PSR-FCA Consolidation: What Payment Services Firms Need to Know About the Regulatory Merger
What the HM Treasury consultation on folding the Payment Systems Regulator into the FCA means for payment services firms and how to prepare.
Read the guideGET AUTHORISED
Payment Services PermissionsAIS Permissions Support
Account information and payment initiation permissions under the Payment Services Regulations 2017.
AIS applications are often delayed because the submission does not explain the operating model with enough precision. MEMA helps firms seeking AIS permissions, AISP authorisation, or RAISP registration build applications that reflect the real product rather than a generic fintech narrative.
SERVICE OVERVIEW
AIS and PIS Permissions Support
Translate an account-information product into a permissions route the FCA can understand.
Open-banking firms, fintechs and providers using account information services. A precise perimeter, accountable operating model and evidence-led application.
Evidence we help you build
- Perimeter analysis
- Business plan architecture
- Outsourcing and oversight map
- Risk, conduct and customer-support controls
Typical timeframe
Ready to submit within 6 weeks, often sooner
Under the Payment Services Regulations 2017 the decision period is 3 months from a complete application, and 12 months at most.
Ideal for
- Open-banking firms
- Fintechs
- Providers using account information services
Which AIS question are you solving?
- Perimeter
- Application
- Third parties
- Customer journey
How MEMA helps you
- Perimeter Analysis
- Business Plan Architecture
- Third Party Oversight
- Customer & Conduct
- Operational Evidence
- Product Translation
Registered or authorised?
A firm providing only account information services is registered (a RAISP); payment initiation needs authorisation as a payment institution. The decision periods shown in the journey are those for an authorisation application.
Which AIS question are you solving?
Start with the part of the model that needs the most clarity.
Perimeter
Clarify AIS, AISP and registration implications.
Application
Build the business plan, governance and controls.
Third parties
Show oversight of providers and integrations.
Customer journey
Connect support, complaints and conduct controls.
The workstreams we cover
From perimeter analysis to a credible, complete application
Perimeter Analysis
- What the product actually does
- How payment account information is accessed
- Form of aggregation or processing
- Whether the service is properly characterised as AIS
Business Plan Architecture
- Permissions route and submission logic
- Business plan drafting
- Governance narratives
- Risk and control frameworks
Third Party Oversight
- Outsourcing arrangements
- Role of each external provider
- Retention of accountability
- Controls around relationships
Customer & Conduct
- Customer support arrangements
- Complaint handling design
- Consumer Duty positioning
- Vulnerability considerations
Operational Evidence
- Operational readiness evidence
- Data safeguards and security
- Customer journey documentation
- Compliance monitoring framework
Product Translation
- Translate innovation into regulatory language
- Preserve commercial logic of the business
- Explain layered integrations clearly
- Make the regulatory story coherent
How MEMA helps
Payment-services applications turn on the detail of the model: what data moves, who touches it, and which party is responsible when something fails.
- 1Establish the perimeterWe confirm which payment services you actually provide and therefore which permission profile the application needs.
- 2Structure the business planThe plan is built around the operating model — flows, volumes, counterparties and revenue — so the numbers and the narrative describe the same firm.
- 3Map outsourcing and oversightThird parties, technology providers and any reliance arrangements are documented with the oversight that has to sit over them.
- 4Build the control evidenceRisk, conduct, security and customer-support controls written to the standard the application is assessed against.
- 5Handle the case officerWe draft and pressure-test responses to information requests, which is where applications are most often delayed.
Key AIS Permissions Requirements
What the FCA expects, and the evidence behind it.
Regulated activity
Explain what information is accessed and how.
Outsourcing
Retain accountability for providers and integrations.
Governance
Define ownership, risk and control oversight.
Customer support
Build proportionate conduct and complaints arrangements.
What you will need to produce
- Perimeter analysis
- Business plan architecture
- Outsourcing and oversight map
- Risk, conduct and customer-support controls
Translate the product into a permissions route
The starting point is the service the customer actually receives, not the label used by the product team.
- Data and activity map
- Show what account information is accessed, how it is used and where the customer consents.
- Business plan
- Explain the product, customer journey, revenue model, governance and operational dependencies.
- Customer support
- Cover complaints, communications, vulnerability and how customers can understand and control the service.
Control third-party dependencies
Connectivity, identity and technology providers need clear ownership and oversight.
- Provider due diligence
- Assess critical providers, service levels, resilience and the firm's retained accountability.
- Risk and controls
- Design access, security, incident, continuity and change-management controls around the product.
- Application evidence
- Tie product diagrams and operating evidence back to the permissions and governance narrative.
Why AIS Is a Specialist Exercise
The challenge is not describing the technology. It is explaining the regulated activity in a way that is technically accurate, commercially intelligible, and aligned with the Payment Services Regulations.
Common Application Weaknesses
- Blurs product features with regulated services
- Underplays third party integration significance
- Fails to demonstrate compliance accountability
- Generic fintech narrative without regulatory precision
Strong Application Characteristics
- Clearly explains why the service is in scope
- Maps the customer journey with precision
- Demonstrates governance and oversight structure
- Shows the firm is ready, willing and organised
Why Firms Choose MEMA
Permissions work is not a form filling exercise. It is a test of whether the business can articulate its model and demonstrate an operating framework.
- Effective where products use layered integrations
- Explain the role of each third party clearly
- Demonstrate retention of regulatory accountability
- Built around real FCA expectations
- Practical governance around customer outcomes
- Technically precise and commercially aware
AIS, AISP and RAISP: The Landscape
Firms use these terms differently depending on stage, product maturity, and familiarity with the regime. The underlying need is usually the same.
AIS Permissions
Is the business in scope of Account Information Services regulation?
Authorised payment institution route
Account information provided alongside payment initiation or other payment services needs authorisation as a payment institution
RAISP Registration
Registration route for firms providing only account information services
A firm providing only account information services is registered (a RAISP); payment initiation needs authorisation as a payment institution. The decision periods shown in the journey are those for an authorisation application.
The AIS Permissions journey
The route from scoping your permissions to a decision. The FCA's part of it is fixed; the preparation before it is where applications are won or lost.
- 1Confirm which payment services you provideAccount information and payment initiation are separate services with separate permissions, and whether you act as principal or agent changes the answer again.
- Establish whether you provide AIS, PIS, or both
- Confirm principal, agent or distributor status
- Map what data and money move, and who touches them
- 2Build the model and oversight packThese applications turn on operating detail: the flows, the third parties, and who is accountable when a dependency fails.
- Build the plan around the actual flows and volumes
- Document outsourcing and the oversight over it
- Evidence security, conduct and customer-support controls
- 3Submit to FCASubmitted through the FCA's Connect portal with the application fee of £1,130 – £2,820.
- Complete submission through Connect
- Application fee paid at submission
- Case officer assigned by the FCA
- 4FCA reviewThe decision period under the Payment Services Regulations 2017 is 3 months from a complete application, and 12 months at most.
- Case officer raises questions on the submission
- Further information requests answered and evidenced
- Weak responses, not complexity, are the common cause of delay
- 5Permission grantedPermission is granted and the firm can carry on the regulated activity, subject to any requirements attached to it.
- Permission recorded on the Financial Services Register
- Any limitations or requirements confirmed
- Reporting and supervision obligations begin
Related Services
Firms seeking AIS permissions may also benefit from these:
Related FCA Guidance
Deeper reading on AIS/PIS permissions and open banking regulation.
Explore our other services
End-to-end support across the full regulatory lifecycle.
Frequently Asked Questions
Select a question to view the answer.
What is the difference between AIS, AISP and RAISP terminology?
Firms and advisers often use the terms differently in conversation, but in practice they are usually referring to the same core issue, namely whether the business is carrying on regulated account information services and requires the appropriate permissions or registration route.
Can MEMA help if the product uses third party providers?
Yes. Many AIS models rely on external providers for data connectivity, identity checks, or related functions. The key issue is that outsourcing or integration does not remove the applicant's regulatory accountability. The application needs to show how that accountability is retained and overseen.
Do you only help with drafting the business plan?
No. We support the wider application architecture, including perimeter analysis, control design, governance, operational readiness, customer support, complaints, and the narrative that ties the model together.
Can you help if we are not yet certain whether AIS is the correct route?
Yes. That is often the most important point to address first. We can help assess the model and determine whether AIS permissions are the right route or whether a different analysis is required.
Resolve the Permissions Question Early
If your product depends on account aggregation or payment account information, the permissions question should be resolved properly and early.
Phone: 0330 133 0811
Email: contact@memaconsultants.com