Understand the differences and choose the appropriate licensing route

FCA

FCA

FCA

FCA

Authorisation / specific permissions

PSRs small payment institution registration

Authorisation / specific permissions

EMRs small electronic money institution registration

Apply for payment services authorisation under PSRs, combining the eight statutory services according to the flow of funds, rather than describing API as a banking or electronic money licence.

A registration route for those meeting the small payment services thresholds; transaction volumes, service scope and client money requirements must be reviewed on an ongoing basis.

Issuing electronic money and providing applicable payment services require separate compliance with initial capital and safeguarding obligations. Electronic money balances are not bank deposits.

A registration route for those meeting the outstanding electronic money and payment transaction volume thresholds, with thresholds and initial capital triggers checked separately.

There is no uniform initial capital amount; the statutory currency is euros. Only the AIS category has no initial capital requirement; money remittance under paragraph 1(f) requires €20,000, PIS under paragraph 1(g) requires €50,000, and any service under paragraph 1(a) to (e) requires €125,000. Where multiple capital tiers are involved, the higher amount applies rather than their sum; €125,000 does not mean that all five services must be obtained, nor does it automatically permit electronic money issuance.[3]

Ongoing own funds must generally remain at least equal to the higher of the applicable initial capital and the amount calculated under Method A, B or C, rather than “initial capital plus an equal amount of operating capital”. Institutions providing only PIS and/or AIS, without providing services under points 1(a) to (f), fall within the exception to ongoing method calculations under regulation 22(2) of PSRs; this does not remove the €50,000 initial capital floor or PII obligations for PIS.[3] [4]

Method A is 10% of the preceding financial year's fixed overheads. Method B applies a tiered calculation to average monthly payment volume, obtained by dividing the preceding year's total payment transactions by the number of months in that year. The Method B tiers are 4% of the first €500 × 10,000, 2.5% of the next €500 × 10,000, 1% of the next €9,000 × 10,000, 0.5% of the next €1.5 × 100,000,000, and 0.25% of the remainder, then multiplied by a scaling factor of 0.5 for money remittance only or 1 for other services under paragraph 1(a) to (e).[3]

Method C applies statutory tiering and scaling rules to the relevant income indicator comprising interest income and expenses, gross commissions and fees, and other operating income, with the relevant minimum checks. The method to be used is directed by FCA; firms cannot select whichever produces the lowest result. Based on a risk assessment, FCA may increase or decrease the calculated amount by up to 20%, but ongoing capital must not be described as a uniform percentage of transaction volume applicable to all API.[3] [5]

Initial capital and own funds must meet eligible capital definitions and deduction requirements; they are not simply total assets or customer bank balances. Article 22 provides that Tier 2 must not exceed one third of Tier 1, and at least 75% of Tier 1 must be CET1. Double use of the same capital within a group must also be prevented, and operating liquidity distinguished from resources required for an orderly wind-down.[3] [4] [5]

Euro thresholds cannot be translated as fixed amounts of £17,000, £43,000 or £107,000. The relevant sterling equivalents must be checked against the applicable exchange-rate basis and calculation date. PSRs has not specified a uniform preparatory funding or consultancy fee budget for API. Funding for actual UK staffing, banking, systems, insurance and exit arrangements normally requires separate estimates; minimum statutory capital cannot represent the project's total cost.[3] [5]

SPI has no uniform minimum initial regulatory capital figure and is not subject to ongoing own funds methods A, B or C for API. Paragraph 9.1 of FCA's May 2026 “Our Approach” expressly states that the capital resources chapter does not apply to small PIs. None of €25,000, €50,000 or £50,000 appearing on the original page should be listed as minimum capital for SPI.[2]

The absence of fixed regulatory capital does not mean there is no obligation to make financial preparations. Firms still need resources for start-up costs, salaries, system maintenance, chargebacks and refunds in line with their actual business. Transaction forecasts, account arrangements and funding sources should match the business plan. If FCA doubts the reliability of a self-declaration of scale, it may request forecast financial information; this does not mean every SPI must submit a standard-format “certificate of minimum capital compliance”.[2]

When comparing an upgrade, initial capital for a API providing only money remittance is €20,000; for services under Schedule 1, paragraph 1(a) to (e), it is €125,000; and for a API providing PIS, it is €50,000. Where multiple thresholds apply, the higher applies, alongside ongoing own funds requirements. These amounts are in euros and relate to API, not the transaction-volume-based capital tiers for SPI. In particular, a SPI cannot conduct PIS on the strength of €50,000.[1] [2]

Fees and capital must be distinguished: as at the verification date, SPI registration applications fall under FCA fee Category 3, at a non-refundable £1,130, while the G.4 basic flat-rate regulatory fee for the 2026/27 year is £652. Application fees, annual fees, other potentially applicable levies, HMRC fees, banking or insurance costs and consultancy fees should not collectively be described as capital or a security deposit. Actual payments are subject to current official rules and invoices.[6] [7]

The minimum initial capital for AEMI is 350,000 euros (EUR), not 350,000 pounds or 500,000 euros. This is a regulatory eligible capital requirement, not a deposit or application fee paid to FCA. The legislation requires this amount to be met before authorisation, while FCA allows evidence of capital to be completed close to authorisation. It is therefore incorrect to claim universally that all capital must be injected before submitting an application. Where capital is held in another currency, conversion and exchange-rate fluctuations must be managed.[1] [2] [4]

Ongoing own funds must be at least the higher of 350,000 euros and the requirement calculated under paragraph 13 of Schedule 2 to EMRs; 35 × 10,000 euros must not be treated as a uniform lifetime requirement for institutions of all sizes. Electronic money issuance and related payments use Method D, namely 2% of the average daily closing electronic money liabilities over the preceding six calendar months, recalculated on the first day of each month for use during that month; new institutions use business plan projections accepted by FCA.[2] [3] [4]

When a UK entity conducts unrelated payment services, it must calculate the requirement for that business separately using Method A, B or C as specified by FCA and include it in the overall requirement; the same capital item cannot be used twice to satisfy component requirements. A is generally 10% of the previous financial year's fixed overheads; B applies bands to average monthly unrelated payment volume and a service scaling factor; C uses a banded income indicator calculation. FCA may adjust the calculated requirement upwards or downwards by up to 20% based on a risk assessment, but the floor of 350,000 euros still applies.[2] [3]

Initial capital must comply with applicable capital item and deduction rules; ordinary borrowings, unpaid capital commitments and safeguarded customer funds cannot directly be treated as eligible initial capital. Ongoing own funds may include other compliant capital instruments subject to corresponding proportional limits, so it is also incorrect to state that all capital can only ever be frozen cash. Expenses and losses erode capital; operating liquidity and orderly wind-down funding must be budgeted separately.[2] [4]

SEMI has no single fixed minimum capital figure applicable to all applicants. Under Schedule 2 to EMR, where actual average outstanding electronic money, or that projected in the business plan, is below EUR500,000, there is no initial capital requirement under that framework. Where it reaches or exceeds EUR500,000, eligible initial capital of at least 2% of average outstanding electronic money must be held before registration.[2] [5]

Once the above capital band applies, ongoing own funds are generally also calculated at 2% of average outstanding electronic money. Following a risk assessment, FCA may increase or decrease the ongoing calculation by up to 20%. For example, an average balance of EUR500,000 normally corresponds to EUR10,000, and EUR5,000,000 to EUR100,000. These are examples excluding any FCA adjustment, not additional fixed licence capital bands. Statutory amounts are expressed in euros, with equivalent amounts in other currencies also permitted.[4] [5] [6]

There is no separate payment-business capital calculation requirement for SEMI's unrelated payment services, but the business must still have adequate operating resources and is subject to a monthly average transaction threshold of EUR3,000,000. Customers' funds used to purchase electronic money are not company capital, and safeguarded funds must not be used to repay shareholder loans or cover operating losses. Application fees, staffing, systems and banking costs should be budgeted separately from capital and customer funds.[2] [19]

When becoming an authorised EMI, the initial capital floor is EUR350,000, not EUR500,000 or EUR3,500,000. Ongoing funding requirements after authorisation must also be calculated using the relevant methods under EMR and the requirements for unrelated payment business; paying in EUR350,000 once must not be assumed to eliminate any future need for additional funds.[5] [6]

Shareholders and controllers: disclose direct and indirect ownership chains, voting rights, group and close links, and identify the ultimate natural persons. Persons or institutions holding 10% or more of capital or voting rights, or able to exercise significant influence despite holding less than 10%, must submit qualifying holding information; screening solely against the Companies House beneficial ownership registration threshold is insufficient.[5] [6]

Directors and business managers: all management committee members must register, corresponding to directors for limited companies and members for LLP, including those actually managing regulated payment business. Applications use payment institution personnel information procedures such as PSD Individual, focusing on reputation, knowledge, experience, other appointments and actual responsibilities, rather than assigning a fixed SMF number to every API director.[5] [6] [9]

Compliance and anti-money laundering: a Head of Compliance and/or MLRO should normally be registered, with clearly defined responsibilities for business management, compliance oversight and suspicious activity reporting. Whether functions may be combined depends on size, complexity, conflicts of interest and effective oversight. The verified rules do not require every API to employ separate full-time CRO, CTO and CFO, nor is there a universal ICA certificate requirement.[5] [6] [15]

Local substance: the head office assessment focuses on the location of the directors and senior management making central direction and significant day-to-day decisions, and the location of administrative functions such as central compliance and internal audit. Evidence should show that the UK entity can control banking arrangements, client funds, systems risks and outsourcing, rather than merely retain a UK correspondence address. Neither 'everyone must be a UK national' nor 'at least two UK-resident directors' should be treated as a verified universal condition.[1] [5]

Individual accountability: payment service institutions authorised solely under PSRs, without FSMA authorisation, do not thereby fall within SM&CR, but must still meet payment legislation requirements on personnel suitability and management responsibility. If the same legal entity also holds permission for FSMA regulated business, assess separately the scope of SM&CR arising from that permission rather than using API status to generalise across all circumstances.[21] [22]

Shareholders and controllers: SPI has no uniform requirement for British shareholders or a minimum local shareholding, but qualifying holders must pass a fitness assessment. Applications must disclose the group structure, ultimate natural persons, direct and indirect control, significant influence arrangements, sources of funds and overseas close links that may impede supervision; listing nominee shareholders alone is insufficient.[1] [3]

Directors and business managers: FCA requires registration of all management committee members, corresponding to directors for limited companies and management committee members for LLP, together with managers directly responsible for payment business. The head of compliance or money laundering reporting officer will usually fall within registration scope, but not every customer service or technical employee needs registration; there is no universal 'two UK-resident directors' headcount standard for all SPI.[2] [3]

Compliance and anti-money laundering: responsibility for AML oversight and the nominated officer receiving internal suspicious activity disclosures should be clearly identified. Regulation 21 of MLR also requires payment service providers to designate an individual to monitor and manage AML policies and provide relevant information to senior management at least annually. A compliance lead at board or senior management level and an independent AML audit function are required as applicable to the size and nature of the business. It must not be stated that all roles must invariably be separate, full-time and absolutely prohibited from being outsourced. For natural persons operating individually, the specific exceptions in regulation 21(6) must also be checked.[16]

Local substance and individual regimes: the management team should be able to exercise actual control over UK payment operations, oversee agents and outsourcing, and provide records and make decisions when queried by FCA. An institution holding only SPI registration does not enter SM&CR by virtue of that registration and should not submit SMF1, SMF3, SMF16 or SMF17 as applications for statutory SPI roles. If the same entity also holds FSMA authorisation, the individual regime arising from that authorisation must be assessed separately.[2] [12]

For shareholders, FCA reviews direct and indirect controllers with a qualifying holding, including those holding at least 10% of shares or voting rights and those able to exercise significant influence. Applicants must disclose the group structure, beneficial owners and sources of wealth and acquisition funds through the full ownership chain; close links must also be shown not to impede FCA supervision. Multiple layers of offshore companies cannot replace transparent disclosure.[1] [4]

The reputation, knowledge and experience of directors and persons responsible for managing electronic money and payment services are assessed through the EMD Individual process. Holding only EMRs authorisation does not, by virtue of AEMI status, automatically make the firm subject to FSMA’s SM&CR, SMF approval or annual certification regime. If the same company also has FSMA permission, a separate assessment is required under that permission. The enhanced senior management accountability proposals in the Treasury’s 2026 consultation must not be described as already fully implemented.[14] [16] [17]

Firms should appoint compliance and anti-money laundering leads with sufficient capability, time and authority, and clearly define board oversight, finance and safeguarding responsibilities. The substance of a UK entity's head office is assessed by the location of central management and control, significant day-to-day business decisions and central administrative functions. The legislation does not prescribe a uniform fixed number of directors, UK nationals or any particular professional certificate for all AEMI.[1] [4]

For shareholders, identify persons directly or indirectly holding at least 10% of capital or voting rights, as well as those holding less than 10% but able to exercise significant influence. Retain a look-through ownership chart, ultimate beneficial owner information and evidence of sources of funds and fitness; SEMI has no uniform requirement for British shareholders or a specified British shareholding proportion.[1] [2]

Directors, LLP management members, the head of compliance, MLRO and others actually managing the registered business should be registered and submit career histories and background information as required by FCA. Ordinary employees not directly managing the relevant activities do not all need registration on this basis. FCA assesses integrity, knowledge, experience and the ability to perform duties in practice; there is no uniform SEMI rule that 'MLRO must have three years' experience' or uniform list of professional certificates. Institutions should provide sufficient time, authority and resources rather than merely appointing nominal officeholders.[1] [2]

An SEMI operating solely through EMR registration does not automatically fall within SM&CR by virtue of that status. The SM&CR guidance from FCA excludes firms not authorised under FSMA. EMD personnel registration and suitability requirements still apply. If the same legal entity also has FSMA Part 4A permission, check the applicability of SM&CR under that permission separately. Form A, SMF approval or annual certification must not universally be listed as statutory SEMI materials.[1] [14]

A UK head office is a substantive condition, not one satisfied merely by providing a UK mailing address. FCA focuses on where central management and control are located, particularly the directors and senior managers making significant day-to-day decisions and the central compliance and management functions. Overseas shareholders may invest, but must not keep all actual management overseas while using only a UK shell company and virtual address as a regulatory contact point.[2] [3]

Statutory authorisation deadlines: section 9 of PSRs requires FCA to decide within three months of receiving a complete application; for an incomplete application, FCA may decide, but must do so no later than twelve months after receipt. This deadline also applies to variations of the scope of authorisation. It is a deadline for a decision, not guaranteed approval, and does not mean every project takes a fixed three months from preparation to operation.[1]

Preparation: legislation sets no uniform period for incorporation, recruiting UK management, securing safeguarding accounts, system testing, PII or preparing a three-year plan. The original guide's “1 to 3 months of preparation” and “2 to 9 months of substantive review” are estimates unsupported by case data; the latter cannot replace the statutory three-month period for complete applications. Consulting quotations should provide separate timelines for outstanding tasks rather than combine preparation and regulatory assessment.[1] [5] [7]

Ancillary procedures: for a separate payment agent registration application, regulation 34(11) of PSRs requires notification of the decision within two months of receipt of a complete application. Applications combined with the main authorisation application follow the relevant authorisation procedure. Changes in control are normally assessed within 60 working days of a complete notification, subject to lawful interruption. Official central bank guidance recommends allowing at least twelve months for direct access to payment systems even after completing the work relating to FCA; this must not be described as the statutory authorisation period for API itself.[13] [17] [19]

Statutory decision deadlines: section 9 of PSRs applies to SPI registration through section 15. A complete application must be decided within three months of FCA receiving the complete information; an incomplete application must be decided no later than twelve months after initial receipt. These are decision deadlines, not guarantees of approval; persistently incomplete information may result in refusal. They must not be rewritten as “three months for complete applications, exceptionally extended to six months”, nor may the 60 working days for change-of-control assessment be treated as the deadline for SPI registration or an upgrade to API.[2] [8] [9]

Preparation: company or partnership arrangements, securing UK managers, HMRC processes, banking cooperation and system testing are pre-submission or parallel preparation and are outside the three-month complete-application period above. Internal consulting schedules may initially budget around 8 to 12 weeks for preparation, adjusted to actual banking and staffing readiness. This is only a planning estimate, not an average or service commitment published by FCA. Complex overseas ownership, agent networks and unresolved funding accounts may significantly extend preparation and enquiries.

Article 9 of EMRs provides that a decision on a complete application for authorisation or variation of authorisation must be made within three months of FCA receiving the complete application; an incomplete application must be decided no later than twelve months after receipt of the original application. The statutory time limit is a deadline for a decision, not a guarantee of approval. Meeting the minimum submission requirements does not mean that FCA has deemed the application complete, so the commonly experienced project duration of six to twelve months cannot replace the statutory rules.[5]

There is no uniform statutory number of preparation months; timing depends on the readiness of bank safeguarding accounts, management, systems, three-year budgets and documentation. Rengang Yongsheng (Hong Kong) Limited and Tang Shangyong (Mr Tang) can develop project calendars based on actual readiness, but “one to two months” or “three to six months” of preparation can only be case-specific budgets with explicitly stated assumptions, not promises of universal deadlines or faster approval.[4]

Direct payment system access is a separate project. Bank of England guidance requires planning for at least twelve months for direct access even after completing the relevant FCA activities. The guidance also notes that FCA generally requires at least nine months of actual regulated business history before undertaking the relevant s166 assessment; this does not constitute a fixed waiting period for initial AEMI authorisation.[15]

Statutory decision deadlines should be distinguished from preparation time. Section 9 of EMR applies to SEMI registration through section 15: FCA must decide within three months of receiving a complete application; it may decide an incomplete application before completion, and must decide within twelve months of first receiving it. A decision does not necessarily mean approval.[7] [8]

By complete, FCA means that all information and evidence necessary for a decision has been received, not that the applicant has clicked submit. Requests for additional documents, proof of capital, bank safeguarding arrangements and personnel background issues may all affect completeness. Accordingly, claims of “obtaining a licence in 3–6 months” or “approval in 4–6 months” cannot replace the statutory distinction between complete and incomplete applications.[2] [7]

There is no uniform statutory number of preparation days or officially guaranteed UK total timeframe for establishing SEMI from scratch. This feature does not present the original page's 1–2 months of preparation or 6–9 months overall as factual commitments. Projects should have separate work plans based on UK personnel, systems, safeguarding banks, available funding and document readiness, managed separately from the decision period after acceptance by FCA.[1] [2]

Periodic reporting: API normally submit annual FSA056 capital adequacy returns within 30 working days after the accounting reference date; payment services complaints reports are also normally submitted annually within 30 working days after the relevant reference date. REP017 fraud reporting for API is normally half-yearly, submitted within two months after the reporting period ends; a substantive assessment of REP018 operational and security risks must be undertaken at least annually, with nil returns handled under applicable quarterly arrangements for periods when a full report is not submitted, rather than broadly describing all reporting as quarterly.[5]

Ownership and safeguarding reporting: API reports on REP002 controllers and REP001 close links are generally annual, due four months after the accounting reference date. Institutions subject to safeguarding requirements must submit REP027 monthly, reporting relevant funds, accounts, insurance/guarantees, reconciliations and discrepancies within 15 working days after each calendar month-end. Check the institution’s actual reporting schedule using My FCA/RegData; the exception for pure PIS/AIS must not be overlooked.[5] [10] [11]

Client money: the regime taking effect on 2026-05-07 is the Supplementary Regime. Rules including CASS 15 and CASS 10A supplement, rather than already replace, Article 23 of PSRs. Relevant funds must be segregated from other funds, internal and external reconciliations performed at least once each reconciliation day, and a resolution pack maintained to support timely return of customer funds. Reconciliation days as legally defined exclude weekends, bank holidays and days when relevant foreign markets are closed.[4] [10] [11]

Safeguarding accounts or insurance: where relevant funds continue to be held until the end of the business day following receipt, they must be placed in an eligible segregated account under provision 23, or safeguarded using legally permitted relevant assets and independent custody arrangements. The requirement that segregation starts upon receipt must not be misrepresented as allowing funds to be diverted before that deadline. Insurance or a comparable guarantee must cover the relevant funds and meet the conditions for claims to be paid; contingency arrangements must be in place three months before the policy expires. Safeguarding funds is not equivalent to FSCS compensation and does not guarantee immediate repayment in full upon insolvency.[4] [10] [18]

Safeguarding audits: SUP 3A applies to the relevant API and auditors. Pure PIS/AIS institutions are not within the same audit scope for holding funds, and an exemption is available to those meeting the prescribed threshold of never having been required to safeguard more than £100,000 in relevant funds. The ordinary rules assess the threshold over at least 53 weeks, but the transitional arrangements from 2026-05-07 to 2027-05-14 instead assess the period since the rules took effect. The amount is in pounds sterling, not euros, and this is not an exemption from financial audits for all business activities.[5] [12]

Audit deadlines: the period covered by a safeguarding audit report should generally not exceed the 53 weeks specified in the relevant rules, and the report should be delivered to FCA within four months after period-end. Reports within the initial commencement transitional scope whose reporting periods end within 53 weeks after the rules take effect may be submitted within six months. This initial six-month allowance cannot be extended unconditionally to later new applicants. Statutory financial statement audits and specific safeguarding audits require separate assessment; where non-payment business is also conducted, separate accounting information for the payment business and applicable audit reports must also be provided under Article 24 of PSRs.[4] [5] [12]

AML and records: keep institutional risk assessments and customer and beneficial owner information up to date, apply appropriate enhanced due diligence to high-risk business, and operate transaction monitoring, internal escalation, suspicious activity reporting and staff training. MLR customer due diligence and transaction information is generally retained for five years from the end of the business relationship or completion of the transaction. Relevant compliance records under provision 31 of PSRs must be retained for at least five years from creation. These are different starting points; all documents should not be described uniformly as subject to six years’ retention or five years after the relationship ends.[15] [19]

Customers and incidents: payment complaints should normally receive a response within 15 working days. Exceptional delays beyond the firm's control require a holding response, and the final deadline should normally be no later than 35 working days. Eligible customers may complain to FOS. Major operational or security incidents should be notified promptly under Article 99 of PSRs and applicable incident classification and reporting procedures; a blanket “24 hours” or “72 hours” must not replace these. Capital, liquidity, outsourcing, exit plans and Consumer Duty implementation should also be tested continually.[5] [7] [18] [20]

Maintaining authorisation and fees: firms must pay the applicable FCA periodic fee annually; the application fee is not a permanent all-inclusive regulatory fee. Article 10 of PSRs lists grounds for withdrawal of authorisation, including not providing payment services within twelve months of approval, ceasing business for more than six months or no longer meeting the conditions. Holding authorisation in a shell entity therefore does not mean a “dormant licence” can be retained indefinitely.[1] [8]

Annual data: SPI must submit the FSA057 small payment institution return, covering 1/1 to 31/12 each year, through RegData by the end of month 1 of the following year. It includes summaries of payment and non-payment business income, transaction volumes and values including UK agents, new customers, agent numbers, payment system access and whether safeguarding is undertaken voluntarily. Connect, used for applications, must not be described as the submission platform for all periodic data.[2]

Client funds: where SPI opts for safeguarding, the Supplementary Regime effective from 2026-05-07 requires application of CASS 15 and compliance with the relevant fund-record and resolution-pack requirements. Internal and external funds reconciliations should be performed at least once each reconciliation day, with safeguarding accounts, third-party due diligence, acknowledgement letters and the resolution pack properly maintained. The REP027 monthly safeguarding return must be submitted using RegData through the My FCA portal within fifteen business days after month-end; fund shortfalls must not be left undisclosed until the annual return.[2] [13] [14]

Audit requirements must be distinguished: choosing to safeguard does not make SPI a API or EMI subject to mandatory annual safeguarding audits as listed in SUP 3A.1.1R. SUP 3A.1.3G encourages safeguarding firms outside the mandatory scope to arrange independent audits voluntarily. The £100,000 and fifty-three-week exemptions under API/EMI are not SPI capital thresholds; the first year of 2026 also has a transitional approach measured from the rules' commencement date. The first-year transitional submission period for mandatory reports may be six months after the reporting period-end, and is generally four months thereafter. This does not justify claiming that all SPI must undergo a statutory audit annually.[15]

Accounts and AML: company financial statement audits, an independent AML audit function and client funds safeguarding audits are three distinct matters, each to be assessed according to legal form, company law, the scale and nature of the business and applicable regulatory rules. The independent AML audit function under regulation 21 of MLR is established where appropriate to scale and nature, with the responsible person reporting to senior management at least annually. Customer due diligence and transaction information is generally retained for five years from completion of an occasional transaction or the end of a business relationship under regulation 40 of MLR, also checking the ten-year limit on transaction records and exceptions to legally required deletion.[16] [21]

Customer complaints and security: PSD complaints normally require a final response within fifteen business days, extended to a maximum of thirty-five business days in exceptional circumstances beyond the firm's control; complaint records are generally retained for three years. Annual payment services complaints reporting, fraud data, financial crime reporting and major security incident notifications should follow their respective scopes and the schedules allocated by FCA. SPI has no general obligation to submit quarterly capital adequacy returns.[2]

Ongoing eligibility and customer communications: update the rolling twelve-month transaction average monthly, maintain the fitness and propriety of controllers and managers, supervise agents and outsourcing, and assess customer outcomes under Consumer Duty. Even without electing PSRs safeguarding, appropriate asset protection should still be considered under Principle 10, making clear that customer funds are not covered by FSCS compensation if SPI fails; bank partnerships or safeguarding accounts do not mean the institution's customers directly receive a promise of bank deposit compensation.[2] [19]

Annual fees and supervision: the basic flat annual fee for FCA G.4 under 2026/27 SPI is £652. Other applicable levies and HMRC supervisory fees must be assessed separately. Firms must pay fees in accordance with notices or invoices, retain supporting records for returns and respond to regulatory enquiries. Registration must not be understood as a transferable licence asset requiring no maintenance or capable of remaining dormant indefinitely.[7] [17]

AEMI must submit applicable returns through designated channels such as My FCA and its RegData system. The FIN060 annual electronic money institution return is generally due within thirty working days after the accounting reference date; the annual payment and electronic money complaints return also has a corresponding thirty-working-day requirement. REP017 payment fraud data for AEMI is generally reported half-yearly, within two months after period-end. When payment services are provided, the REP018 operational and security risk assessment is required at least annually. All reporting must not be reduced to “quarterly financial statements”.[4]

From 2026-05-07, the REP027 safeguarding return is monthly and due within fifteen working days after month-end. Safeguarding methods, accounts, amounts, discrepancies and breaches must be recorded for each business activity. Internal and external reconciliations must be performed at least once on each reconciliation day. Exceptions, such as relevant markets being closed, should be interpreted under the rules; “daily” must not be reduced to a monthly spot check of balances.[6] [7]

Institutions subject to SUP 3A must appoint an independent external auditor. The safeguarding audit reporting period must generally not exceed fifty-three weeks, and reports are normally submitted within four months of period end. Transitional provisions extend this to six months after period end only where the reporting period ends within fifty-three weeks after 2026-05-07 takes effect. The general small-amount audit exemption requires that the institution has not been required to safeguard more than one hundred thousand pounds at any time for at least fifty-three weeks, but from 2026-05-07 to 2027-05-14 the transitional provisions require the observation period to be ‘since the rules took effect’ instead.[8] [9]

An audit of company financial statements and a safeguarding audit are separate obligations. Eligibility for the small company accounts exemption does not automatically exempt a company from a SUP 3A audit; conversely, it must not be asserted that all AEMI accounts unconditionally require the same type of annual audit. Hybrid institutions must identify the separate accounting information requirements for electronic money and payment business. Actual financial statement, audit and FCA submission obligations are determined jointly by EMRs, company law and individual conditions.[4] [8]

Client funds must be separated from own funds, using eligible bank accounts, qualifying low-risk liquid assets or insurance guarantees as permitted by legislation; account purposes and third-party rights are restricted. Banks and guarantors should be assessed continually, and an accurate, retrievable wind-down information pack maintained. Contingency arrangements should be in place three months before insurance or guarantees expire. Safeguarding still does not equate to FSCS deposit compensation or a promise of immediate full repayment following insolvency.[6] [10]

Ongoing anti-money laundering work includes risk updates, reviews of customer and beneficial owner information, enhanced due diligence, transaction and sanctions monitoring, staff training and record-keeping. Suspicious activity reports should be submitted to NCA as required, not merely to FCA. Firms serving retail customers must also implement applicable Consumer Duty requirements, payment and redemption disclosures and complaints handling, and promptly notify FCA of material business, security and funds risks. Paying annual regulatory fees is not an annual review that reissues a licence or guarantees automatic renewal.[4] [12] [13]

SEMI must continuously meet registration conditions, rather than reapply annually for a one-year licence. Annual fees and returns are ongoing obligations, not licence renewal. FCA may cancel registration on statutory grounds such as no longer meeting requirements, failing to commence business or ceasing business for a prolonged period. Having no new transactions therefore does not justify neglecting account, personnel or notification responsibilities.[2]

The FIN060b SEMI annual return is generally due within 30 working days after the accounting reference date. FSA065 reports total outstanding electronic money as at month 12, day 31, and is generally submitted within one month after that year-end. The electronic money/payment complaints annual return is generally due within 30 working days after the accounting reference date. SEMI payment fraud REP017 is generally reported annually and submitted within two months after the reporting period ends. Follow the schedule actually assigned in My FCA/RegData rather than stating broadly that all financial returns are submitted quarterly or monthly.[2]

From 2026-05-07, SEMI falls within the safeguarding Supplementary Regime and must perform applicable internal and external reconciliations at least once each reconciliation day, retain records enabling client liabilities to be reconstructed, and maintain a CASS 10A resolution pack. The REP027 monthly safeguarding return must be submitted within 15 working days after each month-end. Safeguarding of customer top-ups cannot be left unchecked until month-end, and safeguarded funds cannot be used as the company’s liquidity reserve.[2] [10] [11] [12]

Safeguarding audits and company financial statement audits should be assessed separately. SUP 3A requires relevant institutions to arrange safeguarding audits, but provides a small-amount exemption where they have not been required to safeguard more than GBP100,000 in relevant funds. The standard exemption test considers whether that amount was exceeded at any time over at least 53 weeks. At the time of this review, the transitional period from 2026-05-07 to 2027-05-14 was still in progress, during which the test instead runs from the rules' commencement. A full 53-week history must not mechanically be required of every new institution.[11]

Safeguarding audit reports must generally be submitted to FCA within four months after the end of the period covered, which must end no later than 53 weeks after the applicable starting point or the end of the previous period. For audit periods ending within 53 weeks after the rules take effect, transitional provisions extend the submission period to six months. This is not a universal six-month deadline after year-end for all institutions' financial audits. Any separate company-law audit obligation should be determined independently according to the legal entity type and actual audit exemption conditions.[11]

Customer funds received by SEMI to purchase electronic money must be safeguarded by law. Funds received from ancillary unrelated payment services may be safeguarded under PSR on an opt-in basis. Once that option is taken, a level of protection equivalent to that for authorised institutions must be adopted, and the choice and changes must be disclosed. Even without opting into PSR safeguarding, appropriate client asset protection must be arranged for unrelated payment business under the FCA principles. Segregation, eligible secure liquid assets, or insurance/guarantees must comply with specific rules; this is neither permission for arbitrary investment nor a blanket prohibition on all investment.[2] [11] [12]

AML customer due diligence, beneficial owner identification, ongoing monitoring and staff training must be maintained, and relevant AML records are normally retained for five years after the customer relationship ends or the transaction is completed. SAR concerning suspected money laundering or terrorist financing are submitted to UKFIU within NCA; FCA notifications of significant compliance incidents and OFSI sanctions reports are separate obligations. Applicable 2026 annual frozen asset reports must also take account of holdings as at month 9, day 30 and the deadline of month 11, day 30.[20] [21] [22]

Complaints about electronic money and payment services generally require a response within 15 business days. In exceptional circumstances beyond the institution’s control, this may be extended to 35 business days, with the reasons for the delay explained to the customer; an eight-week deadline cannot be applied across the board. Issuance and redemption at par must be implemented under EMR, with redemption conditions and lawful charges clearly disclosed in advance, and no interest or other benefits linked to the length of time electronic money is held may be granted. The Consumer Duty applicable to consumers should be reflected in products, charges, understanding and support arrangements.[2] [18]

For 2026/27, the periodic FCA fee for the G.11 category covering SEMI is GBP1,432, but this is not a cap on the institution’s total annual regulatory expenditure. Other applicable fee categories or levies for FOS, the Money and Pensions Service and similar bodies must be calculated separately based on actual activities and the FCA invoice. First-year prorating and annual fee schedule updates should also be checked separately.[15] [16]