How Payments and E-Money Firms Are Regulated

Payment institutions are authorised under the Payment Services Regulations 2017, and e-money institutions under the Electronic Money Regulations 2011. The FCA explains the application process on its payment and e-money institution pages and its approach in its payment services and e-money approach document.

These firms aren’t in the Senior Managers and Certification Regime, so there are no Senior Manager Functions. Instead, the FCA assesses the directors and the people responsible for managing the payment or e-money business, and the firm’s MLRO.

The People the FCA Assesses

Directors and Managers

Each director, and each person responsible for managing the payment services or e-money business, must be of good repute and have appropriate knowledge and experience. The FCA assesses them individually as part of the application, looking at their background, experience in payments and regulated businesses, and any adverse history.

The MLRO

The MLRO is often the role the FCA scrutinises most closely, because payments and e-money businesses carry high money laundering and fraud risk. The FCA wants to see an MLRO with relevant payments experience, enough seniority and time, and a credible plan for the firm’s controls. Our guide to what an MLRO does explains the role.

Compliance

Firms need someone responsible for regulatory compliance more broadly: conduct rules, complaints, financial promotions, the Consumer Duty where it applies, and regulatory reporting. At smaller firms, this is often combined with the MLRO role.

Safeguarding and Finance

Payment and e-money institutions must safeguard customers’ funds, keeping them separate and protected if the firm fails. The FCA has made safeguarding a supervisory priority and has strengthened its expectations, including more regular reconciliation, reporting and independent audit. Firms need finance people who understand safeguarding in detail, as well as capital requirements and regulatory returns.

Risk and Operations

Authorised firms need credible risk management, outsourcing oversight, IT security and operational resilience. Larger firms often appoint a head of risk and a chief operating officer.

A Typical Team for an Authorised Firm

Common Reasons Applications Struggle

• An MLRO without payments experience, or with too little time for the role.
• Directors with no regulated-sector experience, and no one on the team who has.
• Safeguarding arrangements that are unclear, untested or not owned by anyone with the right expertise.
• Heavy reliance on consultants, without people in the business who understand the controls.
• Key people named late, or changed during the application.
• Outsourcing to group or third parties without clear oversight in the UK firm.

Overseas and Group Applicants

Many applicants are part of international payments or fintech groups. The FCA expects the UK firm to be run from the UK, with its own management and an MLRO based in the UK, rather than as a branch office of a group run elsewhere. Group policies and systems can be used, but the UK firm must oversee them and be able to explain how they apply to UK customers. Applicants in this position often need to recruit UK-based leaders with local regulatory experience. Our overseas firms and group structures service supports international groups setting up regulated UK businesses.

When to Recruit

Recruit the MLRO and compliance lead before you finalise the application, not after. They should help design the controls described in the application, and they’ll need to explain them to the FCA. Directors and the safeguarding lead should also be in place, or firmly committed, before submission. The FCA has statutory timeframes for deciding applications once they’re complete, but changes to key people part-way through can restart the clock in practice. Our authorisation support service helps firms build the team behind an application.

Growing After Authorisation

Once authorised, many payments and e-money firms grow quickly, and their teams must keep pace. The FCA has taken action where controls fell behind growth, including requiring skilled person reviews of financial crime and safeguarding. As volumes increase, firms typically move from fractional to full-time MLROs, add a dedicated head of compliance, and strengthen finance and risk. Our guide to section 166 reviews explains what happens when the regulator steps in.

If You Later Join the Senior Managers Regime

Some payments and fintech groups add businesses that fall within the Senior Managers regime, for example by obtaining consumer credit or investment permissions. At that point, those regulated entities need approved Senior Managers. See our guide to SMF designations.

Frequently Asked Questions

Are payment and e-money institutions in the Senior Managers regime?

No. They’re authorised under separate regulations, but the FCA still assesses their directors, managers and MLRO.

Does an EMI need an MLRO?

Yes. EMIs and payment institutions within the Money Laundering Regulations need an MLRO and nominated officer, and the FCA assesses them closely.

Can the MLRO be fractional?

Often, yes, particularly at smaller or early-stage firms, if the time commitment is adequate. As volumes grow, many firms move to a full-time MLRO.

What is safeguarding?

The requirement to protect customers’ funds, keeping them separate from the firm’s own money, so they can be returned if the firm fails.

When should we recruit our MLRO?

Before you finalise the application, so they can shape the controls and explain them to the FCA.