On 14 July 2026 HM Treasury published a consultation, "Modernising payment services regulation", on the future of the rules for payment institutions (PIs), electronic money institutions (EMIs) and the wider payments market. It covers traditional payments, stablecoins and tokenised money, open banking and payments made by AI agents. The consultation ran for 12 weeks and closed on 6 October 2026.
Nothing has changed yet for firms. The Payment Services Regulations 2017 (the PSRs) and the Electronic Money Regulations 2011 (the EMRs) remain in force, and FCA permissions and obligations are unchanged. The Government will consider the responses, set out implementation details and make the changes through secondary legislation, followed by FCA rule-making. The direction is clear enough, however, to shape products planned for the next 12 to 24 months.
| Milestone | Date | Status |
|---|---|---|
| Consultation published | 14 July 2026 | Complete |
| Consultation closed | 6 October 2026 | Complete |
| Open banking statutory instrument under the Data (Use and Access) Act 2025 | Due by end of 2026 | Pending |
| Government response and implementation plan | Not yet scheduled | Pending |
| Secondary legislation and FCA rules | To follow the response | Pending |
The Government's aim is to regulate the economic activity a firm performs, whatever the technology, rather than build a separate regime for each new form of payment. The main proposals and questions are:
| Area | Proposed direction |
|---|---|
| Structure of the law | Keep the perimeter, key definitions and customer rights in legislation; move detailed technical requirements into FCA rules |
| Payment activities | Restructure the list of regulated payment services |
| Stablecoins and tokenised money | Bring UK-issued qualifying stablecoins used for payments into the payments framework |
| Existing PIs and EMIs | Require a variation of permission before offering tokenised payment services |
| Open banking | A long-term framework under the Data (Use and Access) Act 2025, with a new access right for variable recurring payments |
| AI agents | Review consent, authentication and liability for agent-initiated payments |
| Senior management | Consider enhanced senior manager accountability at payment and e-money firms |
| Financial inclusion | Protect access for people who cannot or do not want to pay digitally |
The consultation does not propose merging the PI and EMI authorisation regimes, and it does not propose a statutory trust over safeguarded funds. Safeguarding continues under the FCA's CASS 15 rules, which have applied since 7 May 2026.
Payment technology has moved faster than the legislation. Firms now combine bank transfers, stablecoins, blockchain settlement, embedded finance, open banking and automation in a single product. A customer may see one payment while the firm's model involves payment services, stablecoins, custody, exchange and safeguarding.
Consider a firm that receives pounds from a UK customer, settles value overseas in a stablecoin and pays the beneficiary in local currency. Under today's rules that journey can engage the PSRs, the money laundering rules and the cryptoasset regime at different points. The Government wants a framework that treats traditional and tokenised payments consistently. For firms, the lesson is that regulatory analysis starts from the customer journey and the flow of funds, not from how the firm describes itself.
The Government is considering keeping core matters, such as the regulatory perimeter, key definitions including electronic money, and the rights and protections of customers and firms, in legislation. Detailed, technical requirements would move into FCA rules, which can be updated more quickly. The consultation asks where that line should be drawn.
A rulebook that the FCA can update faster is more flexible, but not necessarily lighter. Firms will need to follow FCA consultations and Handbook changes as closely as they follow legislation today.
Table 1 of the consultation proposes changes to the eight payment services in Schedule 1 of the PSRs. If adopted, existing permissions would need to be mapped to the new activity list.
The split of issuing from acquiring is the change most likely to matter in practice, because card issuers and merchant acquirers would hold distinct permissions. Firms should keep an accurate record of which services they provide today so that any transition is straightforward.
The Government intends to regulate the use of certain stablecoins for payments and let traditional and tokenised payment services operate side by side. Under the proposal, only UK-issued qualifying stablecoins, or stablecoins from a jurisdiction HM Treasury recognises as having an equivalent regime, would be treated as money-like and brought within the payments perimeter.
Two models can look alike but be analysed differently: a stablecoin used only for the firm's internal settlement, and a product where customers acquire, hold, transfer and redeem the stablecoin. The questions are who receives customer funds, who controls the token at each stage, whether the customer is exposed to the cryptoasset, who executes the payment and whether custody or exchange takes place. Separately, the FCA's new cryptoasset regime opened its application window on 30 September 2026, running to 28 February 2027, and commences on 25 October 2027. Our article on stablecoin payments regulation in the UK works through the permissions.
The consultation proposes that authorised and registered firms obtain a variation of permission from the FCA before providing payment services using tokenised money, because tokenised versions can carry different risks. An existing authorisation would not be a blanket permission for every new payment technology.
Relevant cases include stablecoin settlement, blockchain-based cross-border payments, tokenised treasury services, programmable payments and mixed fiat and digital asset flows. Before launch, a firm should check whether the activity sits within its current permissions, whether any further regulated activity arises, and whether its safeguarding, financial crime, operational and governance arrangements still fit. That analysis is cheapest before the technical and contractual structure is fixed. Our guide to FCA variation of permission applications explains the process.
Without careful drafting, one transaction could engage both the payments regime and the new cryptoasset regime. The Government does not want firms to hold two sets of permissions for the same activity. Its approach is to bring UK-issued qualifying stablecoins used for payments into the payments framework and remove overlapping cryptoasset intermediary requirements where appropriate.
Not every stablecoin business becomes a payment firm. Custody, exchange, trading and broader digital asset services may still need cryptoasset authorisation. Payment and e-money firms should settle where their product sits on the boundary before choosing infrastructure partners, drafting customer contracts or fixing the operating model.
The consultation asks whether the payments framework suits smart contracts and programmable payments, where the terms of a payment, such as when it is released or how it is split, are written into code that executes automatically. It also asks whether conduct of business and prudential requirements need adjusting for tokenised payment services.
For firms, the practical points are who is the payment service provider when code releases funds, when the customer's consent is given and how it can be withdrawn, and how safeguarding applies to funds locked in a contract. Products that rely on programmable release, such as escrow for marketplaces or conditional supplier payments, should document these points now so the analysis can be updated as rules are made.
Open banking rests today on the PSRs, the Competition and Markets Authority's order and industry standards. The Government proposes two tracks: modernising the open banking provisions in the PSRs, and creating a new long-term framework under the Data (Use and Access) Act 2025 with powers delegated to the FCA. The FCA reports that more than 16 million people and businesses used open banking in 2025, making more than 29 million payments a month on average.
For payment initiation and account information providers, banks, EMIs and PIs, account-to-account payments could compete with cards and direct debits for subscriptions, recurring merchant payments and business payments. The open banking statutory instrument is due by the end of 2026.
Agentic payments are payments made by AI systems acting with some autonomy for a consumer or business: comparing suppliers, choosing products, initiating purchases, approving transactions within limits or managing recurring spend. The PSRs predate them. The consultation asks what changes are needed to authentication, consent and liability for unauthorised transactions, and the FCA said in its 2026 priorities that it is considering with the Treasury whether rules are needed for agentic AI payments.
The open questions are when consent is given, when authentication should happen, what happens if an agent exceeds its mandate and who bears the loss. Describing software as an AI agent does not take the payment activity outside regulation: a platform that initiates payments, holds customer money or performs another payment service needs the corresponding permission. Our article on AI agents and payments regulation covers the design questions in detail.
The consultation identifies financial crime as a key risk in the payments and e-money sector and asks whether enhanced senior manager accountability at payment and e-money firms would improve oversight, together with its costs and benefits, including for international competitiveness. No such regime has been introduced: PIs and EMIs authorised under the PSRs and EMRs remain outside the senior managers and certification regime.
The direction is consistent with the FCA's own expectations. Boards should already be able to show who owns safeguarding, financial crime, compliance and other material risks, how they are monitored and how weaknesses are escalated. CASS 15 already requires one director or senior manager to be responsible for safeguarding compliance.
Beyond structure and technology, the consultation asks three questions about risk and access:
Responses to these questions will shape the FCA's supervisory focus as much as the legislation. Firms with strong financial crime controls, clear accountability and good outcomes data are best placed whichever amendments are chosen.
Alongside the consultation, the Payment Systems Regulator's functions are being consolidated into the FCA, ahead of legislation where possible, under a revised memorandum of understanding between the FCA, the Bank of England, the PRA and the Payment Systems Regulator. Rules such as the authorised push payment fraud reimbursement scheme continue to apply during the transition.
The consultation also asks which international developments should inform UK reform, including the EU's new payment services directive (PSD3) and Payment Services Regulation, and the UK's continued participation in the Single Euro Payments Area. The UK is not bound by the EU package, and UK firms have had no passporting rights since 31 December 2020. Our guide to PSD3 and the EU Payment Services Regulation covers the EU side.
No redesign is needed because the consultation was published. Most proposals need legislation and FCA rule-making first. The reforms should, however, feature in planning for any firm that intends to:
The priority is to map each planned product against current permissions and identify gaps before significant investment. Current obligations continue in full: safeguarding under CASS 15, with reconciliations each reconciliation day, the monthly REP027 return and the annual audit, is an immediate FCA priority, and new incident and third-party reporting applies from 18 March 2027.
For any product planned for launch in the next 12 to 24 months, five steps give a clear view of what the current rules require and what the reforms may change.
Recording this analysis in a short regulatory memorandum gives the board a basis for its decision and gives the FCA a clear explanation if it asks.
Applications for authorised payment institution or EMI status continue under the current framework. The consultation has not changed the process or created new permissions. Applicants planning stablecoins, tokenised settlement, open banking or AI-driven payments should describe both the current model and the planned direction.
The application should explain how funds move, which entity performs each activity, who contracts with the customer, how safeguarding works and which third parties are relied on. Activities and fund flows come first, and the permission follows from them: an EMI is not automatically right for every digital account, and a PI permission does not automatically cover every new value transfer method. Our guides to the UK payment institution licence and the UK EMI licence set out the current requirements.
The reforms are a planning matter for boards, not only for compliance teams. Six checks give a board a clear view of its exposure:
The firm advises fintechs, PIs and EMIs on structuring new payment products under the current rules and the proposed framework: perimeter analysis for stablecoin, open banking and AI-driven models, variation of permission applications, new FCA applications, CASS 15 safeguarding and financial crime frameworks. Early work on entity roles, fund flows and permissions avoids unnecessary applications, launch delays and restructuring later.
Not yet. The PSRs and the Electronic Money Regulations 2011 remain in force. HM Treasury consulted from 14 July to 6 October 2026 on a modernised framework, which will be made through secondary legislation and FCA rules.
No date has been set. The Government will set out implementation details after considering the consultation responses, so firms comply with the current regime until new requirements formally take effect.
No. Existing permissions remain valid. The consultation proposes that firms obtain a variation of permission before providing payment services using tokenised money once the new framework applies.
The July 2026 consultation does not propose merging the two authorisation regimes. It proposes restructuring the list of payment activities and moving detailed rules into the FCA Handbook.
The Government proposes bringing UK-issued qualifying stablecoins, and those from recognised equivalent regimes, into the payments framework when used for payments. Custody, dealing or exchange involving other cryptoassets would stay under the cryptoasset regime.
It asks what changes are needed to authentication, consent and liability for unauthorised transactions when AI agents initiate payments. No rules have been proposed yet.
Applications continue under the current regime. The application should reflect any planned stablecoin, open banking or AI-driven activity, with permissions following the actual activities and fund flows.
Buckingham Capital Consulting has obtained FCA payment and e-money licences for firms including Nexpay, Oval, Dzing Finance and Hryze, and a variation of permission for Moneliq, since 2013. It advises payment and e-money firms on structuring new products under the current rules and the proposed UK framework.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.