Business scope and permission boundaries
Corresponding to paragraph 1(a) of Schedule 1 to PSRs, this supports cash deposits into payment accounts and the operations required to maintain those accounts. These accounts must be used for payments; an account name resembling a bank account does not constitute permission to accept deposits.[4] [18]
Application value and choice of route
Select the minimum sufficient combination of permissions that lawfully supports the actual business, client scope and financial responsibilities, rather than treating the broadest permissions or fastest approval as the sole objective.
SPI is not subject to the uniform initial capital and ongoing own funds calculation regime for API, making it suitable for small remittance or payment businesses with controlled transaction volumes. This advantage is only a simplification of the regulatory capital regime; it does not mean a business may operate without working capital or refund resources, or use customer payments to meet company costs.[2]
SPI permits applications from natural persons, ordinary partnerships and appropriate corporate or incorporated partnership entities, not only UK Ltd companies. Application materials must address actual payment flows, managers and transaction-volume monitoring. The small-institution route does not remove responsibilities for personnel fitness and propriety, AML, information security or complaints.[1] [2]
Eligible SPI may first establish local operations and a compliance record within a limited scale, and plan a API application before the business grows. Registration status can be checked on the FCA register, but does not guarantee a commercial bank account, payment network access, acquiring partnerships or FSCS compensation for customer funds.[2] [19]
Application conditions and entry requirements
Explain the account provider, cash collection locations, crediting times, customer authentication and funds routes, and include transactions executed by agents in the SPI scale calculation. If account balances substantively constitute electronic money, reassess the EMR route; issuance regulation must not be bypassed merely by describing the activity as “account operation SPI”.[1] [2]
Shareholders, directors and key personnel
Shareholders and controllers: SPI has no uniform requirement for British shareholders or a minimum local shareholding, but qualifying holders must pass a fitness assessment. Applications must disclose the group structure, ultimate natural persons, direct and indirect control, significant influence arrangements, sources of funds and overseas close links that may impede supervision; listing nominee shareholders alone is insufficient.[1] [3]
Directors and business managers: FCA requires registration of all management committee members, corresponding to directors for limited companies and management committee members for LLP, together with managers directly responsible for payment business. The head of compliance or money laundering reporting officer will usually fall within registration scope, but not every customer service or technical employee needs registration; there is no universal 'two UK-resident directors' headcount standard for all SPI.[2] [3]
Compliance and anti-money laundering: responsibility for AML oversight and the nominated officer receiving internal suspicious activity disclosures should be clearly identified. Regulation 21 of MLR also requires payment service providers to designate an individual to monitor and manage AML policies and provide relevant information to senior management at least annually. A compliance lead at board or senior management level and an independent AML audit function are required as applicable to the size and nature of the business. It must not be stated that all roles must invariably be separate, full-time and absolutely prohibited from being outsourced. For natural persons operating individually, the specific exceptions in regulation 21(6) must also be checked.[16]
Local substance and individual regimes: the management team should be able to exercise actual control over UK payment operations, oversee agents and outsourcing, and provide records and make decisions when queried by FCA. An institution holding only SPI registration does not enter SM&CR by virtue of that registration and should not submit SMF1, SMF3, SMF16 or SMF17 as applications for statutory SPI roles. If the same entity also holds FSMA authorisation, the individual regime arising from that authorisation must be assessed separately.[2] [12]
Capital and financial resources
Registration under SPI carries no dedicated minimum regulatory capital amount for account operation, but operational resources must still be arranged for cash handling, refunds and reconciliation. Only on becoming an API providing such services do the €125,000 initial capital and ongoing own funds regimes apply; customer funds are not that capital.[2]
Registered office and operational substance
The application should list the UK head office, registered office and principal place of business and, where applicable, the individual's UK residence. Regulatory assessment focuses on UK connections and supervisability appropriate to the actual organisational form; there is no universally applicable requirement for office floor area, rent or a London location.[1] [2]
Merely renting a registered address cannot replace an assessment of head office location. Actual central management, oversight of payment operations and arrangements for access to information must be demonstrable. If shareholders and part of the team are overseas, explain how the responsible persons in the UK will continue to perform their duties, how FCA can access records, and how overseas service providers will not restrict supervision. A UK branch of an overseas company does not automatically become a SPI merely through Companies House registration.[2]
Application document checklist
Entity and signatory documents: submit the applicable company or partnership formation documents, constitutional documents, identity and address information, and authority to sign the application. FCA guidance distinguishes signatories: the individual for a sole trader, two partners for a general partnership, the director for a single-director company, two directors for a multi-director company, two members for an LLP, and the general partner for a limited partnership. A blanket requirement for “two company directors to sign” is inappropriate.[2]
Payment services business description: map actual products against Schedule 1, attaching customer journeys, funds-flow diagrams, contracting entities, agents' responsibilities and key partnerships. Explain whether accounts are provided and who is responsible for payment execution and refunds, and explicitly exclude AIS, PIS and electronic money issuance. Avoid using only the broad description “payment platform”.[1] [2]
Twelve-month transaction volume documentation: existing businesses should provide historical monthly transaction amounts, agent transaction amounts and euro-conversion working papers; new businesses should provide substantiated twelve-month transaction forecasts. Also include rolling-average monitoring, threshold alerts and escalation arrangements. Company revenue or client fund balances must not substitute for the total value of payment transactions.[1] [2]
Controller and group materials: set out direct and indirect ownership, voting rights, ultimate controllers, significant influence and close links, and submit the relevant FCA form for each qualifying holder. Supplement this with sources of funds, financial background, regulatory history and organisational evidence as required by the application. A screenshot of PSC from Companies House alone does not constitute complete controller disclosure.[1] [3]
PSD management information: submit individual forms, career histories, responsibilities and fitness and propriety disclosures for all applicable directors, management committee members and persons responsible for payment business. The compliance officer and MLRO should be included according to their actual management remit. These materials are not SMF application forms or mandatory annual certification documents under SM&CR.[3] [12]
AML policies and risk assessments: include customer and beneficiary due diligence, risk classification, enhanced due diligence, sanctions risk management, transaction monitoring, internal disclosures and procedures for reporting to NCA. If supervised by HMRC, attach the registration number or evidence of application and confirm the conditions for commencing business; if AML is supervised by FCA, explain the basis for not requiring duplicate HMRC registration.[2] [16] [17]
IT and payment security documents: explain system functions, access rights, sensitive data retention and controls, fraud statistics, fault handling, backup and recovery, and major security incident reporting. Outsourced services should be supported by contracts, oversight mechanisms and record access arrangements demonstrating that the applicant retains control of its payment business rather than relying entirely on suppliers.[2]
Customer contracts and complaints documents: prepare usable fee and exchange-rate disclosures, execution and refund terms, customer support processes and complaint recording mechanisms. PSD complaints normally require a final response within 15 business days, extended to a maximum of 35 business days in exceptional circumstances beyond the firm's control, with information on applicable Financial Ombudsman Service channels.[2] [19]
Protection of funds and account documentation: if safeguarding is chosen, explain the segregated account or insurance or guarantee method, due diligence on the bank or insurer, acknowledgement letters, internal and external reconciliations and the resolution pack. If it is not chosen, explain customer asset protection and risk disclosures; ordinary company accounts or “daily balance checks” must not simply be labelled compliant safeguarding.[2] [13] [15]
Financial and operational resource documentation: provide operating budgets, funding sources, cash flows and existing financial statements according to actual needs, explaining requirements for refunds, fraud losses and partner reserves. There is no uniform minimum capital evidence requirement for SPI. Three-year forecasts may serve as business planning but must not be described as a fixed statutory attachment for all SPI; ultimately, the Connect questions and FCA case-specific requirements prevail.[2]
This is provided as a reference for organising the project; it cannot replace current official application forms or case-specific requests for additional materials. Please do not send identity documents or customer records through website forms.
Application process and key steps
First, determine the business perimeter and select the entity, establishing whether the activities genuinely constitute payment services under Schedule 1, whether electronic money is issued, and whether AIS or PIS is included. Calculate twelve-month transaction volumes including UK agents and confirm that SPI applies, rather than incorporating first and then guessing the registration category from product names.[1] [4]
Second, establish actual UK operations, managers and the division of AML supervisory responsibilities, and complete controller identification and source-of-funds preparations. Money-remittance-only businesses should also check HMRC registration and restrictions on starting operations, while integrated payment models should check FCA’s AML supervision. The two situations must not be conflated.[2] [17]
Third, establish workable payment security, customer terms, complaints and scale-monitoring processes, and decide whether to safeguard customer funds voluntarily. The necessary banking, technology, agent or insurance arrangements should support the declared business. Application documents must reflect actual readiness, rather than template promises that have not been implemented.[2] [13]
Step four: complete the SPI application and personnel and controller forms in Connect, upload the required evidence and pay the correct current application fee. FCA may decline to assess submissions lacking minimum necessary information or the correct fee. Payment and clicking submit do not mean the application has been deemed complete.[3] [6]
Step five: FCA reviews the information, with supplementary transaction forecasts, personal background information, AML, IT or safeguarding evidence supplied as requested. The statutory three-month period for a complete application starts when all information needed for a decision is available. Respond within the case officer's deadlines rather than treating every enquiry as an “exceptional extension to six months”.[2] [8]
Step six: upon receiving the decision, check the registration effective date, permitted payment services and any restrictions before arranging the formal launch and regulatory reporting accounts. Agents must complete FCA registration before providing payment services on behalf of the institution. Obtaining SPI status does not automatically authorise all agents, brands or new products.[2] [3]
Approval deadlines and project timelines
Statutory decision deadlines: section 9 of PSRs applies to SPI registration through section 15. A complete application must be decided within three months of FCA receiving the complete information; an incomplete application must be decided no later than twelve months after initial receipt. These are decision deadlines, not guarantees of approval; persistently incomplete information may result in refusal. They must not be rewritten as “three months for complete applications, exceptionally extended to six months”, nor may the 60 working days for change-of-control assessment be treated as the deadline for SPI registration or an upgrade to API.[2] [8] [9]
Preparation: company or partnership arrangements, securing UK managers, HMRC processes, banking cooperation and system testing are pre-submission or parallel preparation and are outside the three-month complete-application period above. Internal consulting schedules may initially budget around 8 to 12 weeks for preparation, adjusted to actual banking and staffing readiness. This is only a planning estimate, not an average or service commitment published by FCA. Complex overseas ownership, agent networks and unresolved funding accounts may significantly extend preparation and enquiries.
Changes to shareholders, directors and permissions
Changes in control: paragraph 5 of Schedule 6 to PSRs applies the Part 12 control regime of FSMA to SPI. It must not be incorrectly stated that SPI requires only post-completion notification. A proposed acquisition or increase of control crossing the 10%, 20%, 30% or 50% threshold, or creating significant influence, requires notification and FCA approval before implementation. Reducing or relinquishing control also requires prior notification, but this is not the same application for approval to increase control.[2] [10]
The statutory control assessment period is generally 60 working days from when the notification is considered complete, and may be lawfully interrupted for further information. FCA guidance explains that, where conditions are met, the interruption may extend to an additional 30 working days. Transaction arrangements should make regulatory approval a condition precedent to completion. The licensed entity should also promptly make its own notification when it becomes aware of a proposed change; “sending an email 30 working days in advance” cannot replace approval.[2] [11]
Changes in directors and managers: new directors and persons directly responsible for payment services should be notified through Connect before appointment, with personal information provided. Under FCA guidance, removals should be notified no later than seven working days after the event. Actual or proposed changes in MLRO should be notified without undue delay; relevant appointments of persons responsible for AML under regulation 21 of MLR must also be notified to the AML competent authority within fourteen days. This is distinct from whether SM&CR applies to SPI.[2] [3] [16]
Business and scale changes: adding or removing registered payment services requires the registration variation process; adding AIS or PIS cannot be done simply by adding them to the existing SPI registration. On becoming aware that the SPI size criteria are no longer met or that services beyond the scope permitted for SPI are intended, a firm wishing to continue providing payment services in the UK must apply for authorisation within thirty days under regulation 16 and arrange cancellation of its existing registration. Loss of other eligibility conditions must be notified to FCA immediately, rather than waiting for the annual report.[2]
Ongoing compliance and annual maintenance
Continue reconciling cash collections, agent ledgers and customer accounts to prevent temporarily held cash being mistaken for company revenue. If safeguarding is elected, CASS 15 and REP027 monthly reporting apply; also maintain FSA057, AML cash risk controls and complaints mechanisms.[2]
Acquisition due diligence and transaction considerations
Transaction target verification: the purchase concerns a legal entity or business, not an “SPI licence” that can be detached from the original entity and transferred. First verify the actual legal entity, registration status, service categories, restrictions, agents and brand relationships in the FCA register, then check Companies House records, liabilities, regulatory correspondence and whether cancellation is underway. A sole-trader or asset acquisition cannot directly use the seller’s personal registration.[2] [19]
Scale and business due diligence: at a minimum, reconstruct rolling twelve-month payment transaction volumes including all UK agents, checking euro conversion and whether revenue has incorrectly been treated as transaction volume. Sample actual wallets, prepaid cards, merchant accounts and open banking interfaces to confirm that electronic money is not being issued or AIS/PIS provided under the name of SPI, and that agents or brands have not been split to circumvent the €300 × 10,000 monthly average threshold.[1] [2]
Client money and AML due diligence: reconcile customer obligations, bank balances, segregation arrangements, the legal nature of accounts and existing shortfalls daily, and establish whether the firm has declared its election to safeguard to FCA and submitted 2026 monthly returns on time. Review high-risk countries, agents, beneficiary identification, transaction monitoring and the history of NCA reporting, and confirm the HMRC supervisory registration required for remittance-only business. Continued registration does not prove that historical client money and AML issues have been resolved.[2] [15] [17]
Completion and operational continuity: obtain prior FCA consent according to the control thresholds, and implement arrangements for new directors, MLRO and effective management in the UK. Shareholders must not be changed first with approval sought afterwards as a “notification update”. Bank account, acquiring, insurance, agency and technology contracts may contain change-of-control termination or renewed due diligence clauses. Check these and obtain required counterparty consents, while agreeing responsibility mechanisms for historical refunds, complaints, funding shortfalls and information handover.
View the complete process for acquiring a licensed companyBusiness segments and applicable regimes
The following are specific permissions, organisational models or statutory categories covered by this topic. They do not necessarily each constitute a separate financial licence.
Frequently asked questions
Is SPI a licence or a registration?+
Its formal legal status is small payment institution registration under FCA, not authorised payment institution status or banking authorisation. In the Chinese-language market, this may be explained as eligibility to enter the market, but customer terms and websites should expressly state ‘a small payment institution registered with FCA’, avoiding claims of full authorisation or government endorsement.[1] [3]
Must €300 × 10,000 never be exceeded in any month?+
No. The statutory core is the monthly average of total payment transactions over twelve months, including UK agents. A monthly peak requires immediate recalculation of the rolling average and review of future business arrangements, but exceeding €300 × 10,000 in one month does not mechanically establish a breach. Nor may only own-business transactions be counted while ignoring agents.[1] [2]
Does SPI require minimum capital of €50,000 or £50,000?+
There is no such uniform SPI minimum regulatory capital threshold, and several capital figures on the original page conflict. The €50,000 for API is used for PIS; SPI itself cannot undertake PIS. Operating funds, bank reserves and application fees should still be budgeted separately.[1] [2]
Can SPI issue electronic wallets or prepaid cards?+
The product name alone is insufficient. Issuing payment instruments and issuing electronic money are different activities. If an instrument represents electronically stored monetary value issued on receipt of funds and accepted by persons other than the issuer, access under EMR must be assessed separately. SPI registration does not itself confer eligibility to issue electronic money.[2]
Can SPI be used for open banking simply because no client money is held?+
No. The registration conditions for SPI expressly exclude AIS and PIS; not handling client money does not change that restriction. Only AIS may be assessed for the RAISP route, while including PIS requires appropriate authorisation. Adding both to a description of SPI technical services does not permit operations.[1] [2]
Must it be a UK Ltd with two UK directors?+
Applicants for SPI may include sole traders, ordinary partnerships and appropriate corporate or partnership entities; FCA also specifies their respective application signatories. Actual UK location and supervisability must satisfy the requirements for the organisational form, but there is no uniform rule requiring all SPI to have two UK-resident directors or to be Ltd companies only.[1] [2]
Is MLRO necessarily SMF17?+
No. SPI registration alone does not make SM&CR applicable. Registration of MLRO or payment managers and the obligations of the person responsible for AML arise under a separate regime. Responsibilities should be implemented through PSD personnel registration under FCA and Article 21 of MLR. Only if the same entity also holds FSMA authorisation should SMF requirements be assessed separately.[3] [12] [16]
Must SPI also register with HMRC?+
Not all SPI require duplicate HMRC registration. Institutions already subject to AML supervision by FCA generally do not need duplicate registration. Remittance-only and similar models are usually subject to AML supervision by HMRC. Actual activities and supervisory responsibilities must be checked; a FCA payment services registration number does not automatically replace HMRC registration.[2] [17]
Do the new 2026 rules require all SPI to segregate client money?+
No. FCA PS25/12 retains the voluntary safeguarding opt-in for SPI, and the new Supplementary Regime takes effect on 2026-05-07. Those opting in should apply the same protection standards as CASS 15 and submit REP027 monthly reports. Those not opting in must still consider appropriate client asset protection and explain risks accurately.[2] [13] [14]
Does choosing safeguarding require a SUP 3A statutory audit every year?+
SPI is not a API or EMI entity subject to mandatory audit as listed in SUP 3A.1.1R. The final rules provide voluntary audit guidance for such institutions. Company financial statement audits, independent AML audits applicable according to size and nature, and voluntary safeguarding audits must be assessed separately. “Funds exceeding £100,000” does not directly establish that SPI falls within the API audit regime.[15] [16]
Is client money protected by FSCS if SPI fails?+
No. The FCA consumer page makes clear that client funds are not compensated by FSCS if SPI, API or EMI itself fails. Even with safeguarding arrangements, funds must be returned through liquidation or administration, which may take time and involve deducted costs. This should not be promoted as a full guarantee equivalent to bank deposits.[19]
Is a complete application certain to be approved within three months?+
Three months is the statutory decision period after FCA receives complete information, not a guarantee of approval, and it does not run from the start of internal preparations. Incomplete applications must be decided within twelve months at the latest and may be refused; application fees are non-refundable. Separate time should be budgeted for banking partnerships, HMRC, personnel and systems preparation.[2] [6] [8]
When buying an SPI, do you complete first and then notify FCA?+
No. SPI is subject to the change-in-control regime introduced by Schedule 6 to PSRs. Acquiring or increasing control across relevant thresholds requires prior FCA consent. Due diligence should also cover transaction volumes, client money, AML and partnership contracts, with approval and necessary contractual consents made conditions of completion. SPI must not be treated as a licence that can be separated from the original entity and sold.[2] [10]
When should an application for API be made after exceeding the size limit?+
On becoming aware that the relevant SPI conditions are no longer met, an entity intending to continue providing payment services in the UK should apply for authorisation within thirty days under Article 16 as described in the FCA guidance, and arrange cancellation of its previous SPI registration. Thirty days is an application obligation, not an approval deadline or assurance of permission to expand freely during that period. Preparations to upgrade should begin before an anticipated threshold breach.[2]
Are charities, merchant payment collection or technical outsourcing automatically exempt?+
There is no blanket exemption for charities or for not handling funds. Schedule 1 sets specific conditions for non-professional charitable cash collection, commercial agents and purely technical services. A platform acting for both payer and payee, responsible for actual payment services or providing AIS/PIS should reassess the perimeter rather than rely on non-profit or outsourcing labels.[4]
Official basis and verification sources
Primarily based on FCA, PRA / Bank of England, GOV.UK and current legislation. Older third-party guides supplied by users are used to organise business material and do not override the latest official requirements.
Tang Shangyong (Mr Tang / Drew) · Business Manager
Global financial licence application, transaction and ongoing compliance services