FCA enforcement against payment firms - regulatory oversight network

FCA Investigations and Enforcement

The FCA may fine a payment firm, censure it publicly, cancel its authorisation or prosecute it. A payment institution, an electronic money institution and a participant in a designated payment system each answer to a different statutory regime, and each regime carries its own powers, procedures and appeal route. A firm that is both an authorised payment institution and a scheme participant answers to the FCA and the Payment Systems Regulator at the same time. HM Treasury has proposed transferring the Payment Systems Regulator's functions to the FCA, and until that happens both sets of powers remain in force.

Statutory powers of the FCA and the PSR over payment firms

The FCA enforces against payment service providers under three overlapping statutory regimes, each granting distinct powers and each applying to different categories of firm and conduct.

Under the Financial Services and Markets Act 2000 (FSMA 2000) the FCA may require information and documents (Part XI, sections 165-171), impose a financial penalty or publish a statement of censure (Part XIV, sections 205-206), and seek an injunction or a restitution order through the courts (Part XXV, sections 380-384). Those powers apply to an FSMA-authorised person. An authorised payment institution (API) and an authorised electronic money institution (AEMI) are authorised under regulation 6 of the PSRs 2017 and regulation 6 of the EMRs 2011 respectively, not under Part 4A FSMA, so sections 205, 206, 380 and 382 do not reach them. FSMA Part XI applies to a payment firm only as applied and modified by Schedule 6 to the PSRs 2017 and Schedule 3 to the EMRs 2011, and the penalty, censure, injunction and restitution powers against a payment firm sit in the PSRs 2017 and the EMRs 2011 themselves.

A payment service provider that contravenes a requirement of the Payment Services Regulations 2017 (PSRs 2017) may be fined by the FCA under regulation 111, one of the enforcement powers in Part 9 (regulations 108-117). The FCA may also seek an injunction under regulation 113 and restitution under regulation 114, mirroring FSMA. Its Enforcement Guide addresses the exercise of these powers at ENFG App 2 (Non-FSMA powers). ENFG App 2.1.1G provides that references in DEPP to the Act are to be read as references to the corresponding provisions of the other legislation, and ENFG App 2.1.2G confirms that the FCA's approach to the exercise of those powers is consistent with its use of powers under the Act. The FCA therefore investigates under the PSRs 2017 by substantially the same procedure as it uses under FSMA, subject to the modifications Schedule 6 makes to the application of Part XI.

An electronic money institution is subject to parallel enforcement provisions in the Electronic Money Regulations 2011 (EMRs 2011) at regulations 48-58: the FCA may impose a financial penalty (reg 51), publish a statement of censure (reg 50), and suspend or restrict its authorisation (reg 52). A person who issues electronic money without authorisation commits a criminal offence and may be imprisoned for up to two years and fined without limit (regs 63-70).

The Payment Systems Regulator (PSR) enforces separately under Part 5 of the Financial Services (Banking Reform) Act 2013 (FSBRA 2013), against participants in designated payment systems. Its powers depend on participation in a regulated payment system and on the obligation said to have been breached, not on a firm's institutional label, so the PSR may act against a payment institution that participates in a designated system. The PSR may impose a financial penalty (section 73), give a direction (section 54) or impose a requirement (section 55) and publish a compliance failure (section 72). It also holds concurrent competition enforcement powers alongside the CMA.

Both regulators may act against a firm that is both an authorised payment institution and a participant in a designated payment system. HM Treasury has confirmed that it will consolidate the PSR into the FCA. Consolidation requires primary legislation, and that legislation is the Financial Services and Markets Bill [HL], HL Bill 5 of 2026-27, introduced in the House of Lords on 19 May 2026, read a second time on 8 June 2026 and in committee there from 22 June 2026, with report stage listed to begin on 7 September 2026 (Bill stages, UK Parliament). The policy it would implement is set out in the Treasury's consultation response (A Streamlined Approach to Payment Systems Regulation: Consultation response, 21 April 2026, paragraph 1.4). The FCA and the PSR are already working on operational readiness ahead of it. The consolidation and what it would mean for a firm under investigation are set out in a separate post on the PSR/FCA consolidation.

Enforcement powers comparison

PowerFCA (FSMA 2000)FCA (PSRs 2017)FCA (EMRs 2011)PSR (FSBRA 2013)
Financial penaltiess206: unlimitedreg 111: unlimitedreg 51: unlimiteds73: unlimited
Public censures205reg 110reg 50s72
Variation/cancellation of permissionss55J-55Lreg 10-12reg 10-12Not available
Injunctionss380-381reg 113reg 54s75
Restitutions382, s384reg 114 (FCA), reg 116 (court)reg 55 (FCA), reg 57 (court)Not available
Criminal prosecutionVariousregs 138-142regs 63-70Not available
Skilled person reportss166Via FSMA s166Via FSMA s166s82
Appeal routeUpper Tribunal (s133)Upper TribunalUpper TribunalCompetition Appeal Tribunal (s78)
Enforcement powers available to the FCA and PSR against payment service providers under each statutory regime. The FSMA column applies to an FSMA-authorised person, such as a bank providing payment services; it does not apply to a payment institution or an electronic money institution, whose powers sit in the PSRs 2017 and the EMRs 2011.

Triggers for an FCA investigation into a payment institution

The FCA opens an investigation into a payment firm on a specific supervisory concern rather than on routine inspection. It is a risk-based regulator with limited resources, and it concentrates enforcement where it identifies the greatest harm to its statutory objectives of consumer protection, market integrity and competition.

The FCA concentrates supervisory and enforcement attention on the protection of customer funds under PSRs 2017 regulation 23, anti-money laundering and financial crime controls under the Money Laundering Regulations 2017, compliance with the Consumer Duty, now the FCA's primary conduct standard for retail-facing firms, and operational resilience. A payment service provider within the scope of the Payment Systems Regulator's mandatory reimbursement requirement carries a further exposure under FSBRA where it does not reimburse a victim of authorised push payment fraud. That requirement has applied to payment service providers participating in the Faster Payments Scheme since 7 October 2024, and to CHAPS under a parallel direction; participating in a designated payment system does not by itself engage it.

The FCA may also open an investigation after a section 166 skilled person review identifies serious weaknesses, after a whistleblower report, after a pattern of consumer complaints, or where a firm does not respond to a supervisory request under section 165 FSMA 2000. It may do the same where sector-wide work identifies failures at an individual firm, including supervisory work against the safeguarding standards the FCA set in PS25/12, which introduced the CASS 15 rules in force from 7 May 2026.

A firm that self-reports a breach does not avoid enforcement action, but the FCA treats the self-report as a mitigating factor under the penalty framework. The FCA expects a firm to report a material breach promptly under Principle 11 of its Principles for Businesses.

The FCA enforcement process for payment firms

The FCA follows a structured sequence set out in its Enforcement Guide (ENFG) and its Decision Procedure and Penalties Manual (DEPP). ENFG App 2 (Non-FSMA powers) lists both the PSRs 2017 and the EMRs 2011, and applies the DEPP penalty policy to each of them (DEPP 6.2 and DEPP 6.4 on relevant factors, and DEPP 6.5 to DEPP 6.5D on the level of a financial penalty). The Regulatory Decisions Committee takes some of the decisions made under the PSRs 2017, as DEPP 2 Annex 1G sets out. A firm under investigation under the PSRs 2017 or the EMRs 2011 therefore meets substantially the same procedural framework as a firm under FSMA, though not an identical one: the statutory modifications apply, and the FCA's statement of policy for a non-FSMA penalty does not adopt every part of DEPP.

The FCA begins with a scoping phase of initial fact-finding. It may visit the firm, request information under section 165 FSMA, and assess whether a formal investigation is warranted. It sometimes commissions a section 166 skilled person report at this stage, at the firm's cost, to establish the factual position before deciding whether to proceed.

If the FCA decides to investigate, it appoints investigators under section 167 (general investigations) or section 168 (investigations in particular cases). Investigators may compel the production of documents, require attendance at interview, and in certain circumstances obtain warrants to enter premises. A person who fails without reasonable excuse to comply with a requirement imposed under Part XI may be certified to the court by the FCA and dealt with as if in contempt (section 177(1) and (2) FSMA). Falsifying or destroying documents, and providing information that is false or misleading in a material particular, are separate criminal offences under section 177(3) and (4).

The case team then prepares a recommendation. Where it recommends enforcement action, the case goes to the Regulatory Decisions Committee (RDC), an independent body within the FCA, which decides whether to issue a warning notice. The firm may make written and oral representations to the RDC before it issues a decision notice.

At any stage before the RDC decides, the firm may seek to settle. On a full settlement the discount is all or nothing. Under DEPP 6.7.3G(3) the reduction is 30% if the agreement is concluded during stage 1, the period running from the commencement of the investigation until the FCA has reached and communicated its assessment of the appropriate penalty and given the firm a reasonable opportunity to agree it, and 0% in any other case. Only a legacy case in which stage 1 had begun but no agreement had been reached before 1 March 2017 can still attract the old 20% and 10% tiers. A firm that agrees only part of the case may instead enter a focused resolution agreement, under which DEPP 6.7.3AG gives 30% where all facts and all breach issues are agreed during stage 1, 15 to 30% where all facts but not all breach issues are agreed, and 0 to 30% in any other case, and nothing at all after stage 1 in each instance. Once the stage 1 window closes the discount is gone, so a firm needs a clear view of its exposure and a realistic assessment of the evidence well before then. The FCA's statement of policy for a penalty under the PSRs 2017 or the EMRs 2011, listed at ENFG App 2.1.2G, runs to DEPP 6.5D and does not name DEPP 6.7, so a firm should confirm the discount position with the case team at the outset of a non-FSMA case.

After a decision notice the firm has 28 days to refer the matter to the Upper Tribunal (Tax and Chancery Chamber). On a disciplinary reference the Tribunal determines what action the FCA should take and remits the matter with directions, which bind the FCA (section 133(5) and (7) FSMA). The FCA gives a final notice only once the reference period has expired without a reference or the Tribunal has directed (section 390 FSMA).

As an indication rather than a published benchmark, a straightforward case may conclude within 12 to 18 months, and a complex investigation involving several firms or cross-border elements can take three years or longer.

How the FCA calculates penalties for payment service providers

The FCA applies a five-step framework under DEPP 6 to determine financial penalties.

At Step 1 the FCA removes any financial benefit the firm derived directly from the breach, depriving it of the profit made or loss avoided, ordinarily with interest (DEPP 6.5A.1G). At Step 2 it sets a figure for the seriousness of the breach, selecting a percentage of the firm's relevant revenue between 0% and 20% across five fixed levels, having regard to the nature of the breach, whether it was deliberate or reckless, how long the non-compliance lasted, and the impact on consumers or market integrity (DEPP 6.5A.2G). At Step 3 it adjusts that figure for the mitigating and aggravating factors listed at DEPP 6.5A.3G(2), among them the firm's conduct in bringing the breach to the FCA's attention, the degree of cooperation, remedial steps taken and the firm's previous disciplinary record. At Step 4 it applies a further uplift if the penalty would not deter the firm or the wider industry. At Step 5 it applies the settlement discount, which does not apply to the disgorgement element.

No statutory maximum penalty applies. The FCA may also censure the firm publicly by publishing a statement of its failings, under regulation 110 of the PSRs 2017 or regulation 50 of the EMRs 2011, vary or cancel its authorisation or registration, impose requirements restricting its activities, and seek restitution for consumers. Under regulation 111(2) of the PSRs 2017 the FCA may not both impose a penalty and cancel an authorisation or registration in respect of the same contravention, so on any one contravention it chooses between them. It remains free to use different measures for different contraventions. A person who issues electronic money without authorisation may be prosecuted and imprisoned for up to two years.

The PSR applies a separate penalty methodology under its Financial Penalty Scheme and its Revised Penalty Statement 2023. It shares the principle of proportionality with the FCA, but it calculates the penalty differently and decides through the Enforcement Decisions Committee rather than the RDC.

Differences between PSR enforcement and FCA enforcement

A participant in a designated payment system answers to the PSR under a distinct enforcement regime. Consolidation would merge the two regimes, but both remain in force and both regulators exercise their powers.

The PSR's jurisdiction covers participants in designated payment systems (Faster Payments, Bacs, CHAPS, LINK, Mastercard, Visa and others designated by HM Treasury under section 43 FSBRA). The FCA's jurisdiction covers individual payment service providers (payment institutions, EMIs, registered account information service providers). A firm may be subject to both.

Enforcement decisions at the PSR are taken by the Enforcement Decisions Committee (EDC), not by the FCA's Regulatory Decisions Committee; the EDC draws three-member panels from a pool of independent members to decide individual cases. A firm appealing a PSR penalty decision goes to the Competition Appeal Tribunal under section 78 FSBRA rather than to the Upper Tribunal. On a direction, a requirement or a publication decision the CAT applies judicial review principles (section 77(4) FSBRA), but on a penalty appeal it may uphold, set aside or substitute a penalty of its own amount (section 78(5)), and the penalty is not payable until the appeal is determined. The PSR also holds concurrent competition enforcement powers alongside the CMA, and may investigate and penalise anti-competitive conduct within a payment system.

A payment service provider within the scope of the PSR's mandatory reimbursement requirement, in force since 7 October 2024, that does not reimburse a victim of authorised push payment fraud commits a compliance failure within section 71 FSBRA and may be fined for it under section 73. HM Treasury has said that it intends the FCA to hold powers over payment systems that are broadly equivalent in scope and substance to the PSR's, integrated into the FCA's existing FSMA framework so far as that is practicable, and that it is still considering how to design the legislation (A Streamlined Approach to Payment Systems Regulation: Consultation response, 21 April 2026, paragraphs 1.2 and 4.3). HM Treasury also intends to make specific directions and requirements appealable to the High Court rather than the Competition Appeal Tribunal.

Section 166 skilled person reviews and voluntary requirements

The FCA uses two supervisory tools short of formal enforcement against payment firms, a skilled person review under section 166 and a voluntary requirement, and each carries material practical consequences.

The FCA commissions a skilled person report under section 166 FSMA as an independent review into a specific aspect of a firm's business. It sets the scope, the firm pays the cost, and the skilled person reports directly to the FCA. In payments the FCA commonly uses a section 166 review to assess safeguarding arrangements, anti-money laundering controls, governance and operational resilience. The firm cannot refuse the review, and the findings often inform whether the FCA proceeds to formal enforcement.

A skilled person review typically takes six to twelve months and diverts substantial management time. The FCA publishes quarterly data on the number and cost of skilled person reports it commissions, broken down by sector.

A firm accepts a voluntary requirement (VREQ) as a restriction on its own business without formal enforcement proceedings. A payment institution might agree to stop onboarding new customers, ring-fence specific funds, appoint additional compliance staff or commission an external audit. The FCA typically publishes a VREQ on the Financial Services Register, where the market can see it. A firm that declines a VREQ after the FCA has signalled supervisory concerns can expect the FCA to impose the same restrictions on its own initiative, under regulation 12 of the PSRs 2017 for a payment institution, applied to a small payment institution by regulation 15, or regulation 11 of the EMRs 2011 for an electronic money institution. Section 55J FSMA, the own-initiative variation of permission, applies to a Part 4A permission and does not reach a payment institution or an electronic money institution.

Rights to challenge an FCA or PSR enforcement decision

A payment firm may challenge an enforcement decision at every stage of the process, and the appeal forum depends on which regulator took the action.

For an FCA enforcement decision, whether under FSMA, the PSRs 2017 or the EMRs 2011, the firm may refer the matter to the Upper Tribunal (Tax and Chancery Chamber) within 28 days of the decision notice (section 133 FSMA). On a disciplinary reference, which under Schedule 6 to the PSRs 2017 covers a regulation 110 statement and a regulation 111 penalty, the Tribunal may consider evidence that was not before the FCA, must determine what action the FCA should take, and must remit the matter to the FCA with directions (section 133(4) and (5) FSMA). The FCA must act in accordance with that determination. On any other reference the Tribunal may only dismiss the reference or remit the matter (section 133(6)). The FCA gives a final notice, and so takes the action, only where no reference was made within the period set by the Tribunal Procedure Rules or where the Tribunal has given its directions (section 390(1) and (2) FSMA).

A firm challenging a PSR enforcement decision under FSBRA goes to the Competition Appeal Tribunal under section 78 FSBRA. On a penalty appeal the CAT may uphold the penalty, set it aside or substitute an amount of its own (section 78(5) FSBRA). On any other CAT-appealable decision it applies judicial review principles and may only dismiss the appeal or quash the decision in whole or in part (section 77(4) and (5) FSBRA), a narrower jurisdiction than the Upper Tribunal's full merits reference.

Before the appeal stage the firm holds procedural rights within the enforcement process itself: the right to make written and oral representations to the RDC, or to the EDC in a PSR case, before a decision notice is issued, the right to access the evidence against it, subject to public interest immunity and third-party confidentiality, and the right to seek settlement at any stage. Those rights are worth most to a firm that has already established the evidential basis for the case and the size of its own exposure.

Common enforcement triggers for payment firms

TriggerPrimary regulatorTypical statutory basisTypical outcome
Safeguarding failuresFCAPSRs 2017 reg 23, EMRs 2011 regs 20 to 22Financial penalty, requirements, possible cancellation
AML/CTF control weaknessesFCAMLR 2017, PRIN, Principle 3Financial penalty, s166 review, VREQ
Consumer Duty breachesFCAFCA Handbook PRIN 2AFinancial penalty, public censure, remediation
APP fraud reimbursement non-compliancePSRFSBRA s73, Specific DirectionFinancial penalty, compliance direction
Unauthorised payment services or e-money issuanceFCAPSRs 2017 reg 138, EMRs 2011 regs 63-70Criminal prosecution, injunction
Interchange fee non-compliancePSRInterchange Fee Regulation, FSBRAFinancial penalty
Operational resilience failuresFCAFCA Handbook, FSMAs166 review, VREQ, financial penalty
Misleading financial promotionsFCABCOBS 2.2.1R; PRIN 2A (Consumer Duty)Financial penalty, public censure
Failure to cooperate with investigationFCAFSMA s177Contempt of court under s177(1) and (2); criminal offence under s177(3) and (4)
Common enforcement triggers for UK payment service providers, showing the primary regulator, statutory basis and typical regulatory outcome

Key regulatory references

Primary legislation: Financial Services and Markets Act 2000 (Part XI investigations, Part XIV discipline, Part XXV injunctions and restitution). Payment Services Regulations 2017 (SI 2017/752) (Part 9 enforcement). Electronic Money Regulations 2011 (SI 2011/99) (regs 48-58 supervision and enforcement, regs 63-70 criminal offences). Financial Services (Banking Reform) Act 2013 (Part 5 PSR enforcement powers).

FCA guidance: FCA Enforcement Guide (ENFG), on the FCA's use of its enforcement powers, and in particular ENFG App 2 on the FCA's non-FSMA powers under the PSRs 2017 and the EMRs 2011. Decision Procedure and Penalties Manual (DEPP), including DEPP 6 penalty framework. FCA Enforcement Information Guide.

PSR guidance: PSR Powers and Procedures Guidance (September 2024). PSR Financial Penalty Scheme. PSR Revised Penalty Statement 2023.

Appeal routes: Upper Tribunal (Tax and Chancery Chamber) (FCA decisions). Competition Appeal Tribunal (PSR decisions).

Advice on an FCA or PSR investigation into your payments business

Frequently asked questions about FCA investigations and FCA enforcement

Can the FCA investigate a small payment institution?

Yes. A small payment institution (SPI) is registered under PSRs 2017 regulation 13, on the conditions in regulation 14, and is subject to the FCA's enforcement powers in Part 9 of the PSRs. An SPI must comply with the conduct requirements in Parts 6 and 7 of the PSRs 2017, with the FCA's Principles for Businesses including the Consumer Duty (PRIN 3.1.1AR applies PRIN to a small payment institution), and with the Money Laundering Regulations 2017. It is not subject to the safeguarding duty in regulation 23, which binds an authorised payment institution, nor to the initial capital and own funds requirements in regulation 22 and Schedule 3, and regulation 14(4) bars it from providing payment initiation or account information services. An SPI that chooses to safeguard relevant funds by one of the regulation 23 methods gets the insolvency priority in regulation 23(14) and (15) for those funds (regulation 23(16)) and takes on the organisational duty in regulation 23(17), but it does not thereby become subject to regulation 23 as a whole. The FCA can impose financial penalties, cancel registration, or pursue criminal prosecution for operating without registration.

What is the difference between a section 165 request and a section 166 review?

A section 165 request is a statutory demand for specific information or documents. A firm that fails without reasonable excuse to comply may be certified to the court and dealt with as if in contempt under section 177 FSMA, and providing false or misleading information in response is a criminal offence under section 177(4). A section 166 review requires the firm to appoint an independent skilled person (at the firm's cost) to report to the FCA on a particular aspect of the firm's business. Section 165 gathers evidence; section 166 provides an independent assessment.

How long does an FCA investigation typically take?

These ranges are indicative, not published targets. Straightforward cases may conclude within 12 to 18 months from the scoping phase to final notice. Complex investigations, particularly those involving multiple firms, cross-border elements or contested proceedings before the Upper Tribunal, can take three years or longer. The FCA publishes average investigation timelines in its annual enforcement data.

Does self-reporting a breach to the FCA prevent enforcement action?

No. The FCA can and does take enforcement action against firms that self-report. However, self-reporting is treated as a mitigating factor at Step 3 under DEPP 6.5A.3G(2)(a), which weighs the conduct of the firm in bringing (or failing to bring) the breach quickly, effectively and completely to the FCA's attention, and may reduce the financial penalty. The FCA expects firms to report material breaches promptly under Principle 11.

What happens to PSR enforcement powers after the FCA/PSR consolidation?

HM Treasury has confirmed that it intends the substance of PSR regulation to survive the institutional merger, and that the FCA should hold powers broadly equivalent in scope and substance to the PSR's, integrated into the FCA's existing FSMA framework so far as practicable (A Streamlined Approach to Payment Systems Regulation: Consultation response, 21 April 2026, paragraph 4.3). HM Treasury has not settled the design of the legislation. A firm currently supervised by the PSR should expect its regulatory obligations to continue, with changes to reporting lines and supervisory contacts. A separate post sets out the PSR/FCA consolidation in detail.

Can the FCA prosecute individuals as well as firms for payments offences?

Yes. The EMRs 2011 create criminal offences for issuing electronic money without authorisation (reg 63), punishable by up to two years' imprisonment. The FCA can also prosecute an individual for misleading statements under section 89 of the Financial Services Act 2012. Against an individual at a payment firm, the FCA takes disciplinary action under section 66 FSMA as applied and modified by Schedule 6 to the PSRs 2017, which substitutes a section 66A under which a person responsible for the management of a payment service provider, or of its payment services activities, is guilty of misconduct if knowingly concerned in a contravention of the PSRs 2017 by that provider. Schedule 3 to the EMRs 2011 does the same for an electronic money issuer. The FCA may also apply to the court against a person knowingly concerned in a contravention, for a remedial order or an asset freeze under regulation 113(2) and (3) of the PSRs 2017 and for restitution under regulations 114 and 116, with parallel powers in regulations 54 to 57 of the EMRs 2011.

What is the settlement discount and when should a firm consider settling?

On a full settlement the discount is all or nothing. Under DEPP 6.7.3G(3), a settlement agreement concluded during stage 1 attracts a 30% reduction in the financial penalty, and any later agreement attracts nothing. A focused resolution agreement, which settles part of the case only, attracts 30%, 15 to 30% or 0 to 30% during stage 1 depending on how much is agreed, and nothing afterwards (DEPP 6.7.3AG). The decision to settle requires a clear understanding of the firm's exposure, the strength of the FCA's evidence, and the commercial consequences of a contested process, and it has to be taken inside the stage 1 window. A firm needs advice on its settlement position before the stage 1 window closes.

Is a voluntary requirement (VREQ) truly voluntary?

In form, yes. In practice, the FCA typically signals that if the firm does not accept a VREQ, it will impose the same restrictions compulsorily on its own initiative, under regulation 12 of the PSRs 2017 or regulation 11 of the EMRs 2011. VREQs are published on the FCA Register. A firm that accepts a VREQ avoids the cost and uncertainty of contested proceedings but accepts the reputational impact of a published restriction.

Related payments regulation pages

See also our other payments regulation pages:

Payment Institution Authorisation and Licensing
Open Banking and Variable Recurring Payments
PSR and Scheme Governance
Safeguarding and Consumer Duty
EMI Authorisation and E-Money Regulation
Operational Resilience and DORA
The PSRs 2017 Explained: Payment Authorisation, Liability and Execution Times
The PSRs 2017 Explained: Information Requirements and Framework Contracts
Digital Money and Central Bank Digital Currencies. A firm facing an FCA investigation into payment services activity may need to establish whether that activity was ever within the regulated perimeter, which is addressed in The PSRs 2017 Explained: the Payment Services Perimeter and the Exclusions.

How We Work sets out the firm's engagement models, and Investigations and Enforcement Support covers what the firm does for a firm already under investigation or expecting one.

Credentials

Rob Bratby is Managing Partner of Bratby Law and Fractional General Counsel to UK Payments Initiative Limited, the industry body developing the UK's commercial account-to-account payments scheme. He also holds Fractional General Counsel appointments at The One Touch Switching Company, TelXL and Core. He is ranked Band 2 for Telecommunications in Chambers UK 2026, listed by The Legal 500 as a Leading Partner for IT and telecoms in London, and recognised in the Lexology Index as a Global Elite Thought Leader for telecoms and media and a Thought Leader for data privacy and protection.

Discuss your matter