UK Payment Institution Licence: How to Get FCA Authorisation in 2026

What an authorised payment institution is

An authorised payment institution (API) is a company authorised by the Financial Conduct Authority (FCA) under the Payment Services Regulations 2017 (the PSRs) to provide payment services in the UK. It is the full payments licence: there is no cap on transaction volumes and it can cover all eight regulated payment services, from money remittance to card acquiring and open banking.

An API moves money; it does not store value. It cannot issue electronic money (a prepaid balance held for the customer to spend later), which needs an electronic money institution (EMI) licence, and it cannot take deposits or lend on its own account, which are banking activities. An API may grant credit only where it is closely linked to a payment and repaid within 12 months.

How the API compares with the other UK payment routes

The UK has four main routes for payment firms. Choosing the right one at the start avoids a second application later. Our comparison of the API, SPI, RAISP and EMI routes sets out the choice in more detail.

Who needs API authorisation

A firm needs to be authorised or registered before it provides a payment service in the UK as a regular business. Providing payment services without authorisation is a criminal offence under the PSRs, so a firm cannot trade while its application is assessed. It can build its product, hire its team and open bank relationships in the meantime.

The API is the right route when any of the following applies:

• the business will exceed an average of €3 million of payment transactions a month, the ceiling for a small payment institution;
• it will provide payment initiation services (paying directly from a customer's bank account through open banking), which a small payment institution cannot do;
• it needs the credibility of full authorisation with banks, card schemes and enterprise customers; or
• its forecasts show it will outgrow the small payment institution regime within two to three years. Applying once for full authorisation is usually more efficient than registering and reapplying.

Some activities fall outside the PSRs altogether. The main exclusions are the limited network exclusion (for example, a store card usable only in one retailer's shops), the commercial agent exclusion and the electronic communications exclusion. A firm relying on the limited network or electronic communications exclusion must notify the FCA once it passes the thresholds in the regulations.

A foreign group can own a UK API. The UK company must be a genuine UK business, with its head office and registered office in the UK, real decision-making in the UK, and directors who run the regulated business day to day.

The eight payment services and the permissions to request

Schedule 1 of the PSRs lists eight payment services, labelled (a) to (h). The application names the exact services the firm will provide. The FCA expects every permission to be supported by the business plan, the flow of funds and the controls, so a firm should request only what it will use in its first two to three years.

1. (a) Cash placed on a payment account, with the operations needed to run the account.
2. (b) Cash withdrawn from a payment account, with the operations needed to run the account.
3. (c) Executing payment transactions from a payment account: direct debits, card payments and credit transfers, including standing orders.
4. (d) Executing payment transactions covered by a credit line, the same transactions funded by credit granted to the customer.
5. (e) Issuing payment instruments or acquiring payment transactions: issuing payment cards, or acquiring card payments for merchants.
6. (f) Money remittance: receiving funds from a payer to transfer to a payee, without opening a payment account in the payer's name. This covers most international money transfer businesses.
7. (g) Payment initiation services: initiating a payment from a customer's account held at another provider, at the customer's request.
8. (h) Account information services: giving the customer a consolidated view of their accounts held at other providers.

The services chosen set the initial capital, the own funds method, whether safeguarding applies and the depth of the FCA's review. A remittance business with two corridors and a card acquirer serving thousands of merchants are both APIs, but they are assessed very differently.

Initial capital requirements

Initial capital is the minimum paid-up capital the firm must hold at authorisation. The PSRs set it in euros in Schedule 3. Where a firm requests services in more than one band, the highest amount applies.

Capital must be fully paid up and held in a UK bank account in the firm's name before authorisation. Firms hold the sterling equivalent, with a margin for exchange rate movements. Firms providing payment initiation or account information services must also hold professional indemnity insurance or a comparable guarantee, sized under the European Banking Authority guidelines the FCA applies.

Ongoing own funds: Methods A, B and C

After authorisation, an API must hold own funds (capital that absorbs losses) at all times equal to the higher of its initial capital and a calculated requirement. The FCA tells each firm which of three methods to use and may direct an amount up to 20% higher or lower than the result. Firms that provide only payment initiation or account information services hold their initial capital only and do not run the calculation.

The scaling factor is 0.5 for a firm authorised only for money remittance and 1 for a firm providing any of services (a) to (e). Under Method C the result cannot fall below 80% of the average relevant income indicator over the previous three years.

Worked example

A card acquirer processes €60 million of payments in its first full year. Its monthly payment volume is €5 million, so Method B gives 4% of €5 million, or €200,000, multiplied by a scaling factor of 1. Its own funds requirement is €200,000, because that is higher than its €125,000 initial capital. A remittance-only firm with the same volume would apply a scaling factor of 0.5, giving €100,000. The financial forecasts should show own funds rising with volumes in this way, with headroom above the requirement.

Safeguarding under CASS 15

Safeguarding protects customers' money if a payment firm becomes insolvent. An API that receives funds for payment transactions must keep them separate from its own money, either in a segregated safeguarding account at a bank or by covering them with an insurance policy or bank guarantee. Firms providing only payment initiation or account information services do not hold customer funds and are outside the regime.

The FCA's supplementary safeguarding rules, set out in policy statement PS25/12 and the new CASS 15 chapter of the FCA Handbook, have applied since 7 May 2026. Every applicant now shows CASS 15 compliance in its application. The main requirements are:

• a single director or senior manager responsible for safeguarding compliance, reporting to the board;
• a written safeguarding policy, a method for calculating the amount to be safeguarded, and documented due diligence on each safeguarding bank or insurer;
• acknowledgement letters from each safeguarding bank confirming the account holds customer funds;
• internal and external reconciliations at least once each reconciliation day (business days on which the relevant markets are open), with a documented process for resolving any discrepancy promptly;
• a monthly safeguarding return to the FCA within 15 business days of each month end;
• an annual safeguarding audit by an external auditor, with the report delivered to the FCA within six months of the end of the first audit period and within four months for later periods. Firms that have not been required to safeguard more than £100,000 at any time in the previous 53 weeks are exempt; and
• a resolution pack: the records an insolvency practitioner would need to return funds to customers, kept up to date and retrievable within 48 hours.

The safeguarding account is often the longest lead item in the project, so banks should be approached early. Our guide to CASS 15 covers each rule in detail.

People, governance and UK substance

The FCA must be satisfied that the firm is run by people of good repute with the knowledge and experience to manage a payments business. Each director, and each person responsible for managing the payment services, completes the PSD Individual form on the FCA's Connect system. Senior managers and certification regime approvals (SMF functions) do not apply to payment institutions; the FCA assesses these individuals through the PSD Individual form instead.

The team the FCA expects to see

• A chief executive or managing director who runs the business from the UK and can explain the product, risks and controls.
• A finance lead who owns the capital, own funds and safeguarding calculations.
• A money laundering reporting officer (MLRO), the person who receives internal suspicious activity reports and decides whether to report to the National Crime Agency, with real experience of the firm's customer types and countries.
• A compliance officer and, for larger firms, a risk lead, a technology lead and an operations lead.
• An independent non-executive director, increasingly expected where the firm is scaling or serves consumers.

Anyone who will hold 10% or more of the shares or voting rights, directly or indirectly, is a controller and is assessed for fitness and propriety, including the source of the funds they invest. Directors and people with significant control must also have verified their identity with Companies House, which has been mandatory for new appointments since 18 November 2025.

Outsourcing parts of compliance or operations is acceptable, but responsibility stays with the API. The board must understand and oversee what is outsourced, and the UK entity must keep enough knowledge to challenge its providers.

Financial crime controls

Every API is supervised for anti-money laundering under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (the MLRs). The FCA expects a working framework at authorisation, tailored to the firm's customers, countries, products and volumes. A framework copied from a template is identified quickly in review.

• A business-wide risk assessment covering customers, products, delivery channels and geographies.
• Customer due diligence for individuals and businesses, including beneficial ownership checks, with enhanced due diligence for higher-risk customers and countries.
• Sanctions screening against the UK consolidated list and, where relevant, other lists the firm's partners require.
• Automated transaction monitoring sized for the forecast volumes, with documented rules and alert handling.
• Internal suspicious activity reporting to the MLRO and onward reporting to the National Crime Agency.
• Information on the payer and payee carried with transfers, as the funds transfer rules in the MLRs require.
• Training, record keeping for five years and an annual MLRO report to the board.

Operational resilience, security and outsourcing

Payment firms rely on third parties for onboarding, ledgers, payment execution, screening, cloud hosting and customer support. That is acceptable, provided the API shows how it selected each provider, how it monitors them and how it would exit the arrangement. Contracts for important functions should give the FCA and the firm's auditors access rights.

• Operational resilience: the FCA's operational resilience rules (PS21/3) have applied in full since 31 March 2025. The firm identifies its important business services, sets impact tolerances (the maximum disruption it will accept) and tests that it can stay within them.
• Security and incidents: the PSRs require a security policy, a framework for operational and security risks, and prompt reporting of major incidents to the FCA.
• New incident and third-party reporting: under PS26/2, published on 18 March 2026, new rules on operational incident reporting and material third-party arrangements apply from 18 March 2027. Authorised payment institutions will notify the FCA of material third-party arrangements and submit an annual register of them.
• Strong customer authentication: firms that hold payment accounts or initiate payments apply strong customer authentication (two independent checks, such as a device and a fingerprint) under the FCA's technical standards.

Consumer Duty, complaints and fraud reimbursement

The Consumer Duty has applied since 31 July 2023 to firms serving retail customers, including small businesses in some cases. It requires the firm to deliver good outcomes on products, price and value, customer understanding and customer support, and the application should show how this is built into the product. A firm serving only larger corporate customers should record why it is outside scope.

APIs must handle complaints under the FCA's dispute resolution rules (DISP), respond within the payment services deadlines, and refer customers to the Financial Ombudsman Service. New complaints reporting rules from PS25/19 apply from 1 January 2027, with the first reporting period running to 30 June 2027.

Firms that send Faster Payments are part of the mandatory reimbursement scheme for authorised push payment (APP) fraud, where a customer is tricked into sending money to a fraudster. It has applied since 7 October 2024, with the cost shared equally between the sending and receiving firm and a maximum reimbursement of £85,000 per claim.

FCA application fees and total cost

The FCA application fee is paid by card through Connect when the application is submitted. It is non-refundable, and an application submitted without the correct fee is rejected without assessment. The figures below are from the FCA's application fees page, last updated on 13 July 2026.

The application fee is a small part of the total. The real budget covers initial capital and own funds, the people above, safeguarding and operating accounts, transaction monitoring and screening systems, professional indemnity insurance where required, the safeguarding audit and annual accounts. After authorisation the firm also pays annual FCA periodic fees and the Financial Ombudsman Service levy, which the FCA sets each year. Our guide to what an FCA PI or EMI licence costs in 2026 breaks the budget down.

The application, step by step

The application is made through the FCA's Connect system. The FCA allocates a case officer within a maximum of 20 working days and rejects, without assessing it, any submission that leaves questions unanswered or relies on generic template policies.

1. Confirm the route. Rule out the small payment institution, EMI and exclusion routes, and record why the API fits.
2. Fix the permissions. Map each product to the exact Schedule 1 services.
3. Set up the UK company and team. Incorporate, appoint directors, complete Companies House identity checks and confirm the controllers.
4. Map the flow of funds. Show the customer, the firm, every bank and payment partner, each account and the point at which the firm's obligation to the customer ends. This drives the permissions and the safeguarding analysis.
5. Write the business plan and three-year forecasts. Cover customers, products, volumes, pricing, countries, currencies, staffing, technology and partners, with capital and own funds calculations.
6. Design safeguarding under CASS 15. Choose the method, approach safeguarding banks and write the policy, reconciliation process and resolution pack.
7. Build the financial crime framework. Risk assessment, policies, procedures and the systems that will run them.
8. Complete the operational framework. Security, incident management, business continuity, outsourcing, complaints, wind-down planning and regulatory reporting.
9. Submit through Connect with the correct fee, the PSD Individual forms and the controller forms.
10. Answer the FCA's questions. Keep every answer consistent with the original model and tell the FCA about any material change.
11. Prepare for day one. Have people, accounts, systems and controls ready to run on the day of authorisation.

What the application pack contains

• Regulatory business plan and programme of operations
• Three-year financial forecasts, evidence of paid-up capital and the own funds calculation
• Flow of funds diagrams and safeguarding policy, with bank correspondence
• Business-wide financial crime risk assessment and policies
• Governance structure, organisation chart and board terms of reference
• Security policy, operational and security risk framework, business continuity and outsourcing policies
• Complaints procedure, Consumer Duty assessment and wind-down plan
• PSD Individual forms for directors and managers, and controller forms

How long authorisation takes

The PSRs require the FCA to decide a complete application within 3 months of receiving it, and any application within 12 months. In 2025/26 the FCA determined 93.5% of payment services authorisation applications within these statutory deadlines, according to its published operating service metrics.

In practice the clock starts once the application is complete, and the FCA's questions usually arrive in rounds. The firm plans API authorisations at 6 to 8 months from submission, with 4 to 8 weeks of preparation before that. The single largest factor within the applicant's control is how complete and consistent the pack is on the day it is submitted.

What the FCA looks for in a strong application

Applications that move quickly share the same features. The FCA looks for a settled business model, documents that describe the same business throughout, and people who can explain it in interview.

• A settled model. The product, corridors and partners are fixed before drafting begins, so the plan does not change during assessment.
• Permissions that match the flow of funds. Every service requested appears in the money flows, and every money flow is covered by a permission.
• Real UK management. Directors who run the business from the UK and answer questions on risk and controls without notes.
• Resources that match the forecasts. Compliance, operations and monitoring capacity that grows with the projected volumes.
• Safeguarding designed for CASS 15. A policy, reconciliation process and resolution pack written for the current rules, with a safeguarding bank identified.
• Risk-based financial crime controls. A risk assessment specific to the firm's customers and countries, with systems in place to run it.
• Consistent figures. The same volumes, entities and assumptions across the business plan, forecasts and policies.

Where the FCA has material concerns it usually invites the firm to withdraw rather than issuing a refusal. A firm that withdraws can reapply once the points raised are addressed.

Buying an existing API instead

Acquiring an authorised payment institution can be quicker than a new application in some cases, but the buyer acquires a regulated company, not a licence that can be detached and moved. Anyone acquiring 10% or more of an API needs the FCA's approval before completion through a change in control application, which the FCA assesses within up to 60 working days once complete.

The buyer should review the target's safeguarding, financial crime controls, complaints, regulatory returns, capital position and any open supervisory matters, and check that its permissions fit the new business model. A change to the model after acquisition may itself need a variation of permission.

After authorisation

Authorisation is the start of supervision. The FCA expects the controls described in the application to be running from day one and reviews them through regulatory returns, information requests and, where needed, a skilled person review. The main recurring obligations are set out below; our guide to FCA compliance for UK payment institutions covers each one.

An API can also appoint agents to provide payment services on its behalf, once each agent is registered with the FCA, and can later add permissions through a variation.

Serving EU customers and the UK reform agenda

UK payment institutions lost their EU passporting rights on 31 December 2020. A UK API can serve customers abroad only where the local law of each country allows it, and to serve EU customers at scale a group needs a separate EU-authorised payment institution, commonly in Lithuania, Ireland or the Netherlands. Our guide to EU payment institution licensing compares the options.

In the UK, HM Treasury consulted from 14 July to 6 October 2026 on modernising payment services regulation. The main proposals are to move detailed technical rules from the PSRs and the Electronic Money Regulations into the FCA Handbook, to restructure the list of payment activities (combining the cash placement and withdrawal services, combining execution with and without a credit line, and splitting card issuing from acquiring), and to bring UK-issued stablecoins used for payments within the payments regime. The Government also asked about authentication and liability for payments made by AI agents, and about stronger senior manager accountability at payment firms and EMIs.

The Government will make the changes through secondary legislation and has said it will set out implementation details after the consultation. Until then, applications are made and assessed under the current PSRs, and a firm authorised now carries its permissions into the new framework.

How Buckingham Capital Consulting helps

The firm prepares and manages FCA payment institution applications from the first route analysis through to authorisation and the first year of supervision. That covers the business plan and forecasts, the flow of funds, CASS 15 safeguarding, the financial crime framework, governance documents, preparation of directors for FCA interview and the response to every FCA question. It also arranges safeguarding and operating accounts alongside the application, so the firm can trade on the day it is authorised. Details of the service are on our UK payment institution licence page.

Frequently asked questions

References

1. FCA: Application fees for EMIs and payment institutions
2. FCA: Payment institution applicants
3. The Payment Services Regulations 2017 (legislation.gov.uk)
4. FCA PS25/12: Changes to the safeguarding regime for payments and e-money firms
5. FCA: Safeguarding requirements for payment institutions and e-money institutions
6. FCA operating service metrics 2025/26
7. FCA PS26/2: Operational incident and third party reporting
8. HM Treasury: Modernising payment services regulation (consultation, July 2026)

Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.

This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.