What Do the FCA and PSR Regulate? A Guide to UK Payments Regulation

ByRob Bratby Posted on Payments Regulation
What Do the FCA and PSR Regulate? A Guide to UK Payments Regulation - Bratby Law Payments Regulation

The Financial Conduct Authority (FCA) and the Payment Systems Regulator (PSR) are the two bodies responsible for regulating payments in the UK. The FCA authorises and supervises payment service providers and electronic money institutions under the Payment Services Regulations 2017 (PSRs 2017) and the Electronic Money Regulations 2011 (EMRs 2011). The PSR regulates designated payment systems, including Faster Payments, Bacs, CHAPS and the card schemes. Together they oversee a sector that processes over 46 billion transactions a year. This guide explains what each regulator does, how they enforce the rules, and what the planned consolidation of the PSR into the FCA means for regulated firms.

This is the third in our series of UK regulator explainers, following our guides to what Ofcom regulates and what the ICO regulates.

What legislation do the FCA and PSR enforce?

The FCA’s payments jurisdiction rests on three principal instruments. The Payment Services Regulations 2017 (PSRs 2017) transpose the second Payment Services Directive (PSD2) into UK law and set out the authorisation, conduct and prudential requirements for payment institutions, registered account information service providers and electronic money institutions. The Electronic Money Regulations 2011 (EMRs 2011) govern the issuance and redemption of electronic money. And the Financial Services and Markets Act 2000 (FSMA) provides the FCA’s overarching regulatory framework, including its enforcement and rule-making powers.

The PSR operates under the Financial Services (Banking Reform) Act 2013 (FSBRA), under which the FCA established it as an independent body corporate with its own regulatory powers over designated payment systems. The PSR also enforces the Interchange Fee Regulation (IFR), which caps interchange fees on consumer card transactions, and has specific responsibilities for access to payment systems under Part 8 of the PSRs 2017.

This dual-regulator structure is unusual. Most EU member states have a single payments regulator. The UK split reflects the particular structure of UK payment systems, where operators like Pay.UK and the card schemes sit between the banks and the end users.

Who needs FCA authorisation?

Any business providing payment services in the UK as a regular occupation or business activity must be authorised or registered by the FCA under the PSRs 2017. Payment services include operating payment accounts, executing payment transactions (including direct debits, card payments and credit transfers), issuing payment instruments, money remittance, and payment initiation and account information services.

There are three tiers. Authorised Payment Institutions (APIs) must hold initial capital of between EUR 20,000 and EUR 125,000 (or the sterling equivalent) depending on the services provided, meet ongoing prudential requirements and safeguard client funds. Small Payment Institutions (SPIs) must not exceed a monthly average of EUR 3 million in payment transactions over a rolling 12-month period and face lighter requirements but cannot passport into other jurisdictions. Electronic Money Institutions (EMIs) authorised under the EMRs 2011 must hold initial capital of EUR 350,000 and comply with separate safeguarding and redemption obligations. The euro denominations are a retained EU law artefact: the PSRs 2017 transposed PSD2 and the capital thresholds were not converted to sterling by the post-Brexit amendments. Regulation 2 provides that references to euro amounts include equivalent amounts in other currencies. HM Treasury’s planned review of payments legislation may address this.

The FCA must determine an authorisation application within three months of receiving a completed application. In practice, timelines are longer. The FCA’s own data shows average determination periods of five to six months for API applications.

What are the FCA’s enforcement powers?

The FCA can impose financial penalties on authorised firms and approved persons under FSMA. For breaches of the PSRs 2017, the FCA can issue directions, impose requirements, vary or cancel authorisation, and prosecute criminal offences. Regulation 138 of the PSRs 2017 makes it a criminal offence to provide payment services without authorisation or registration, carrying a maximum sentence of two years’ imprisonment on conviction on indictment.

The FCA’s Consumer Duty, which came into force on 31 July 2023 under the FCA Handbook (PRIN 2A), applies to payment service providers and requires firms to deliver good outcomes for retail customers. This extends beyond the specific conduct rules in the PSRs 2017 to cover product design, price and value, consumer understanding and consumer support.

What does the PSR regulate?

The PSR regulates designated payment systems: Faster Payments, Bacs, CHAPS, LINK, Mastercard, Visa and the cheque clearing systems. Its three statutory objectives under FSBRA are to promote competition, promote innovation and ensure that payment systems are operated in the interests of those who use them.

The PSR’s most significant recent intervention is the APP fraud mandatory reimbursement requirement, which took effect on 7 October 2024. Payment service providers participating in the Faster Payments system must reimburse victims of authorised push payment (APP) fraud up to a cap of £85,000 within five business days. In the first year, 88% of money lost to APP scams was reimbursed. The PSR has commissioned an independent review of the policy, with a final report expected by Q3 2026.

The PSR also enforces the Interchange Fee Regulation, capping consumer debit card interchange at 0.2% and consumer credit card interchange at 0.3% of the transaction value. The PSR has actively enforced the IFR, imposing fines totalling over £10 million on major UK banks for interchange fee and Confirmation of Payee breaches since 2022.

What does the FCA/PSR consolidation mean?

In March 2025, the UK government announced it would abolish the PSR and consolidate its functions into the FCA. HM Treasury published a consultation in September 2025 setting out how this would work. The consultation closed in October 2025 and legislation will follow when Parliamentary time allows. The government’s Payments Forward Plan, published in early 2026, sets out the implementation timeline.

The consolidation will transfer the PSR’s competition and innovation objectives to the FCA, along with its powers to issue directions and requirements to payment system operators and participants. The FCA will gain powers broadly equivalent to those the PSR holds under FSBRA: the ability to designate payment systems, impose access requirements, vary agreements and gather information from system operators.

For regulated firms, the practical implications are significant. Firms that currently report to both regulators on overlapping matters will deal with a single point of contact. The FCA’s existing supervisory approach, which is more firm-focused than the PSR’s system-level regulation, will need to accommodate the PSR’s infrastructure-level perspective. HM Treasury has also signalled a broader review of payments legislation, including the PSRs 2017 and EMRs 2011, with a consultation expected in Q2 2026.

As we noted in our analysis of agentic AI and payments, regulatory questions at the intersection of technology and payment services are multiplying. A single regulator may be better placed to take a consistent view across authorisation, system access and consumer protection.

How do the FCA and PSR interact with other regulators?

The FCA and PSR sit within a wider regulatory framework. The Bank of England supervises systemically important payment systems (CHAPS and, from 2024, the New Payments Architecture). HM Treasury sets the legislative framework and designates payment systems for PSR regulation. The ICO regulates the data protection aspects of open banking and payment data. Ofcom’s responsibilities under the Online Safety Act 2023 intersect with payments fraud, particularly where online platforms are used to facilitate APP scams.

The FCA is also a member of the Digital Regulation Cooperation Forum (DRCF) alongside Ofcom, the ICO and the CMA. As open banking expands and variable recurring payments (VRPs) move from pilot to commercial deployment, the boundaries between payments regulation, data protection and competition law will continue to require coordination across regulators.

Viewpoint

The consolidation of the PSR into the FCA is the most consequential structural reform to UK payments regulation since the PSR was created in 2015. In our experience advising fintechs and payment institutions, the current dual-regulator model creates friction: firms often receive overlapping information requests and face uncertainty about which regulator leads on cross-cutting issues such as APP fraud prevention and open banking governance. A single regulator should reduce that friction, but the risk is that the FCA’s firm-level supervisory culture absorbs the PSR’s system-level competition focus. Firms should watch the legislative drafting closely to see whether the PSR’s competition objective survives the transfer with real teeth.

If you are launching a payments product or are unsure whether your business requires FCA authorisation, Bratby Law can advise on the regulatory requirements for your payments product.

The companions to this guide are What does Ofcom regulate? (covering UK telecoms) and What does the ICO regulate? (covering UK data protection).

Key sources

Get in touch

For advice on FCA authorisation, payments compliance or the impact of the PSR consolidation on your operations, contact Rob Bratby at Bratby Law. Subscribe to our regulatory updates for further analysis.

Select topics of interest

Lawyer

Telecoms | Data | Payments | Founder, bratby.law | Fractional General Counsel | Chambers-ranked telecoms lawyer

Similar Posts