Authorised Payment Institution Rules and Readiness
Published
An authorised payment institution is a person authorised under regulation 6 of the Payment Services Regulations 2017 and entered on the FCA register. Providing or purporting to provide a regulated payment service in the UK without the right permission is a contravention.
That can feel distant from the decisions facing a founder whose payment flow already works. The product may be tested, a bank partner may be interested, and the business plan may be polished. The difficult question is whether the firm can show that its controls work in practice, not just on paper.
Table of Contents
- Why Payment Permission Is Not the Product
- What an Authorised Payment Institution Is
- Own Funds That Must Hold After Approval
- Safeguarding Customer Money Apart from Capital
- Fraud Controls an Application Should Evidence
- How to Choose Application Support
- Prepare the File Before You Apply
Why Payment Permission Is Not the Product
A founder has built a payment flow that lets customers send money to a recipient. The demo works, and the team is refining its commercial plan. But a working flow doesn't settle whether the firm needs regulatory permission. The answer depends on what the service does, who provides it, and how the relevant activities fit the UK regulatory perimeter.
Customers, banks and counterparties can check an institution's status on the FCA's public register. That matters before a firm's product language creates expectations that its permissions don't support. A firm must not provide, or claim to provide, a regulated payment service unless it falls within a permitted category, such as an authorised payment institution, a small payment institution or a registered account information service provider. The legal framework also recognises other permitted providers. The Payment Services Regulations set out the authorisation framework.
The permission question isn't just whether a business has UK customers. For an application, the firm must carry on, or intend to carry on, at least part of its payment-services business in the UK. It must also show the FCA that its organisation can support the activity: sound governance, clear responsibility lines, effective ways to identify and manage risk, and adequate administrative, risk-management and accounting controls.
That's where a regulator's interview tests the gap between a polished narrative and an operating model. If the business plan says a team member owns payment exceptions, management should be able to explain what that person reviews, how issues reach decision-makers, and what happens when a control fails.
Practical rule: Start with the money movement and who performs each step. Don't start with the product label your team prefers.
If the prototype already initiates or executes payments, the team needs to establish whether the activity is regulated before treating authorisation as a later launch task. The meaningful question is whether the firm can demonstrate both the right permission and the substance to operate within it.
What an Authorised Payment Institution Is
The modern UK framework comes from the Payment Services Regulations 2017, which came into force on 13 January 2018. The Regulations established the authorised payment institution category alongside small payment institutions and registered account information service providers. They define the legal perimeter around payment services and the requirements for firms seeking authorisation. Regulation 2 sets out the framework's scope and terms.
Think of Schedule 1 as a set of lanes through a gate. One lane covers executing payment transactions, another issuing payment instruments, and others include acquiring payment transactions, money remittance, payment initiation and account information services. The firm's activity determines which lane it needs. That choice shapes its application and the controls it must explain, so a generic description such as “payments platform” won't do the work.
A firm can't provide, or purport to provide, a regulated service unless it is an authorised payment institution, a small payment institution, a registered account information service provider or another permitted type of provider. An account information service provider and an institution that executes payments don't occupy identical roles. Founders should map each customer journey to the actual service being delivered rather than assume the whole product fits one label.
What the application must establish
For an application, the applicant must provide the information specified in Schedule 2, hold the required initial capital immediately before authorisation, and be a UK-incorporated body with its head office in the UK. It must also satisfy the FCA that governance is sound and that responsibility lines are clear and transparent. Glentorion's overview of electronic money institutions can help teams distinguish the payment-services question from a separate product-perimeter assessment.
These aren't boxes to tick independently. The proposed services should match the business plan, the capital assumptions and the responsibility map. If those documents describe different versions of the product, the application won't tell a coherent operating story.
Own Funds That Must Hold After Approval
An authorised payment institution can meet its capital requirement on the day of approval and fall short later if its activity grows or its finances weaken. Under the Payment Services Regulations 2017 (PSRs), it must maintain own funds at all times at least equal to the higher of its initial-capital requirement and the amount calculated under the applicable ongoing-funds method. The initial threshold depends on the payment service; the ongoing calculation can vary with the firm's activity. Regulation 6 sets out the own-funds requirements.
| Service type | Initial capital | What changes the ongoing amount |
|---|---|---|
| Money remittance | €20,000 | The variable calculation under the applicable regulatory method |
| Payment-initiation services | €50,000 | The variable calculation under the applicable regulatory method |
| Executing payment transactions, issuing payment instruments, acquiring, or operating payment accounts | €125,000 | The variable calculation under the applicable regulatory method |
These figures are initial-capital thresholds, not a complete estimate of the funds the business needs. The firm must compare its initial requirement with the relevant ongoing calculation and maintain whichever is higher. Its capital file should show the method, assumptions and monitoring arrangements, including how changes to its services or activity affect the calculation.
The composition of own funds is also prescribed. Under regulation 6(2) of the PSRs, at least 75% of own funds must be Tier 1 capital, and at least 75% of that Tier 1 capital must be Common Equity Tier 1. The firm's capital calculation should show how it meets both tests.
Build a monitoring control, not just a forecast
A forecast showing sufficient funds before authorisation does not explain how the firm will stay within the requirement after launch. Transaction growth, losses and operating costs can all affect its position. Assign a named owner to review the calculation and its underlying inputs.
The capital pack should make each step traceable: record the fixed and variable bases, document assumptions, set review responsibilities and specify what management will do if projected own funds approach the required amount. Management information must provide enough warning for the firm to act before a shortfall, not just report one after it occurs.
A useful test is whether a director can explain the calculation, identify its source figures and describe the action triggered by a falling buffer. If only the finance lead can do that, responsibility may be too concentrated.
Safeguarding Customer Money Apart from Capital
Own funds support the institution's resilience. Safeguarding protects payment-service users' relevant funds. The two controls address different risks, and satisfying one doesn't replace the other.
Relevant funds are money received from or for the benefit of a payment-service user to execute a payment transaction. That includes money received from another payment service provider for execution on the user's behalf. Regulation 23 requires an authorised payment institution to safeguard those funds using a prescribed method. The safeguarding rules appear in Part 3 of the Regulations.
The operating design must show how the firm identifies relevant funds, applies segregation or other qualifying protection, governs designated accounts and reconciles balances. Reconciliation frequency should suit the risk and flows. The firm also needs a way to account for payments in flight, escalate breaks and assign oversight to a named senior manager.
Account purpose matters. A payment account held by an authorised payment institution must be used only in relation to payment transactions. Operating cash, customer funds and payment-processing flows therefore can't be treated as interchangeable just because all the accounts are held with a bank. The application and operating model should make clear what each account does and how the firm prevents safeguarded funds from paying unrelated business expenses. The Regulations' contents identify the separate account and safeguarding provisions.
Design for the day a process fails
A safeguarding policy isn't evidence that the process is ready. The firm should be able to trace a customer payment through its records, explain how discrepancies are investigated, and show who can access and approve activity on the designated accounts.
Wind-down provides a practical test: if operations stop, can the firm identify the relevant funds and return them efficiently? The application should distinguish arrangements that will exist on day one from future-state commitments, and explain how those future arrangements will be implemented and overseen.
Fraud Controls an Application Should Evidence
A customer requests an urgent transfer. The payment looks unusual, but delaying it could disrupt a legitimate transaction. Before launch, the firm needs a defined way to assess that risk, decide whether to intervene and record who made the decision. An authorisation application should show how those controls work in practice, not rely on a statement of intent.
UK Finance reported APP fraud losses of £257.5 million in the first half of 2025, up 12% year on year, while reported cases fell 8% to 110,747. Investment-scam losses reached £97.7 million, up 55%. The figures show why case counts alone are a poor measure of exposure: losses can rise even as reported cases fall. UK Finance's H1 2025 report gives the APP fraud figures.
Fraud controls should follow the payment from initiation to completion. That means setting out what signals trigger a warning or hold, who can release a payment, how suspected APP fraud is escalated and how reimbursement decisions are made. Scenario tests should check whether staff follow those rules, keep decision records and take vulnerable customers' circumstances into account. Board oversight should cover dependencies on data providers and other third parties, including what happens when a signal is unavailable.
For example, a voice or identity check should support a decision, not replace it outright. The firm should explain how it verifies that signal, what alternative checks apply if it fails, and how a customer can challenge a decision. Guidance on banking safeguards for AI voice fraud can prompt questions about layered verification, but the firm's own documented process must show how its controls fit its payment journey.
The application should connect the fraud risk assessment to specific controls, responsible people and evidence of testing. A financial crime risk assessment framework can help organise that analysis and assign control ownership. In an FCA interview, managers should be able to explain how a suspected scam moves through the firm's process, from the first alert to the final decision.
How to Choose Application Support
Three routes can work, depending on what the firm already has and who can own the work.
| Route | Where it can fit | Common pressure point |
|---|---|---|
| Founder-led preparation | A team that knows its model and can coordinate internal evidence | Unclear regulatory route, fragmented documents or gaps found late |
| Law firm support | A business that needs legal advice on permissions, structure or contracts | Legal drafting may not assemble the operating narrative and control evidence |
| Integrated regulatory consultancy | A firm that needs application materials, operating arrangements and interview preparation coordinated | Scope and responsibilities still need to be agreed clearly |
A thin prototype may suit founder-led preparation if the leadership team can make decisions and gather evidence. A bank or crypto firm with existing counsel may prefer legal advisers to handle defined legal questions while an internal or external regulatory lead coordinates the application. The weak point in any route is often continuity: a story can break when the person responsible for a control changes and nobody updates the affected documents.
What coordinated preparation looks like
Glentorion is one option for financial and crypto businesses that want regulatory and operational work brought together. Its consultants work with software, systems and AI engineers to scope an engagement to the relevant route, assess the business model, customers and operations, and prepare or review business plans, financial assumptions, policies and procedures. The work distinguishes arrangements that exist now from those the firm intends to establish.
Document review can track findings and corrections across affected materials, while specialist inputs are coordinated around open decisions. Submission can be made under an agreed mandate after client sign-off, followed by interview preparation focused on controls and responsibilities rather than slogans. Its multi-jurisdiction experience includes FCA, MAS and DFSA frameworks, with legal advisers and referral partners working within defined scopes. Teams comparing options can use this guide to regulatory compliance consultants as a starting point for defining the work they need.
Whatever route the firm chooses, ask who owns the consolidated narrative, how changes are tracked, and who will answer the regulator's questions about each control. Support should fill a specific capability gap, not obscure who remains accountable inside the business.
Prepare the File Before You Apply
Start with the activity, not the application template. Write down what the firm does for the customer, identify the legal entity, and confirm the UK business connection. Then match the activities to the relevant payment-service category and its initial-capital requirement.
Before engaging support, put three evidence questions in writing:
- What works on day one? Identify the controls and operational arrangements the firm can demonstrate at launch.
- What is a future commitment? Record what still needs to be built, by whom, and how progress will be overseen.
- What proves the difference? Point to the relevant evidence for safeguarding, own-funds monitoring and fraud intervention.
Give separate, named ownership to customer-money accounts, reconciliations and wind-down, and to the firm's capital forecast. That separation makes it easier to see who is responsible for protecting customer funds and who monitors the institution's financial resilience.
Collect the open decisions that can otherwise stall preparation: the purpose of each bank account, the role of outsourced providers, and which managers will explain each control in an interview. Then compare the documents against the operating model. If a policy describes a process that nobody can demonstrate, record it as a gap rather than presenting it as operational.
Use the resulting list to scope a work plan around the chosen route, deliverables and responsibilities before draft policies multiply. This guide to FCA authorisation for firms can help frame the preparation, but the next step is to identify the firm's specific evidence gaps and assign owners.
Glentorion works with financial and crypto businesses to prepare and review authorisation applications, submit them under an agreed mandate after client sign-off, and prepare management for regulator interviews. If your team is deciding which payment permission fits its operating model, visit Glentorion to scope the route, deliverables and responsibilities before the application narrative gets ahead of the controls.
- authorised payment institution
- FCA authorisation
- payment services
- safeguarding
- own funds
