Payments Regulation
Specialist advice for payment firms, fintechs and infrastructure operators
A firm that holds customer funds, executes payment transactions or issues electronic money must obtain FCA authorisation and meet the conduct and safeguarding requirements that come with it. Those requirements are set out in the Payment Services Regulations 2017 and the Electronic Money Regulations 2011, and the FCA and the PSR supervise them. Bratby Law advises payment institutions, e-money issuers, fintechs and infrastructure operators on authorisation and licensing, safeguarding, Consumer Duty, open banking and variable recurring payments, scheme governance, e-money, operational resilience and DORA, and FCA enforcement. Rob Bratby leads every matter himself.
A head of compliance or general counsel at a payment or e-money institution needs specialist support on safeguarding, the PSRs 2017, strong customer authentication and the Consumer Duty. A founder preparing an FCA authorisation application needs the permissions, the safeguarding model and the governance settled before the application goes in. A City firm running a wider corporate or regulatory instruction needs specialist payments co-counsel alongside it. HM Treasury’s proposed transfer of the PSR’s functions to the FCA and the treatment of payments initiated by autonomous agents are both unsettled, and a firm designing a payments product now has to plan for either outcome.
The regulatory framework
A payment institution or an e-money issuer must obtain authorisation from the FCA. It must then meet the conduct requirements in the Payment Services Regulations 2017, safeguard relevant funds under regulation 23, and meet the operational resilience requirements the FCA imposes under SYSC 15A. An e-money issuer carries a parallel safeguarding duty under regulation 20 of the Electronic Money Regulations 2011, and discharges it by one of the methods in regulations 21 and 22, segregation or insurance or guarantee. A payments firm selling to retail customers must deliver fair value and put customer interests at the centre of its decision-making, a duty the FCA enforces under PRIN 2A as the Consumer Duty.
The Payment Systems Regulator regulates designated payment systems under the Financial Services (Banking Reform) Act 2013, and sets the access rules, the interoperability requirements and the governance standards that apply to their operators and participants. A participant must meet those rules alongside its FCA obligations. A payment institution must also identify, measure and manage operational resilience across its business. A firm that supplies services to authorised persons, payment institutions, e-money institutions or financial market infrastructure entities may be designated by HM Treasury as a critical third party under Chapter 3C of Part 18 of the Financial Services and Markets Act 2000, inserted by the Financial Services and Markets Act 2023. A payment firm is more often a customer of a critical third party than a critical third party itself, and must manage that dependency within its own operational resilience framework.
The Financial Services and Markets Bill [HL], introduced on 19 May 2026 and at report stage in the House of Lords, would abolish the PSR and transfer its functions to the FCA. Since 7 May 2026 an authorised payment institution or e-money issuer must perform an internal safeguarding reconciliation no less than once each reconciliation day under CASS 15, file a monthly safeguarding return under SUP 16.14A, appoint an auditor and obtain an annual safeguarding report under SUP 3A unless it is exempt, and maintain a resolution pack under CASS 10A; the FCA set those requirements in its supplementary safeguarding regime (PS25/12), which prescribes how a firm discharges the statutory safeguarding duty rather than adding to it. A payment firm within the mandatory reimbursement regime must compensate victims of authorised push payment fraud. A firm relying on open banking access must plan for the move from the interim framework to a statutory regime, and for commercial variable recurring payments being implemented under it.
What a payment firm must do at each stage
A payment firm’s obligations change at each stage of its life, from the perimeter question before launch to an FCA enforcement investigation after it.
Why payments regulation matters
A payment firm’s regulatory position determines what it can build, how it operates and how it competes. Firms compete on speed, cost and user experience, and the regulatory requirements set the limits within which they do so. Authorisation is not a single event: every new product, market entry and partnership raises the question again. A private equity investor buying into a payments business needs the regulatory risk profile, the cost of implementing the regime and the sustainability of the operating model, which is a different exercise from reading the compliance manual.
Regulator, operator and advisor experience
The Regulator’s Perspective
Rob Bratby spent a year on secondment to Oftel from Baker and McKenzie. That year inside a regulator informs how he engages with the FCA and the PSR: what a regulator treats as a priority, how it assesses compliance, and when a firm should push back.
The Operator’s Perspective
Rob Bratby holds a fractional general counsel appointment in the payments sector. That is day-to-day work on scheme governance, safeguarding and regulator engagement, rather than a view from outside the business.
The Advisor’s Perspective
Rob Bratby has advised on regulated sectors for 30 years at UK and US City law firms. His payments work covers authorisation, safeguarding, scheme governance, open banking and enforcement, for payment firms, fintechs and infrastructure operators.
Payments regulation credentials
Rob Bratby has advised on financial and communications regulation for 30 years at UK and US City law firms, including a year on secondment to Oftel and senior in-house roles at UK telecoms operators. He leads the firm’s payments work across authorisation, safeguarding, Consumer Duty, open banking, scheme governance, e-money, operational resilience and enforcement, and holds a fractional general counsel appointment with the UK Payments Initiative. He handles every matter himself.
A specialist boutique compared with a full-service practice
Most general financial regulatory practices treat payments as one part of a wider financial services offering.
| Factor | Bratby Law | Full-service financial regulatory practices |
|---|---|---|
| Regulator experience | Fractional general counsel appointments and a year on secondment to Oftel. | Advisory experience only, with limited exposure to how payments regulation operates inside a live business. |
| Payments focus | A payments practice covering the PSRs 2017, the EMRs 2011, safeguarding, scheme governance, the Consumer Duty and operational resilience. | Payments sits within a broad financial regulatory practice covering banking, insurance, wealth management and markets. |
| Senior partner delivery | Rob Bratby, Managing Partner, advises on every matter. No delegation. | Work typically staffed with associates, with senior partner involvement limited and expensive. |
| Cost and engagement flexibility | Boutique rates. A fractional general counsel arrangement is available for ongoing payments regulatory support. | Full-service billing rates, with payments advice priced as part of a broader financial services mandate. |
| Operator experience | Day-to-day work on scheme governance, rule-making and regulator engagement through fractional general counsel roles. | No operator roles; advisory experience only. |
Recent payments regulation insights
- FCA high-growth firms: what the 2026 review repeats from 2023
- Bank of England AI Consortium: the June 2026 minutes and UK AI rules already in force
- Specific Direction 17: what the Confirmation of Payee consultation proposes
Related insight
The hidden architecture of UK open banking: how the directory, dispute management system and API standards built under the Retail Banking Market Investigation Order 2017 have become the UK’s durable competitive advantage.
How we work
Bratby Law works with clients in three ways: as direct legal advisers on specific matters, as specialist co-counsel supporting other legal teams, and as fractional general counsel on a longer-term retained basis. Each model delivers partner-level input without delegation.
Specialist payments regulation advice
Frequently asked questions about payments regulation
Who regulates payment services in the UK?
The FCA regulates payment institutions and e-money issuers, and sets the conduct and safeguarding standards they must meet. The PSR regulates designated payment systems, and sets the access and governance rules for them. The Bank of England has macroprudential oversight of payments infrastructure. HM Treasury sets the policy framework. The Financial Services and Markets Bill [HL], introduced on 19 May 2026 and at report stage in the House of Lords, would transfer the PSR’s functions to the FCA. Nothing in the Bill takes effect until it receives Royal Assent and the relevant provisions are commenced.
Do I need FCA authorisation to provide payment services?
You need authorisation if what you do falls within the definition of a payment service in the Payment Services Regulations 2017. Payment services include money remittance, payment accounts, payment execution, credit transfers, direct debits and payment cards. Working out whether your service is on that list is the perimeter question, and it comes before every other regulatory decision.
What is the difference between the FCA and the PSR?
The FCA regulates individual payment institutions, which is firm-level regulation. The PSR regulates payment systems themselves, which is system-level regulation. A payment firm answers to the FCA for conduct and safeguarding, and to the PSR as well if it operates or participates in a designated payment system. HM Treasury has proposed consolidating the two regulators’ functions, subject to legislation.
What safeguarding requirements apply to payment firms?
A payment institution must safeguard relevant funds under regulation 23 of the Payment Services Regulations 2017, and an e-money issuer under regulation 20 of the Electronic Money Regulations 2011, using one of the methods in regulations 21 and 22. Either way the firm must segregate relevant funds in a designated account or cover them by insurance or guarantee. Since 7 May 2026 it must also perform an internal safeguarding reconciliation no less than once each reconciliation day (CASS 15.8.19R), file a monthly safeguarding return within 15 business days of the end of the month (SUP 16.14A.3R), appoint an auditor and obtain an annual safeguarding report prepared as a reasonable assurance engagement (SUP 3A.3, SUP 3A.9.1R), unless it has not been required to safeguard more than £100,000 of relevant funds under the relevant funds regime at any time for a period of at least 53 weeks (SUP 3A.1.1R(2)), maintain a resolution pack retrievable within 48 hours (CASS 10A.1.3R, CASS 10A.1.7R) and allocate responsibility for safeguarding oversight to a single director or senior manager (CASS 15.2.4R). The FCA set those operational requirements in its supplementary safeguarding regime (PS25/12); they prescribe how a firm discharges the statutory duty and do not add to it.
What is a commercial variable recurring payment?
A commercial variable recurring payment lets a consumer authorise a merchant to vary the amount of a recurring payment without giving fresh Strong Customer Authentication for each one. The FCA recorded the launch of the first commercial VRP scheme, operated by the UK Payments Initiative, in a statement published on 2 June 2026. A firm joins voluntarily under the interim framework. Whether participation becomes compulsory under the statutory regime has not been settled.
Does DORA apply to UK payment firms?
The Digital Operational Resilience Act is EU legislation and does not apply directly to UK payment institutions. A UK payment institution meets the UK operational resilience requirements instead. Separately, HM Treasury may designate a firm's material suppliers as critical third parties under Chapter 3C of Part 18 of the Financial Services and Markets Act 2000, which brings those suppliers within direct regulatory oversight. Neither regime is an implementation of DORA. A UK firm with EU operations or EU clients may have to comply with DORA for that part of its business.
What does Consumer Duty mean for payment firms?
A payment firm selling to retail customers must act in good faith towards them, avoid causing them foreseeable harm, and support them in pursuing their financial objectives. That applies to product design, pricing, communications and dispute resolution. The FCA enforces the duty under PRIN 2A.
What is the regulatory perimeter for payment services?
The regulatory perimeter is the boundary between regulated and unregulated activity. A firm that receives customer funds may require FCA authorisation as a payment institution or an e-money issuer, or may be unregulated where the customer funds are held by a regulated firm on its behalf. Settling that question comes before any authorisation strategy.
When should I engage a specialist payments lawyer?
Early. Payment regulation bears on product design, governance, operational capability and transaction structure, so taking advice before those decisions are fixed lets you design for compliance. The usual points are an FCA authorisation application, a product launch, a change to the safeguarding model, scheme participation and private equity due diligence.
Also see
Payments regulation overlaps with Telecoms Regulation, Data Protection, Transactions and Digital Regulation, and each of those pages covers the overlap from its own starting point. How We Work sets out the engagement models, and Insights carries commentary on current regulatory developments, including Agentic AI and Payments: Can an AI Agent Consent to a Payment?, on the regulatory questions raised when an autonomous agent initiates a payment.
Some clients retain Rob Bratby as their fractional general counsel for longer-term regulatory support.