AI outsourcing: when payment firms must tell the FCA
In short: When an authorised payment or e-money institution intends to outsource an operational function relating to its payment services to an AI supplier, it must tell the Financial Conduct Authority (FCA) about the AI outsourcing in advance, and it must report any later change in the function or the supplier without undue delay. From 18 March 2027, new FCA rules also require notice when the firm enters into, or significantly changes, a material third party arrangement.
An authorised payment or e-money institution that buys a fraud-screening model or a customer-service chatbot from an AI supplier is responsible for anything the supplier does or fails to do, to the same extent as if it had expressly permitted it (regulation 36(2) of the PSRs 2017 and of the EMRs 2011). The FCA restated the point in AI in financial services: good practice and areas for improvement, published on 19 October 2026. In its examples of good practice, firms “used contractual requirements to obtain notice of, and further information about, significant model changes.” If an AI tool carries out an operational function relating to a payment or e-money firm’s payment services, the firm must tell the FCA when the supplier changes and, from 18 March 2027, when a material arrangement changes significantly. A firm that has contracted for notice of model changes will usually hear of them from the supplier before the change is made.
Key points
- An authorised payment institution must notify the FCA of its intention to outsource any operational function relating to its payment services, and of any change in the outsourced functions or the persons carrying them out. A new supplier means a new contract, so the advance notice applies again. Source: Payment Services Regulations 2017, regulation 25.
- An authorised e-money institution must do the same for functions relating to the issuance, distribution or redemption of e-money and to payment services. Source: Electronic Money Regulations 2011, regulation 26.
- From 18 March 2027, authorised payment and e-money institutions must give the FCA notice when entering into, or significantly changing, a material third party arrangement, and must submit an annual register when the FCA opens the window. Source: FCA PS26/2, SUP 15.19.6R and SUP 16.33.
- A change in third party or key sub-contractor may be a significant change to a material third party arrangement. Source: FCA FG26/4, paragraph 4.6.
- Where an authorised payment or e-money institution changes an important outsourcing arrangement without a new contract, the FCA expects it to consider whether the change is relevant to its authorisation conditions and so must be notified under regulation 37, which applies to a significant change. Source: FCA Approach Document (May 2026), paragraph 4.60.
| What the firm must notify | Today (PSRs 2017 regs 25 and 37; EMRs 2011 regs 26 and 37) | From 18 March 2027 (SUP 15.19) |
|---|---|---|
| Arrangements covered | Outsourcing of any operational function relating to payment services (and, for e-money institutions, e-money) | Material third party arrangements, whether or not they are outsourcing |
| When to notify a new arrangement | On the intention to enter into the contract | On entering into it; FCA guidance says before any internal or external commitment |
| Changes to notify | Any change in outsourced functions or in the persons carrying them out, without undue delay (reg 25(4); reg 26(4)); a significant change relevant to the authorisation conditions, without undue delay, or a substantial change not yet made, a reasonable period before it happens (reg 37) | Any significant change; FCA examples include a change of key sub-contractor |
| Further obligations | Five conditions for an important operational function, including no impairment of internal control and no delegation of senior management responsibility | Annual register of material arrangements (SUP 16.33) |
The FCA’s AI examples and the payments legislation
The FCA’s examples in the review do not create new requirements (section 1.2 of the review), and among the existing rules the review refers to are the Senior Managers and Certification Regime (SM&CR) and the Senior Management Arrangements, Systems and Controls sourcebook (SYSC). SM&CR does not apply to a firm authorised only under the payments legislation. It applies to authorised persons under the Financial Services and Markets Act 2000 (section 31), and a payment or e-money institution with no Part 4A permission is not one, as set out in SM&CR scope for payment firms. The SYSC 8 outsourcing rules are addressed to a common platform firm (SYSC 8.1.1), which these firms are not. Under FCA guidance, a payment service provider must nonetheless consider, where relevant, requirements under the Financial Services and Markets Act 2000, the FCA Handbook (especially SYSC 8) and other regimes, including the European Banking Authority’s Guidelines on outsourcing arrangements, and a firm outsourcing to the cloud or other third-party IT services should consider the FCA’s guidance FG16/5 (Approach Document, paragraph 18.11).
For these firms the binding outsourcing duties today are statutory: an authorised payment institution that outsources is subject to regulation 25 of the Payment Services Regulations 2017 (PSRs 2017), and an authorised e-money institution to regulation 26 of the Electronic Money Regulations 2011 (EMRs 2011). Chapter 15A of SYSC (operational resilience) applies more widely, to e-money institutions, payment institutions and registered account information service providers (SYSC 1.1A.1B). For a firm within that chapter, taking account of its dependence on AI models, including externally hosted ones, when it assesses how severe but plausible scenarios could affect its business services is a requirement (review, section 4.1, as amended on 20 October 2026). The wider resilience duties are set out on the operational resilience and DORA page.
Outsourcing to an AI supplier under regulation 25
An authorised payment institution must notify the FCA of its intention to enter into a contract under which another person will carry out any operational function relating to its provision of payment services (PSRs 2017, regulation 25(1)). On our reading, an AI supplier that screens the firm’s payment transactions for fraud is likely to carry out such a function, although fraud screening could be argued to be a security service or, if bought off the shelf, a standardised one within the FCA’s exclusions below; a chatbot may or may not, depending on whether it handles payment tasks. In the FCA’s view the duty does not extend to services that form no part of the payment services, such as legal advice, training or security, or to the purchase of standardised services (Approach Document, paragraph 4.59). Regulations 25 and 26 apply only to authorised institutions, not to small institutions, registered account information service providers or banks; regulation 37 applies to small institutions and registered account information service providers, and SYSC 8 to banks. Where the function is important, because a defect or failure in it would materially impair the firm’s compliance, its financial performance or the soundness or continuity of its payment services (regulation 25(3)), five conditions apply (regulation 25(2)). Among them, the outsourcing must not impair the firm’s internal control or the FCA’s ability to monitor and retrace its compliance, and senior management must not delegate responsibility for complying with the Regulations.
The firm must also notify the FCA without undue delay of “any change in outsourced functions or the persons to which functions are outsourced” (regulation 25(4)), and regulation 26(4) of the EMRs 2011 is in the same terms for e-money institutions. A change of AI supplier is a change in the persons to which the function is outsourced, and because the new supplier needs a new contract, the advance notice under regulation 25(1) applies as well. Whether the supplier’s own decision to retire one model and run the service on another is such a change is not settled by regulation 25(4), although it could be argued to be a change in the outsourced function. Where an authorised payment or e-money institution changes an important outsourcing arrangement without entering into a new contract, it will need to consider whether the change is relevant to its conditions for authorisation and so needs to be notified under regulation 37 (Approach Document, paragraph 4.60), although the FCA does not deal expressly with a change the supplier makes on its own. Regulation 37 of the PSRs 2017, and regulation 37 of the EMRs 2011, apply where it becomes apparent to the firm that there is, or is likely to be, a significant change in circumstances relevant to its authorisation conditions, and on our reading that test does not depend on who makes the change. The firm must then give details without undue delay or, for a substantial change that has not yet happened, a reasonable period before it takes place.
Notice of material third party arrangements from 18 March 2027
From 18 March 2027, an authorised payment institution or authorised e-money institution must give the FCA notice when entering into, or significantly changing, a material third party arrangement (SUP 15.19.6R). The FCA published the rules in PS26/2 on 18 March 2026. An arrangement is material where a disruption or failure in the service could cause intolerable levels of harm to the firm’s clients, pose a risk to the soundness, stability, resilience, confidence or integrity of the UK financial system, or cast serious doubt on the firm’s ability to satisfy the threshold conditions or meet its obligations under the Principles or SYSC 15A. A third party arrangement is any arrangement under which a person provides a product or service to the firm, and AI and machine learning models are an example of a non-outsourcing arrangement (FG26/4, paragraph 3.7), so a model the firm licenses and runs itself is within the rules if it meets the materiality test, which its listing as an example does not settle (FG26/4, paragraph 3.8). No notice is needed where the provider is a group company that has not sub-contracted outside the group (SUP 15.19.7R), and no notice under SUP 15.19 is needed from a firm whose registered office (or, if it has none, head office) is outside the UK (SUP 15.19.3R). The FCA says in guidance (SUP 15.19.9G) that the firm should give notice before it makes any internal or external commitment.
A significant change is one that materially alters the nature, scale or complexity of the risks in the arrangement. Changes that may meet that test include a change in how the third party stores, processes or accesses sensitive data and a change in third party or key sub-contractor (FG26/4, paragraph 4.6).
What the notice duties mean for AI supply contracts
In Case study T a firm had to redesign a product built around one model, with no viable alternative, when that model was retired. Some firms relied on vendors’ assurances without challenging or testing them (FCA review, areas for improvement).
A firm is best placed to meet these duties where its contract requires the supplier to give advance notice of any change of model or model developer, of any new sub-contractor and of any move in data location, in time for the firm to notify the FCA before it commits, and to provide the information and cooperation the firm needs to test the supplier’s assurances and to carry out an exit and substitution plan. Supply terms in regulated sectors are covered on the commercial and technology contracts page.
Frequently asked questions
Must an authorised payment institution tell the FCA before using an AI supplier?
Where the AI supplier will carry out an operational function relating to the firm’s payment services, yes. Under regulation 25(1) of the Payment Services Regulations 2017, an authorised payment institution must notify the FCA of its intention to enter into the outsourcing contract. Under regulation 26(1) of the Electronic Money Regulations 2011, an authorised e-money institution must do the same, including for functions relating to e-money.
Must an authorised payment or e-money institution notify the FCA when its AI supplier changes model?
A change of supplier must be notified without undue delay under regulation 25(4) of the PSRs 2017 or regulation 26(4) of the EMRs 2011 and, because the new supplier needs a new contract, in advance under regulation 25(1) or 26(1). Where the model changes under an unchanged contract, the firm must give the FCA details under regulation 37 if the change is significant and relevant to its authorisation conditions. A firm that changes an important outsourcing arrangement without a new contract needs to consider whether the change is relevant to its authorisation conditions (Approach Document, paragraph 4.60).
Does the SM&CR apply to payment and e-money institutions using AI?
No, not where the firm is authorised only under the Payment Services Regulations 2017 or the Electronic Money Regulations 2011 and holds no Part 4A permission under the Financial Services and Markets Act 2000. Instead, under regulation 25(2) of the PSRs 2017 and regulation 26(2) of the EMRs 2011, outsourcing an important function must not result in any delegation by senior management of responsibility for compliance.
What changes for payments firms on 18 March 2027?
From 18 March 2027, under SUP 15.19.6R, an authorised payment institution or authorised e-money institution must give the FCA notice when entering into, or significantly changing, a material third party arrangement. It must also submit an annual register of those arrangements under SUP 16.33 once the FCA opens the submission window. The rules cover non-outsourcing arrangements as well as outsourcing.
Did the FCA’s October 2026 AI review create new rules?
No. The FCA’s examples in AI in financial services: good practice and areas for improvement, published on 19 October 2026, do not create new requirements (section 1.2 of the review). The FCA uses them to show how firms apply the existing rules, including the Consumer Duty, senior management arrangements and operational resilience.
For advice on AI supply contracts and outsourcing notifications for payment and e-money institutions, contact Rob Bratby at Bratby Law.
