Payments Regulation
Specialist advice for payment firms, fintechs and infrastructure operators
A firm that holds customer funds, executes payment transactions or issues electronic money will usually need FCA authorisation or registration, unless an exclusion or exemption applies, and must then meet the conduct and safeguarding requirements that come with it. Those requirements are set out in the Payment Services Regulations 2017 and the Electronic Money Regulations 2011, and the FCA and the PSR supervise them. Bratby Law advises payment institutions, e-money issuers, fintechs and infrastructure operators on authorisation and licensing, safeguarding, Consumer Duty, open banking and variable recurring payments, scheme governance, e-money, operational resilience and DORA, and FCA enforcement. Rob Bratby leads every matter himself.
A head of compliance or general counsel at a payment or e-money institution needs specialist support on safeguarding, the PSRs 2017, strong customer authentication and the Consumer Duty. A founder preparing an FCA authorisation application needs the permissions, the safeguarding model and the governance settled before the application goes in. The corporate team of a large UK or US law firm acting on a payments acquisition or investment needs the FCA and PSR workstream covered by a specialist, white-label or under our own name. HM Treasury’s proposed transfer of the PSR’s functions to the FCA and the treatment of payments initiated by autonomous agents are both unsettled, and a firm designing a payments product now has to plan for either outcome.
The regulatory framework
A payment institution or an e-money issuer must obtain authorisation, or registration as a small institution, from the FCA. An authorised firm must then meet the conduct requirements in the Payment Services Regulations 2017, safeguard relevant funds under regulation 23, and meet the operational resilience requirements the FCA imposes under SYSC 15A, which applies to payment institutions, electronic money institutions and registered account information service providers. An e-money issuer carries a parallel safeguarding duty under regulation 20 of the Electronic Money Regulations 2011, and discharges it by one of the methods in regulations 21 and 22, segregation or insurance or guarantee. Where a payments firm carries on retail market business, it must act to deliver good outcomes for retail customers, which includes providing fair value, a duty the FCA enforces under PRIN 2A as the Consumer Duty.
The Payment Systems Regulator regulates designated payment systems under the Financial Services (Banking Reform) Act 2013, and may give directions to, and impose requirements on, their operators, infrastructure providers and payment service providers under sections 54 to 57 of that Act, including on access, interoperability and governance. A participant must meet the directions and requirements that apply to it alongside its FCA obligations. A firm that supplies services to authorised persons, payment institutions, e-money institutions or financial market infrastructure entities may be designated by HM Treasury as a critical third party under Chapter 3C of Part 18 of the Financial Services and Markets Act 2000, inserted by the Financial Services and Markets Act 2023. A payment firm is more often a customer of a critical third party than a critical third party itself, and must manage that dependency within its own operational resilience framework.
The Financial Services and Markets Bill, introduced in the House of Lords on 19 May 2026, completed its Lords stages in September 2026 and is now before the House of Commons. It would abolish the PSR and transfer its functions to the FCA. Since 7 May 2026 a safeguarding institution, meaning a firm required to safeguard relevant funds under regulation 20 of the EMRs 2011 or regulation 23 of the PSRs 2017, must perform an internal safeguarding reconciliation no less than once each reconciliation day under CASS 15, file a monthly safeguarding return under SUP 16.14A and maintain a resolution pack under CASS 10A, and an electronic money institution or an authorised payment institution authorised for payment services other than payment initiation or account information services must also appoint an auditor and obtain an annual safeguarding report under SUP 3A unless it is exempt; the FCA set those requirements in its supplementary safeguarding regime (PS25/12), which prescribes how a firm discharges the statutory safeguarding duty rather than adding to it. A payment service provider within the mandatory reimbursement regime may be required to reimburse eligible victims of authorised push payment fraud, subject to the scheme’s scope, exceptions, excess and cap. A firm relying on open banking access must plan for the move from the interim framework to a statutory regime, and for commercial variable recurring payments being implemented under it.
What a payment firm must do at each stage
A payment firm’s obligations change at each stage of its life, from the perimeter question before launch to an FCA enforcement investigation after it.
Why payments regulation matters
A payment firm can build, operate and compete only within its regulatory position. Payment firms compete on speed, cost and user experience, inside limits that the regulatory requirements set. A firm must revisit its authorisation with every new product, market entry and partnership. A private equity investor buying into a payments business needs the regulatory risk profile, the cost of implementing the regime and the sustainability of the operating model.
Regulator, operator and advisor experience
The Regulator’s Perspective
Rob Bratby spent a year on secondment to Oftel from Baker and McKenzie. He draws on that year inside a regulator in dealing with the FCA and the PSR: what a regulator treats as a priority, how it assesses compliance, and when a firm should push back.
The Operator’s Perspective
Rob Bratby holds a fractional general counsel appointment in the payments sector. He works day to day on scheme governance, safeguarding and regulator engagement inside the business.
The Advisor’s Perspective
Rob Bratby has advised on regulated sectors for more than 30 years, in private practice at UK and US law firms, in-house at UK telecoms operators and, since 2020, at Bratby Law. His payments work covers authorisation, safeguarding, scheme governance, open banking and enforcement, for payment firms, fintechs and infrastructure operators.
Payments regulation credentials
Rob Bratby has advised on financial and communications regulation for more than 30 years, at UK and US law firms, in senior in-house roles at UK telecoms operators and, since 2020, at Bratby Law, including a year on secondment to Oftel. He leads the firm’s payments work across authorisation, safeguarding, Consumer Duty, open banking, scheme governance, e-money, operational resilience and enforcement, and holds a fractional general counsel appointment with the UK Payments Initiative. He handles every matter himself.
Our own use of AI in research and drafting is described on How we use AI.
A specialist boutique compared with a full-service practice
Bratby Law acts directly for payment firms, and alongside the financial regulatory and corporate teams of large UK and US law firms when a deal or instruction turns on payments regulation.
| Factor | Bratby Law | Alongside a law firm’s team |
|---|---|---|
| Regulator experience | Rob holds fractional general counsel appointments and spent a year on secondment to Oftel. | The instructing firm gains a view of how payments regulation operates inside a live business. |
| Payments focus | Rob’s payments work covers the PSRs 2017, the EMRs 2011, safeguarding, scheme governance, the Consumer Duty and operational resilience. | The firm keeps its broad banking, insurance, markets and corporate coverage; we add depth on payments. |
| Senior partner delivery | Rob Bratby, Managing Partner, advises on every matter himself and signs off all written advice. | The instructing team keeps conduct of the matter; one senior specialist covers the payments workstream and reports to the lead partner. |
| Cost and engagement flexibility | We charge a fixed fee for the initial regulatory review, and offer a fractional general counsel arrangement for ongoing payments regulatory support. | We act white-label or under our own name, and the instructing firm keeps the client relationship. |
| Operator experience | Rob works day to day on scheme governance, rule-making and regulator engagement through his fractional general counsel roles. | The instructing firm’s advisory team gains operator experience. |
Recent payments regulation insights
- Energy smart data and potential consumer detriment
- NFC access conduct requirement: what the CMA’s iPhone proposal means for payment initiation
- AI outsourcing: when payment firms must tell the FCA
Related insight
The hidden architecture of UK open banking: how the directory, dispute management system and API standards built under the Retail Banking Market Investigation Order 2017 have become the UK’s durable competitive advantage.
How we work
Bratby Law advises clients directly on specific matters as direct legal advisors, supports other legal teams as specialist co-counsel, and takes longer-term retained appointments as fractional general counsel. In each case a partner advises and signs off the work.
Specialist payments regulation advice
Frequently asked questions about payments regulation
Who regulates payment services in the UK?
The FCA regulates payment institutions and e-money issuers, and sets the conduct and safeguarding standards they must meet. The PSR regulates designated payment systems, and may give directions to and impose requirements on their participants, including on access and governance. The Bank of England has macroprudential oversight of payments infrastructure. HM Treasury sets the policy framework. The Financial Services and Markets Bill, introduced in the House of Lords on 19 May 2026, completed its Lords stages in September 2026 and is now before the House of Commons. It would transfer the PSR’s functions to the FCA. Nothing in the Bill takes effect until it receives Royal Assent and the relevant provisions are commenced.
Do I need FCA authorisation to provide payment services?
You need authorisation or registration if what you do falls within the definition of a payment service in the Payment Services Regulations 2017 and no exclusion applies. Payment services include money remittance, payment accounts, payment execution, credit transfers, direct debits and payment cards. Working out whether your service is on that list is the perimeter question, and it comes before every other regulatory decision.
What is the difference between the FCA and the PSR?
The FCA regulates individual payment institutions, which is firm-level regulation. The PSR regulates payment systems themselves, which is system-level regulation. A payment firm answers to the FCA for conduct and safeguarding, and to the PSR as well if it operates or participates in a designated payment system. The Financial Services and Markets Bill [HL], now before the House of Commons, would abolish the PSR and transfer its functions to the FCA.
What safeguarding requirements apply to payment firms?
A payment institution must safeguard relevant funds under regulation 23 of the Payment Services Regulations 2017, and an e-money issuer under regulation 20 of the Electronic Money Regulations 2011, using one of the methods in regulations 21 and 22. Either way the firm must segregate relevant funds in a designated account or cover them by insurance or guarantee. Since 7 May 2026 a safeguarding institution must also perform an internal safeguarding reconciliation no less than once each reconciliation day (CASS 15.8.19R), file a monthly safeguarding return within 15 business days of the end of the month (SUP 16.14A.3R), maintain a resolution pack retrievable within 48 hours (CASS 10A.1.3R, CASS 10A.1.7R) and allocate responsibility for safeguarding oversight to a single director or senior manager (CASS 15.2.4R). An electronic money institution, and an authorised payment institution authorised for payment services other than payment initiation or account information services, must also appoint an auditor and obtain an annual safeguarding report prepared as a reasonable assurance engagement (SUP 3A.1.1R, SUP 3A.3, SUP 3A.9.1R), unless it has not been required to safeguard more than £100,000 of relevant funds under the relevant funds regime at any time for a period of at least 53 weeks (SUP 3A.1.1R(2)). The FCA set those operational requirements in its supplementary safeguarding regime (PS25/12); they prescribe how a firm discharges the statutory duty and do not add to it.
What is a commercial variable recurring payment?
A commercial variable recurring payment lets a consumer authorise a merchant to vary the amount of a recurring payment without giving fresh Strong Customer Authentication for each one. The FCA recorded the launch of the first commercial VRP scheme, operated by the UK Payments Initiative, in a statement published on 2 June 2026. A firm joins voluntarily under the interim framework. Whether participation becomes compulsory under the statutory regime has not been settled.
Does DORA apply to UK payment firms?
The Digital Operational Resilience Act is EU legislation and does not apply directly to UK payment institutions. A UK payment institution meets the UK operational resilience requirements instead. Separately, HM Treasury may designate a firm's material suppliers as critical third parties under Chapter 3C of Part 18 of the Financial Services and Markets Act 2000, which brings those suppliers within direct regulatory oversight. Neither regime is an implementation of DORA. A UK group with an EU-regulated entity or establishment should assess whether DORA applies to that entity and its ICT arrangements. Having EU customers does not by itself bring a UK firm within DORA.
What does Consumer Duty mean for payment firms?
Where a payment firm carries on retail market business, it must act in good faith towards retail customers, avoid causing them foreseeable harm, and support them in pursuing their financial objectives. That applies to product design, pricing, communications and dispute resolution. The FCA enforces the duty under PRIN 2A.
What is the regulatory perimeter for payment services?
The regulatory perimeter is the boundary between regulated and unregulated activity. A firm that receives customer funds may require FCA authorisation as a payment institution or an e-money issuer, or may be unregulated where the customer funds are held by a regulated firm on its behalf. Settling that question comes before any authorisation strategy.
When should I engage a specialist payments lawyer?
Early. Payment regulation affects product design, governance, operational capability and transaction structure, so take advice before those decisions are fixed and design for compliance from the start. The usual points are an FCA authorisation application, a product launch, a change to the safeguarding model, scheme participation and private equity due diligence.
Also see
Payments regulation overlaps with Telecoms Regulation, Data Protection, Transactions and Digital Regulation. For the engagement models, see How We Work; for commentary on current regulatory developments, see Insights, including Agentic AI and Payments: Can an AI Agent Consent to a Payment?, on the regulatory questions raised when an autonomous agent initiates a payment.
Some clients retain Rob Bratby as their fractional general counsel for longer-term regulatory support.