence that funds will be protected from the first day of trading. Banks run their own due diligence on payments firms, so the conversation starts early in preparation. Our article on obtaining a safeguarding account explains how. Safeheld, the firm's own safeguarding platform, runs the daily reconciliation and the monthly return.
The FCA expects the permissions applied for to match the business model exactly. Its good practice notes ask applicants to analyse why each permission is relevant to their activities. An EMI application for a product that issues no stored value, or an API application for a wallet that holds balances, raises questions about whether the firm understands its own model.
The firm must hold its initial capital, €350,000 for an EMI and €20,000 to €125,000 for an API, and show it can meet its ongoing own funds requirement as it grows. The FCA looks for forecasts with notes and assumptions, a base case and a downside case, evidence of funding commitments, and historic accounts with the initial application where the company has traded.
A generic anti-money laundering policy does not meet the FCA's standard. The business-wide risk assessment reflects the firm's actual customers, products, countries and payment flows, and the controls, from customer due diligence to transaction monitoring, follow from it. Higher-risk corridors, agent networks and cross-border structures receive the closest attention.
Anyone with 10% or more of the shares or voting rights, or significant influence, must be fit and proper. The FCA looks for a clear ownership chart to the ultimate individuals and documented source of funds. Complex overseas structures, trusts and nominee holdings need a full explanation.
The FCA states that policies should not be generic templates and should explain how the firm will comply, rather than repeat the rules. It also looks for policies that align with one another and for clear information on planned IT systems, identifying which are off the shelf, modified or built, with realistic timelines.
The applicant must be a UK company with its head office in the UK, and the business must be directed from the UK. Where parts of the group operate overseas, the FCA looks for clear evidence of how decisions are made in the UK, with reporting lines and resources in the UK entity.
The FCA must decide a complete application within 3 months and any application within 12 months. Many applications that do not proceed are withdrawn by the applicant before a decision, often to be resubmitted once the gaps are closed. Our guide to FCA PI and EMI timelines sets out each stage.
A refusal affects more than the timetable. FCA application forms, and the forms used by many overseas regulators, ask whether the firm, its owners or its directors have ever been refused an authorisation or registration, so a refusal is disclosed in future applications by the people involved. Banks, card scheme sponsors and investors ask the same question in their own due diligence.
That is why firms with unresolved concerns often withdraw and strengthen the application rather than wait for a decision. The better course is to close the gaps before submission, so that the case officer's questions are about detail rather than about whether a condition is met.
| Before submission | Why it matters |
|---|---|
| Appoint the CEO, MLRO and compliance officer | The FCA assesses the people at application |
| Map every product to its permission | Shows the firm understands its own model |
| Deposit or commit the initial capital | A condition of authorisation |
| Build forecasts with a downside case and funding evidence | Shows the firm stays above its capital requirement |
| Name the safeguarding bank and write the CASS 15 procedures | Shows customer funds are protected from day one |
| Write the risk assessment for the actual business | Shows financial crime controls fit the risks |
| Build the Consumer Duty into every policy | Shows good customer outcomes are designed in |
| Check every document against the business plan | Consistent files are assessed faster |
During the assessment, answer each question completely and on time, update every affected document together, and tell the case officer about any change before it happens.
Buckingham Capital Consulting has worked on UK payment and e-money authorisations since 2013. It obtained FCA API authorisation for Nexpay, Orbital, Oval and Global Send, and FCA EMI authorisation for Dzing Finance, Hryze and HFS. The firm reviews draft applications against each condition for authorisation, helps recruit experienced MLROs and compliance officers, builds the Consumer Duty framework, and introduces banks for safeguarding and operating accounts early in preparation.
Concerns about the key people, safeguarding and whether the firm has met the conditions for authorisation on the information provided. Most such concerns are raised as questions before any decision.
Yes. A new application can be made once the gaps are addressed, with a new application fee and a fresh assessment.
Yes. It issues a warning notice setting out its reasons, and the firm can make representations before a final decision notice.
A firm can refer the FCA's decision notice to the Upper Tribunal, which reviews the decision independently.
No. The FCA application fee is non-refundable whatever the outcome.
In practice yes. The FCA expects the business to be run from the UK, with the CEO and MLRO based here and able to evidence their right to work in the UK.
Buckingham Capital Consulting has obtained FCA EMI and payment institution licences for firms including Hryze, HFS, Nexpay and Orbital since 2013, and arranges the safeguarding and operating accounts alongside the application. The firm reviews each application against the FCA's conditions for authorisation before submission and manages the case officer's questions through to the decision.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.