Payment Services
FCA Authorisation
Specialist regulatory support for payment institutions, e-money issuers, money remittance providers, and payment service providers under PSRs 2017.
Payment Services Regulatory Landscape
The payment services sector encompasses money remittance, payment initiation services (PIS), account information services (AIS), e-money issuance, and merchant acquiring under the Payment Services Regulations 2017.
FCA regulation has intensified following PSD2 implementation, with enhanced focus on safeguarding client funds, strong customer authentication (SCA), operational resilience, and APP fraud prevention.
Successfully obtaining authorisation requires demonstrating robust systems and controls, adequate safeguarding arrangements, comprehensive AML procedures, and credible business models that satisfy the FCA's rigorous standards.
Typical Services
- Money remittance and cross-border transfers
- E-money issuance and prepaid cards
- Payment initiation services (Open Banking)
- Account information services (AIS)
- Merchant acquiring and card payment processing
- Currency exchange and FX services
How We Support Payment Firms
Required FCA Permissions & Authorisations
Payment service providers require specific permissions under PSRs 2017 and EMRs 2011.
Money Remittance
Executing payment transactions where funds are received from a payer for onward transmission to a payee.
- Safeguarding arrangements
- AML/CTF controls
- Transaction monitoring
- Sanctions screening
E-Money Issuance
Issuing electronic money (prepaid cards, digital wallets) that can be used for payments.
- Initial capital: €350,000
- Safeguarding of e-money
- Redemption procedures
- Float management
Payment Initiation Services (PIS)
Initiating payments from customer bank accounts via Open Banking APIs.
- Professional indemnity insurance or comparable guarantee
- Secure API integration
- Strong customer authentication
- Liability framework
Account Information Services (AIS)
Accessing and aggregating customer account data from multiple banks.
- Data protection policies
- Customer consent management
- API security
- Third-party oversight
Acquiring of Payment Transactions
Merchant acquiring and card payment acceptance services.
- PCI DSS compliance
- Merchant due diligence
- Chargeback management
- Settlement procedures
Execution of Payment Transactions
Processing payment orders including direct debits and credit transfers.
- Payment system access
- Transaction reporting
- Reconciliation systems
- Operational resilience
Permissions & scope
Which regulated activities the firm will carry on, and the exact permissions that follow from them. Everything downstream is scoped to this, so a permission asked for loosely is a business plan and a set of controls built against the wrong thing.
Business model
What the firm does, who for, and how it earns. The FCA tests whether the model is viable and whether the permissions being requested actually match it, rather than reading the two documents separately.
Governance & SM&CR
Who is accountable for what, and whether they are fit and proper for it. Senior manager responsibilities have to be mapped to named people and evidenced, not asserted in a paragraph.
Policies & controls
The procedures that make the model work in practice, and evidence they are followed rather than filed. A policy the firm cannot show operating is the most common gap at the gateway.
Financial resources
Capital, projections and an orderly wind-down. The figures have to agree with the business model rather than sit beside it, and the wind-down plan has to be costed.
Key Regulatory Requirements
Payment institutions must demonstrate compliance with comprehensive PSRs 2017 frameworks.
Safeguarding Client Funds
- Segregated safeguarding accounts with authorised credit institutions
- Daily reconciliation of relevant funds
- Safeguarding policy and procedures documentation
- Alternative: insurance or guarantee arrangements
- Audit trail for safeguarding calculations
- Monthly safeguarding reporting to FCA
Anti-Money Laundering & Sanctions
- MLRO appointment and governance structure
- Customer due diligence (CDD) and enhanced due diligence (EDD)
- Transaction monitoring and suspicious activity reporting
- Real-time sanctions screening (OFSI, UN, EU lists)
- PEP screening and adverse media checks
- Annual AML/CTF risk assessment
Operational & IT Resilience
- Incident management and business continuity plans
- Disaster recovery and backup systems
- Outsourcing and third-party risk management
- Cyber security framework and penetration testing
- API security and authentication protocols
- Payment system resilience requirements
Strong Customer Authentication (SCA)
- Two-factor authentication for payment initiation
- Dynamic linking of transaction amounts
- SCA exemption management (low-value, trusted beneficiaries)
- Authentication method security standards
- Fraud rate monitoring for exemptions
- Customer authentication data protection
APP Fraud & Consumer Protection
- Authorised Push Payment (APP) fraud prevention controls
- Confirmation of Payee (CoP) implementation
- Customer warnings and friction for high-risk payments
- Effective refund policies and dispute resolution
- APP fraud reimbursement under the Payment Systems Regulator's mandatory reimbursement requirement (the Government plans to consolidate the PSR into the FCA)
- Fraud analytics and intelligence sharing
Financial Resources & Capital
- Initial capital: €20,000, €50,000 or €125,000 for payment institutions depending on services; €350,000 for e-money institutions
- Own funds calculation (Tier 1 capital)
- Professional indemnity insurance or comparable guarantee for PIS/AIS, with the amount calculated under the EBA guidelines
- Annual capital adequacy return (FSA056 for payment institutions, FIN060 for e-money institutions)
- Financial projections for 3 years
- Wind-down plan and contingency capital
Related Services
Expert support for payment service providers
FCA Authorisation
Navigate the FCA application process with expert guidance from ex-FCA regulators.
Learn more →SMCR Implementation
Implement the Senior Managers & Certification Regime with confidence.
Learn more →Financial Crime Prevention
Robust AML, CTF, and fraud prevention frameworks for regulated firms.
Learn more →Compliance Outsourcing
Outsource your compliance function to experienced regulatory professionals.
Learn more →Ready to Get Authorised?
Speak with our payment services regulatory specialists to discuss your FCA authorisation.
Phone: 0330 133 0811
Email: contact@memaconsultants.com
Free safeguarding and resolution pack
For payment and e-money firms only: daily CASS 15 reconciliations, a shortfall log, a resolution pack index, a monthly return working paper and an audit tracker, with worked examples.
Explore the safeguarding packFree operational resilience pack
Payment and e-money institutions are in scope of SYSC 15A: important business services, impact tolerances, resource mapping, scenario tests, a vulnerability tracker and the self-assessment, with a worked example. It also logs incidents and material third parties for the FCA reporting rules that start on 18 March 2027.
Explore the operational resilience packFree guides for payment firms
Choosing a route, or checking whether you need authorisation at all: the small payment institution limits compared with full authorisation, and how marketplaces and platforms decide whether their funds flows need payment services authorisation.
Free regulatory reporting calendar
Enter your FRN and accounting reference date and we look your firm up on the FCA Register, suggest the RegData returns that are likely to apply to a payment or e-money institution, and show period ends and due dates for the next 12 months.
Build your reporting calendar