AIS Permissions Support
AIS applications are often delayed because the submission does not explain the operating model with enough precision. MEMA helps firms seeking AIS permissions, AISP authorisation, or RAISP registration build applications that reflect the real product rather than a generic fintech narrative.
The AIS Permissions journey
The route from scoping your permissions to a decision. The FCA's part of it is fixed; the preparation before it is where applications are won or lost.
Confirm which payment services you provide
Account information and payment initiation are separate services with separate permissions, and whether you act as principal or agent changes the answer again.
- Establish whether you provide AIS, PIS, or both
- Confirm principal, agent or distributor status
- Map what data and money move, and who touches them
Build the model and oversight pack
These applications turn on operating detail: the flows, the third parties, and who is accountable when a dependency fails.
- Build the plan around the actual flows and volumes
- Document outsourcing and the oversight over it
- Evidence security, conduct and customer-support controls
Submit to FCA
Submitted through the FCA's Connect portal with the application fee of £1,130 – £2,820.
- Complete submission through Connect
- Application fee paid at submission
- Case officer assigned by the FCA
FCA review
The statutory determination period is 6–12 months — six months for a complete application, twelve if it is incomplete when submitted.
- Case officer raises questions on the submission
- Further information requests answered and evidenced
- Weak responses, not complexity, are the common cause of delay
Permission granted
Permission is granted and the firm can carry on the regulated activity, subject to any requirements attached to it.
- Permission recorded on the Financial Services Register
- Any limitations or requirements confirmed
- Reporting and supervision obligations begin
- What applies
- Payment services
- Where it sits in the rules
- PSRs 2017
- FCA determination
- 6–12 months
- FCA application fee
- £1,130 – £2,820
Statutory period from a complete application
Category 3 as a registered AISP, category 4 through an authorised payment institution
Which AIS question are you solving?
Start with the part of the model that needs the most clarity.
Perimeter
Clarify AIS, AISP and registration implications.
Application
Build the business plan, governance and controls.
Third parties
Show oversight of providers and integrations.
Customer journey
Connect support, complaints and conduct controls.
Key AIS Permissions Requirements
What the FCA expects, and the evidence behind it.
What you will need to produce
- Perimeter analysis
- Business plan architecture
- Outsourcing and oversight map
- Risk, conduct and customer-support controls
Translate the product into a permissions route
The starting point is the service the customer actually receives, not the label used by the product team.
Data and activity map
Show what account information is accessed, how it is used and where the customer consents.
Business plan
Explain the product, customer journey, revenue model, governance and operational dependencies.
Customer support
Cover complaints, communications, vulnerability and how customers can understand and control the service.
Control third-party dependencies
Connectivity, identity and technology providers need clear ownership and oversight.
Provider due diligence
Assess critical providers, service levels, resilience and the firm's retained accountability.
Risk and controls
Design access, security, incident, continuity and change-management controls around the product.
Application evidence
Tie product diagrams and operating evidence back to the permissions and governance narrative.
How MEMA helps
Payment-services applications turn on the detail of the model: what data moves, who touches it, and which party is responsible when something fails.
- 01
Establish the perimeter
We confirm which payment services you actually provide and therefore which permission profile the application needs.
- 02
Structure the business plan
The plan is built around the operating model — flows, volumes, counterparties and revenue — so the numbers and the narrative describe the same firm.
- 03
Map outsourcing and oversight
Third parties, technology providers and any reliance arrangements are documented with the oversight that has to sit over them.
- 04
Build the control evidence
Risk, conduct, security and customer-support controls written to the standard the application is assessed against.
- 05
Handle the case officer
We draft and pressure-test responses to information requests, which is where applications are most often delayed.
The workstreams we cover
From perimeter analysis to a credible, complete application
Perimeter Analysis
- What the product actually does
- How payment account information is accessed
- Form of aggregation or processing
- Whether the service is properly characterised as AIS
Business Plan Architecture
- Permissions route and submission logic
- Business plan drafting
- Governance narratives
- Risk and control frameworks
Third Party Oversight
- Outsourcing arrangements
- Role of each external provider
- Retention of accountability
- Controls around relationships
Customer & Conduct
- Customer support arrangements
- Complaint handling design
- Consumer Duty positioning
- Vulnerability considerations
Operational Evidence
- Operational readiness evidence
- Data safeguards and security
- Customer journey documentation
- Compliance monitoring framework
Product Translation
- Translate innovation into regulatory language
- Preserve commercial logic of the business
- Explain layered integrations clearly
- Make the regulatory story coherent
Why AIS Is a Specialist Exercise
The challenge is not describing the technology. It is explaining the regulated activity in a way that is technically accurate, commercially intelligible, and aligned with the Payment Services Regulations.
Common Application Weaknesses
- ✗Blurs product features with regulated services
- ✗Underplays third party integration significance
- ✗Fails to demonstrate compliance accountability
- ✗Generic fintech narrative without regulatory precision
Strong Application Characteristics
- Clearly explains why the service is in scope
- Maps the customer journey with precision
- Demonstrates governance and oversight structure
- Shows the firm is ready, willing and organised
Why Firms Choose MEMA
Permissions work is not a form filling exercise. It is a test of whether the business can articulate its model and demonstrate an operating framework.
RAISP registration secured for a data aggregation fintech
The firm aggregated payment account data, processed it for reporting and financial management purposes, and relied on third party providers for data connectivity and identity verification, all of which needed to be clearly articulated for a Registered Account Information Service Provider application.
The firm was registered as a RAISP.
AIS, AISP and RAISP: The Landscape
Firms use these terms differently depending on stage, product maturity, and familiarity with the regime. The underlying need is usually the same.
AIS Permissions
Is the business in scope of Account Information Services regulation?
AISP Authorisation
Full authorisation route for Account Information Service Providers
RAISP Registration
Registration route for firms meeting Registered AISP criteria
Related Services
Firms seeking AIS permissions may also benefit from these:
Related FCA Guidance
Deeper reading on AIS/PIS permissions and open banking regulation.
Payments Safeguarding
Safeguarding requirements for payment institutions under PSR 2017.
HandbookPERG: Perimeter Guidance
Understanding whether your service requires AIS, PIS, or both permissions.
ImplementationFCA Authorisation Preparation
Application preparation for payment services authorisation.
Frequently Asked Questions
Select a question to view the answer.
What is the difference between AIS, AISP and RAISP terminology?
Firms and advisers often use the terms differently in conversation, but in practice they are usually referring to the same core issue, namely whether the business is carrying on regulated account information services and requires the appropriate permissions or registration route.
Can MEMA help if the product uses third party providers?
Yes. Many AIS models rely on external providers for data connectivity, identity checks, or related functions. The key issue is that outsourcing or integration does not remove the applicant's regulatory accountability. The application needs to show how that accountability is retained and overseen.
Do you only help with drafting the business plan?
No. We support the wider application architecture, including perimeter analysis, control design, governance, operational readiness, customer support, complaints, and the narrative that ties the model together.
Can you help if we are not yet certain whether AIS is the correct route?
Yes. That is often the most important point to address first. We can help assess the model and determine whether AIS permissions are the right route or whether a different analysis is required.
Resolve the Permissions Question Early
If your product depends on account aggregation or payment account information, the permissions question should be resolved properly and early.
Phone: 0330 133 0811
Email: contact@memaconsultants.com