FCA penalty policy changes: what CP26/19 means for payment and e-money firms
In short: The FCA penalty policy changes proposed in CP26/19 (published 15 June 2026, consultation closes 10 August 2026) would amend the Decision Procedure and Penalties Manual (DEPP) for the first time on these thresholds since 2010. These are proposals, not yet in force. They would apply to payment and e-money firms and their senior managers, because the DEPP five-step penalty framework already applies to enforcement under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011, not only under FSMA.
For a payment institution or e-money institution under FCA investigation, how the regulator calculates a penalty matters more than almost anything else once the facts are established. That calculation is now under review for the first time on these thresholds since 2010. On 15 June 2026 the FCA opened CP26/19, Changes to our penalty and decision-making policies, proposing targeted amendments to the Decision Procedure and Penalties Manual (DEPP). Responses are due by 10 August 2026, and the proposals are not in force unless and until the FCA adopts them. The headline drivers are framed around market abuse and inflation, but the proposals would apply to the payments sector, and that is the part worth reading closely.
Key changes proposed
- The FCA last updated the key penalty thresholds in 2010. Source: FCA CP26/19.
- CP26/19 proposes six targeted DEPP changes; the consultation closes on 10 August 2026. Source: FCA CP26/19 consultation paper.
- The DEPP five-step penalty framework applies to enforcement under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011, not only under FSMA. Source: FCA Handbook, DEPP 6.
- There is no statutory cap on FCA financial penalties. Source: FSMA 2000, Part XIV.
- The FCA’s rules prohibit a firm from insuring against or indemnifying an individual’s penalty, so the individual-level changes fall on the individual. Source: FCA Handbook, GEN 6.1.
What the FCA penalty policy changes propose
The FCA proposes six targeted updates to the DEPP. For the most serious market-abuse cases it would raise the minimum penalty for individuals from £100,000 to £150,000, to account for inflation since 2010 (DEPP 6.5C). It would make explicit that it may increase penalties for deterrent effect, having regard to an individual’s income and assets. It would clarify how it treats deferred bonuses, pay and shares when it calculates an individual’s relevant income, in line with recent Upper Tribunal decisions (DEPP 6.5B). It would raise the income and capital thresholds for the serious-financial-hardship reduction to reflect living costs, and allow them to be updated over time. It would allow more flexibility over who takes settlement decisions in some cases. The sixth change is a consequential extension of the penalty framework to cryptoasset market abuse, reflecting the new powers under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102); that sits outside the payments focus of this analysis.
The market-abuse minimum is the change the wider press will lead on. It is not the payments story. Payment and e-money firms are rarely the actors in a market-abuse case. The changes that would bear on the payments sector are the deterrence uplift, the deferred-pay clarification, the hardship thresholds and the settlement-decision flexibility.
How the five-step penalty framework works, and where payment firms sit
The FCA calculates financial penalties under the five-step framework in DEPP 6.5. Step 1 disgorges any financial benefit derived from the breach. Step 2 sets a figure for the seriousness of the breach, by reference to relevant revenue for firms and relevant income for individuals. Step 3 adjusts that figure for aggravating and mitigating factors. Step 4 adjusts upwards for deterrence where the figure is otherwise insufficient. Step 5 applies the settlement discount under DEPP 6.7, which tapers from 30% to nil as proceedings progress. There is no statutory ceiling on the result.
The framework does not stop at FSMA-authorised conduct. The FCA’s Approach Document confirms that DEPP applies to enforcement of obligations under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011, with adjustments for the different statutory base. A payment institution fined for a safeguarding failure, and an e-money institution fined for an operational-resilience failure, both have their penalties set by the same five steps. That is why the proposed changes would apply to the payments sector even though their drivers are framed elsewhere.
| Area | Current DEPP position | What CP26/19 proposes |
|---|---|---|
| Market-abuse minimum for individuals (most serious cases) | £100,000, set in 2010 | Raise to £150,000 for inflation (DEPP 6.5C) |
| Deterrence uplift | Step 4 uplift where the penalty is insufficient to deter | Make explicit that the FCA may raise penalties for deterrent effect, having regard to income and assets |
| Relevant income (individuals) | Step 2 calculated on relevant income; treatment of deferred elements unsettled | Clarify treatment of deferred bonuses, pay and shares, in line with recent Tribunal decisions (DEPP 6.5B) |
| Serious financial hardship | Income and capital thresholds set in 2010 | Raise the thresholds for living costs and allow periodic updating |
| Settlement decision-makers | Fixed arrangements | More flexibility over who makes settlement decisions in some cases |
| Cryptoasset market abuse | Not covered | Extend the framework to cryptoasset market abuse (SI 2026/102); outside the payments focus |
What the FCA penalty policy changes mean for payment firms and senior managers
Four of the six proposals bear directly on payment and e-money firms and the people who run them. The deterrence uplift would make explicit something the FCA already does at Step 4, but would tie it to income and assets, which would raise the ceiling for a well-resourced firm or a well-paid individual where the seriousness figure looks small against their means. The deferred-pay clarification would operate at Step 2. For an individual in a non-market-abuse case, Step 2 is calculated on relevant income, and a senior manager’s package is increasingly weighted towards deferred bonuses and shares. Clarifying that those deferred elements count would tighten the base figure on which the whole penalty is built.
The raised hardship thresholds would give individuals a more realistic floor before a penalty is reduced for serious financial hardship, and would allow the FCA to keep that floor current. The settlement-decision flexibility would be procedural, but would affect how quickly a firm can reach a settled outcome and who it negotiates with. The individual-level changes would apply to senior managers under the Senior Managers and Certification Regime, and the FCA’s rules already prohibit a firm from insuring against or indemnifying an individual’s financial penalty (GEN 6.1 of the FCA Handbook). The deferred-pay and deterrence changes would therefore fall on the individual, not the balance sheet. If you are assessing how an investigation might resolve, our investigations and enforcement support page covers the points where early advice changes the outcome, and our FCA investigations and enforcement page covers the process from information notice to final notice. The proposals also connect to the FCA’s growing supervisory focus on payment firms, set out in the Bratby Law analysis of the FCA sanctions systems and controls findings.
Viewpoint
The most consequential of the FCA penalty policy changes for the payments sector is the least eye-catching one. In practice the relevant-income and deferred-pay mechanics in DEPP 6.5B are where the size of a senior-manager penalty is effectively determined, because the Step 2 base figure drives everything that follows it, and the deferred portion of a modern remuneration package is exactly where the argument has been. The FCA frames the clarification as following recent Tribunal decisions and the codification will make that ground harder to contest. The market-abuse minimum will draw the headlines. For a payment or e-money firm, the deferred-pay clarification would change the Step 2 base figure for any senior-manager investigation, and that figure drives the whole calculation. The consultation runs to 10 August 2026; the deferred-pay treatment is the part most worth a considered response.
Frequently asked questions
Do the CP26/19 changes apply to payment and e-money firms?
They would, if adopted. CP26/19 is a consultation, so the changes are proposed and not in force. The DEPP five-step penalty framework already applies to enforcement under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 through the FCA’s Approach Document, not only to FSMA-authorised conduct, so any change to how DEPP calculates penalties would change how penalties are calculated against payment and e-money firms and their senior managers.
Are these DEPP changes in force?
No. CP26/19 is a consultation. The proposals are not new rules and are not in force. The FCA will review responses, publish feedback, and decide whether to amend the DEPP. Responses are due by 10 August 2026.
Is there a maximum FCA penalty?
No. There is no statutory cap on FCA financial penalties. CP26/19 does not change that. It would change the calculation and the thresholds within the five-step framework, not a maximum, and disgorgement of benefit at Step 1 is recovered in full regardless of any settlement discount.
How do the changes affect senior managers personally?
The deferred-pay clarification, the deterrence uplift by income and assets, and the raised hardship thresholds would all operate at the individual level. The FCA’s rules prohibit a firm from insuring against or indemnifying an individual’s penalty (GEN 6.1 of the FCA Handbook), so a senior manager bears the effect of these changes personally rather than through the firm.
For advice on how CP26/19 affects your firm’s exposure or your senior managers’ position, or on responding to the consultation, contact Rob Bratby at Bratby Law. We advise payment institutions, e-money institutions and their senior managers on FCA and PSR regulation.
