Business scope and permission boundaries
Placing cash in customers' payment accounts and performing the operations required to operate those accounts falls under paragraph 1(a) of Schedule 1. It is a service scope for which API may apply, not a separate banking deposit-taking licence.[2] [19]
Application value and choice of route
Select the minimum sufficient combination of permissions that lawfully supports the actual business, client scope and financial responsibilities, rather than treating the broadest permissions or fastest approval as the sole objective.
Authorised payment services may be provided directly in the UK as a regulated entity, with customers and partners able to check the scope of authorisation through the FCA register. Unlike SPI, API is not subject to the registration ceiling of €300 × 10,000 in average monthly payment transactions, but must still meet the relevant capital and ongoing regulatory requirements.[1] [13]
Within the approved service scope, firms may establish merchant acquiring, payment account, money remittance or open banking payment initiation businesses and lawfully use registered payment agents. An agent network can expand delivery, but the institution remains responsible for the conduct of its agents, branches and outsourced providers. Authorisation cannot be rented out to independent operators.[6] [19]
Eligible API may apply for a Bank of England RTGS settlement account and corresponding direct payment system access to reduce reliance on commercial sponsor banks. Access does not come automatically with authorisation: it requires payment system admission, a FCA supervisory assessment and central bank review. SPI are not eligible to apply for this RTGS account.[13]
Application conditions and entry requirements
It must be demonstrated that payment accounts are used for payment transactions, clearly identifying when cash comes under the institution's or agent's control, and the cash handling, customer identification and account crediting processes. Agents providing UK payment services must first be registered; pure cash storage or transport cannot be brought within this authorisation merely by its label.[2] [19]
Shareholders, directors and key personnel
Shareholders and controllers: disclose direct and indirect ownership chains, voting rights, group and close links, and identify the ultimate natural persons. Persons or institutions holding 10% or more of capital or voting rights, or able to exercise significant influence despite holding less than 10%, must submit qualifying holding information; screening solely against the Companies House beneficial ownership registration threshold is insufficient.[5] [6]
Directors and business managers: all management committee members must register, corresponding to directors for limited companies and members for LLP, including those actually managing regulated payment business. Applications use payment institution personnel information procedures such as PSD Individual, focusing on reputation, knowledge, experience, other appointments and actual responsibilities, rather than assigning a fixed SMF number to every API director.[5] [6] [9]
Compliance and anti-money laundering: a Head of Compliance and/or MLRO should normally be registered, with clearly defined responsibilities for business management, compliance oversight and suspicious activity reporting. Whether functions may be combined depends on size, complexity, conflicts of interest and effective oversight. The verified rules do not require every API to employ separate full-time CRO, CTO and CFO, nor is there a universal ICA certificate requirement.[5] [6] [15]
Local substance: the head office assessment focuses on the location of the directors and senior management making central direction and significant day-to-day decisions, and the location of administrative functions such as central compliance and internal audit. Evidence should show that the UK entity can control banking arrangements, client funds, systems risks and outsourcing, rather than merely retain a UK correspondence address. Neither 'everyone must be a UK national' nor 'at least two UK-resident directors' should be treated as a verified universal condition.[1] [5]
Individual accountability: payment service institutions authorised solely under PSRs, without FSMA authorisation, do not thereby fall within SM&CR, but must still meet payment legislation requirements on personnel suitability and management responsibility. If the same legal entity also holds permission for FSMA regulated business, assess separately the scope of SM&CR arising from that permission rather than using API status to generalise across all circumstances.[21] [22]
Capital and financial resources
Initial capital for this service is €125,000, even if no application is made for the other services in point 1(a) to (e). Ongoing own funds are calculated separately using the method directed by FCA, with the higher of that amount and the initial floor required. Customer cash cannot count as firm capital.[3] [4]
Registered office and operational substance
The registered office, if any, and head office of API must both be in the UK; the head office is not merely a registered address for receiving mail. The official FCA Approach states that a UK virtual office does not satisfy regulation 6(4) of PSRs; supervision focuses on the actual location of central decision-making and administrative functions.[1] [5]
The law does not require all API to be located in London, occupy a fixed office area or have a uniform lease term. Premises and team arrangements should match the business, customers, data and outsourcing oversight. An overseas shareholder's or Hong Kong adviser's address cannot replace the applicant entity's UK head office; changes to the UK correspondence address should also be reflected in FCA information and relevant company registration matters addressed.[5] [9] [19]
Application document checklist
Legal entity and organisational information: UK formation documents, applicable articles of association or LLP members' agreement, head office address, organisational structure and business responsibility charts. Documents must demonstrate that the UK entity can lawfully conduct the proposed activities; the PSRs requirement to provide articles of association does not universally require every company's articles to include the exact words “payment services”.[1] [5]
Business scope and fund flows: the programme of operations must describe each payment service applied for, with customer contracts, product descriptions, fund flows and the roles of relevant partners. Where commercial agent, purely technical service or limited network exclusions are involved, provide the relevant contracts and applicability analysis, not merely an exemption label.[2] [5]
Three-year business and financial plan: submit forecast budgets, profit and cash flow, capital calculations and key assumptions for the first three financial years. Also explain stress scenarios, liquidity sources, and orderly wind-down triggers and costs, ensuring that safeguarded balances are not counted as available operating cash.[1] [5]
Evidence of capital: provide paid-up capital or other eligible capital items, evidence of bank receipt and corresponding company filings or financial information. FCA guidance allows evidence of capital to be submitted at a later stage before authorisation, but compliance with the requirements must be demonstrated before approval; unfulfilled funding commitments cannot be treated as paid-up capital.[3] [5]
Shareholder and controller documents: the complete ownership and voting-right chain, an information form for each qualifying holder, and evidence of sources of funds and financial soundness. LLP must also analyse whether members’ agreements, veto rights or unanimous consent arrangements give members with less than 10% of voting rights significant influence.[5] [6]
Personnel materials: personal forms, curricula vitae, responsibilities, qualifications and other appointments for all relevant directors, members and persons responsible for payment management, with disclosures of criminal, regulatory, litigation and bankruptcy matters. Specific certification and background documents depend on FCA forms and case-specific requirements. Do not claim universally that every curriculum vitae must be notarised, or treat the outdated CRB name as the statutory application document for all personnel.[5] [6] [9]
Client money safeguarding documents: identification of relevant funds, segregation or insurance/guarantee arrangements, due diligence on eligible third parties, account acknowledgement documents, internal and external reconciliations and shortfall procedures. Also provide a CASS 10A resolution pack and arrangements for implementing CASS 15, SUP 3A and SUP 16.14A. A pure PIS/AIS model that does not hold funds should explain why the relevant safeguarding requirements do not apply.[5] [10] [11]
Compliance and AML documentation: business risk assessment, customer due diligence, enhanced due diligence, beneficial owner identification, ongoing monitoring, suspicious activity reporting, record-keeping and training procedures. Money-remittance-only businesses or other cases supervised by HMRC must also provide applicable HMRC registration or application information and confirm consistency between the institution and agent registration structures for the same business.[5] [14] [15]
IT, security and business continuity: security policies, sensitive payment data controls, incident and complaint follow-up procedures, recovery plans and test records. Explain how outsourced technology platforms, payment system access, statistical methodologies and fraud data support regulatory reporting, rather than merely providing a generic security certification.[5] [7]
PIS/AIS professional indemnity insurance: submit the minimum cover calculation, the full proposed policy or guarantee, and the service territories, explaining coverage of relevant liabilities for unauthorised transactions or unlawful access to account data. Institutions providing only acquiring or money remittance services cannot apply the same PII requirements without analysis. Safeguarding insurance and PIS/AIS professional indemnity insurance also serve different legal purposes.[1] [5]
Customer documents and audit arrangements: fee and exchange-rate disclosures, framework contracts, customer identification and complaints channels, transaction authorisation and refund procedures, together with auditor details, if any, and applicable audit arrangements. Evidence should also demonstrate agent and branch inspections, outsourcing oversight and allocation of responsibilities. Required evidence is determined by Schedule 2 to PSRs and the actual activities applied for.[5] [7] [20]
This is provided as a reference for organising the project; it cannot replace current official application forms or case-specific requests for additional materials. Please do not send identity documents or customer records through website forms.
Application process and key steps
First, determine the business perimeter and the specific statutory services for which permission will be sought, assessing separately whether API, SPI, RAISP or electronic money authorisation is appropriate. Map fund control, customer contracts and payment flows clearly, and address other permissions separately where involved. Do not first buy a “fully licensed company” and then assume that all products are already authorised.[1] [2] [5]
Second, establish an eligible UK legal entity, substantive head-office presence, ownership and payment governance arrangements, and determine staffing, capital and banking plans. Preparations must bring systems, security, customer fund reconciliation and exit capabilities to a level that can be demonstrated to FCA. Consultant-prepared documents do not replace directors’ management responsibilities.[1] [5]
Third, prepare materials in accordance with Schedule 2 and the FCA payment institution application guidance, using FCA’s pre-application support service PASS where necessary. For mixed payment services, division of HMRC responsibilities, agent networks or complex fund flows, clarify applicable requirements in advance to avoid contradictions between the entity, services and banking arrangements described in the materials.[5] [6] [7]
Step four: submit the API authorisation application and corresponding controller and personnel information through FCA Connect, and pay the non-refundable application fee. As at the verification date, applications covering only API activities under points 1(f) to (h) fall within category 4, £2,820; those involving points 1(a) to (e) fall within category 5, £5,640. Application fees are separate from annual regulatory fees after approval; the original guide's amount of £1,500 should not be reused.[6] [7] [8]
Step five: FCA checks minimum information, completeness and eligibility, and may request supplementary information, explanations of financial models, system demonstrations or staff interviews. Submissions lacking minimum information or the correct fee may be returned without substantive assessment. The statutory clock for a complete application cannot simply be calculated from the date materials were first uploaded.[1] [7]
Step six: upon receiving the decision, check the permitted services, restrictions, conditions and effective date, and verify the entity on the Financial Services Register. Agents must be registered before providing payment services in the UK on behalf of the institution. Central bank RTGS and direct payment system access require separate applications under their own procedures and cannot be assumed to have been obtained on the day API is approved.[1] [6] [13] [19]
Approval deadlines and project timelines
Statutory authorisation deadlines: section 9 of PSRs requires FCA to decide within three months of receiving a complete application; for an incomplete application, FCA may decide, but must do so no later than twelve months after receipt. This deadline also applies to variations of the scope of authorisation. It is a deadline for a decision, not guaranteed approval, and does not mean every project takes a fixed three months from preparation to operation.[1]
Preparation: legislation sets no uniform period for incorporation, recruiting UK management, securing safeguarding accounts, system testing, PII or preparing a three-year plan. The original guide's “1 to 3 months of preparation” and “2 to 9 months of substantive review” are estimates unsupported by case data; the latter cannot replace the statutory three-month period for complete applications. Consulting quotations should provide separate timelines for outstanding tasks rather than combine preparation and regulatory assessment.[1] [5] [7]
Ancillary procedures: for a separate payment agent registration application, regulation 34(11) of PSRs requires notification of the decision within two months of receipt of a complete application. Applications combined with the main authorisation application follow the relevant authorisation procedure. Changes in control are normally assessed within 60 working days of a complete notification, subject to lawful interruption. Official central bank guidance recommends allowing at least twelve months for direct access to payment systems even after completing the work relating to FCA; this must not be described as the statutory authorisation period for API itself.[13] [17] [19]
Changes to shareholders, directors and permissions
Control: anyone deciding to acquire or increase control over API should notify FCA and obtain approval before implementing the transaction. Where the 10%, 20%, 30% or 50% control thresholds are involved, or a holding enabling significant influence is acquired, it is not sufficient to consider only the first crossing of 10%. Reducing or ceasing control also requires prior notification, but generally does not require approval for the reduction.[5] [16]
Control review: FCA generally has 60 working days to assess a notification from when it is deemed complete. Statutory information requests may interrupt the clock for up to 30 working days. Acquisition funding, group structure, controllers' reputation and financial soundness, and the target's ability to continue meeting authorisation conditions must all be disclosed. The obligation of API itself to notify proposed material changes exists alongside the buyer's notification.[5] [16] [17]
Directors and responsible persons: additions, replacements or removals of persons managing payment services should be notified to FCA through the relevant individual information process in Connect. Proposed personnel changes should be notified in advance. Actual or proposed changes to MLRO should be notified without undue delay. For API holding only payment authorisation, this procedure should not be described as requiring all senior executives to apply for prior SMF approval.[6] [9] [21]
Business and operations: adding or removing payment services requires an application for variation of authorisation; activities outside the authorised scope must not commence before approval. Material changes to the head office, substantive business, close links, material outsourcing, or the bank or method used to safeguard customer funds must also be notified in advance or promptly under the applicable requirements. A change in the company's legal entity must not be assumed to transfer the existing authorisation automatically.[1] [4] [5] [19]
Ongoing compliance and annual maintenance
Relevant client money segregation, reconciliation, consistency between cash and ledgers, and applicable monthly safeguarding returns must be maintained. Cash agent networks must fall within AML monitoring and the institution's responsibility; outsourcing cash operations does not relieve the authorised entity of responsibility.[10] [15] [19]
Acquisition due diligence and transaction considerations
Transaction target checks: API authorisation belongs to a specific legal entity. Retaining the same entity through a share acquisition does not remove change-in-control approval requirements, and an asset acquisition or business migration cannot directly transfer authorisation. Due diligence should verify the legal name, company number, services actually permitted, restrictions, agents and regulatory correspondence against the FCA register, focusing on whether the target already faces cessation of business, suspension of new customers, safeguarding remediation or withdrawal of authorisation.[1] [5] [16] [18]
Payments-specific financial due diligence: reconstruct relevant funds and internal and external reconciliations using customer ledgers, the general ledger, bank records and acquiring settlement information. Examine safeguarding shortfalls, unallocated funds, funds in transit, merchant reserves, refunds and chargeback obligations. Verify the actual applicability of the £100,000 safeguarding audit threshold and the 2026-year transitional period, review audit opinions and remediation, and separately recalculate eligible own funds, double use of group capital and wind-down funding. Do not rely solely on ordinary account balances and the latest balance sheet.[3] [4] [5] [10] [12]
Operational and licensing continuity: check each safeguarding bank, sponsor bank, card scheme, payment system, technology and insurance contract for change-of-control, termination or renewed due diligence clauses. If the buyer plans to replace head office personnel, products, agent networks or outsourced platforms, a plan for continued compliance with UK substance, permission and safeguarding requirements should be designed before completion. Existing central bank RTGS or direct system access relationships remain subject to separate admission conditions and are not guaranteed to continue unconditionally following completion of the share transaction.[4] [5] [13]
Customer and financial crime risks: examine the quality of payer and merchant due diligence, agent oversight, historical complaints and scam compensation, chargeback losses, sanctions screening and handling of suspicious activity, and confirm the division of AML supervisory responsibilities for HMRC/FCA. For supposedly licensed but inactive targets, verify statutory revocation factors such as twelve months after approval and cessation of business for more than six months. Transaction valuations should not mistake UK API for permission to issue electronic money, accept deposits or passport into the EU.[1] [5] [14] [19]
View the complete process for acquiring a licensed companyBusiness segments and applicable regimes
The following are specific permissions, organisational models or statutory categories covered by this topic. They do not necessarily each constitute a separate financial licence.
Frequently asked questions
Is API a UK banking licence or electronic money licence?+
No. API authorises only permitted payment services within the scope of PSRs, and payment accounts may be used only for payment transactions. It does not permit accepting bank deposits or issuing electronic money, nor does it automatically include permission for investment, consumer credit or other financial activities.[2] [5] [19]
Can I apply for API if average monthly payments are below €300 × 10,000?+
Yes. API has no minimum transaction volume threshold; €300 × 10,000 is the registration ceiling for the average monthly payment transaction value of SPI over the preceding twelve months, including relevant agent transactions. SPI cannot provide PIS or AIS, so a low business volume does not mean SPI can replace open banking authorisation or registration.[1] [13]
Must a provider of account information services only pay €50,000?+
No. The statutory initial capital entry for AIS states that there is no requirement; €50,000 applies to PIS. Conducting only AIS generally follows the RAISP registration route, but applicable PII or a comparable guarantee, personnel and security arrangements are still required. No initial capital requirement does not mean no compliance-resource requirements.[1] [3] [5]
Can a UK LLP apply for API? What about a UK branch of an overseas company?+
A LLP established under UK law has body corporate status, and official FCA guidance expressly lists it as an example eligible to apply for API. API still requires a UK head office and, where applicable, registered office. An overseas company merely registering a UK branch does not satisfy the same UK-incorporated legal-entity condition; electronic money institution rules for overseas branches must not be imported into API.[1] [5]
Are two UK-resident directors mandatory, and must SMF1, SMF16 and SMF17 be applied?+
The verified API authorisation conditions require sound governance and suitable personnel; there is no statutory checklist universally requiring two UK-resident directors. Payment service providers authorised solely under PSRs are not subject to SM&CR by virtue of that authorisation and use the payment services individual information procedure. The SM&CR obligations of the same entity holding additional FSMA authorisation require separate assessment.[1] [5] [6] [21]
Is £1,500 the current API application fee?+
No. As at 2026-11-07, the FCA fees page shows an application fee of £2,820 for activities under API, paragraph 1(f) to (h), and £5,640 where paragraph 1(a) to (e) is involved. SPI and RAISP fall within category 3 £1,130. Application fees are non-refundable, and separate annual regulatory fees remain payable after approval.[8]
If a complete application takes three months, why might the project take longer?+
The three months runs from when FCA receives a complete application and is a decision deadline, not a period covering all establishment, recruitment, account opening and systems development. For incomplete applications, the statutory maximum is twelve months from initial receipt. Supplementary information and completeness issues must not be obscured by a consultant’s estimated approval timeframe.[1] [7]
Does client money safeguarding mean full compensation from FSCS?+
They are not equivalent. If a non-bank API fails, client funds are not protected by that institution’s FSCS, but depend on safeguarding and repayment through liquidation or administration. FCA consumer guidance expressly states that repayment may take time and may not be in full because administration or liquidation costs may be deducted. It must not be promoted as a state guarantee or immediate compensation.[18]
Have the 2026-05 safeguarding reforms already been implemented?+
The supplementary regime took effect on 2026-05-07, requiring applicable firms to implement matters including CASS 15, resolution packs, safeguarding audits and monthly REP027. The original PSRs safeguarding provisions remain applicable. PS25/12 has reserved further consideration of Post-Repeal arrangements replacing the statutory regime; the proposed replacement statutory trust regime must not be described as already fully in force.[10] [11] [12]
Must all API undergo the same audit every year?+
No. Ordinary financial statement audits, separate accounting information for payment business, and SUP 3A safeguarding audits are different obligations. Pure PIS/AIS and safeguarding audit threshold exemptions require separate assessment, and specific transitional provisions also apply from 2026 to 2027. Small-company status under company law cannot simply negate a safeguarding audit requirement, nor can it be said that all API must undergo the same comprehensive annual AML audit.[4] [5] [12]
Can an acquired ready-made API immediately change shareholders and products and start operating?+
Transactions triggering acquisition or increase of control require prior FCA approval. Expanding payment services separately requires the corresponding variation of authorisation. Buyers should also check UK substance, continuity of safeguarding bank and commercial sponsorship agreements, historical shortfalls and authorisation restrictions. A so-called licensed shell is not exempt from the risk of cancellation for failure to commence business after approval or prolonged inactivity.[1] [5] [16] [17]
Does approval of API automatically provide access to Faster Payments or central bank RTGS?+
No. Direct access requires separate reviews by the payment system operator and the central bank. The FCA supervisory assessment usually includes an s166 report and remediation before non-objection is provided. Central bank guidance states that FCA generally requires the institution to have actually conducted regulated activities for at least nine months before that s166 assessment, and recommends planning for at least a further twelve months for direct access thereafter. These steps cannot be combined with API authorisation into a three-month commitment.[13]
Does holding UK API allow payment services to be provided directly in the EU or worldwide?+
No. Post-Brexit UK API has no EU/European Economic Area passporting rights. Access and customer service arrangements in other jurisdictions must still be assessed under local law. Cross-border remittance may be UK business permitted for API, but this does not mean all necessary permissions have been obtained at the destination, in the customer's location or for overseas group entities.[5] [13]
Must pure payment gateways, gift cards or commercial agents all apply for API?+
There is no uniform answer. Pure technical support arrangements that never possess funds being transferred may be excluded, but PIS and AIS cannot rely on that technical exclusion to fall outside regulation. Limited network instruments must meet restricted-use conditions. Commercial agents must act for either the payer or the payee, not both, and have authority to negotiate or conclude transactions for goods or services. Product names alone do not determine eligibility.[2]
Official basis and verification sources
Primarily based on FCA, PRA / Bank of England, GOV.UK and current legislation. Older third-party guides supplied by users are used to organise business material and do not override the latest official requirements.
Tang Shangyong (Mr Tang / Drew) · Business Manager
Global financial licence application, transaction and ongoing compliance services