WhatsApp and Telegram +44 7563 115980
[email protected]
BCC runs compliance for authorised and small payment institutions (PIs) regulated by the Financial Conduct Authority (FCA): safeguarding, financial crime, Consumer Duty, returns and the monitoring that holds it together.
Selected engagements from more than 250 licences obtained since 2013, for payment, e-money and cryptoasset firms.
Volkswagen
Payment InstitutionObtained Nexpay’s FCA Authorised Payment Institution licence.
Electronic Money InstitutionObtained Dzing Finance’s FCA Authorised Electronic Money Institution licence.
Obtained Orbital’s FCA Authorised Payment Institution licence.
The short answer
A UK payment institution must meet the Payment Services Regulations 2017 (PSRs), the safeguarding rules in CASS 15, the Money Laundering Regulations 2017 (MLRs), the Consumer Duty and FCA reporting rules. A payment services compliance consultant assesses the firm against these rules, writes up the gaps, fixes policies, controls and returns, and can provide ongoing monitoring or an outsourced compliance officer or money laundering reporting officer.
A PI is authorised or registered under the PSRs, not under the Financial Services and Markets Act 2000 (FSMA) permissions regime that governs most other firms. That changes which rules apply. Most of the Senior Managers and Certification Regime (SM&CR) does not apply to a PI, but the FCA Handbook still reaches it through the Principles for Businesses, including the Consumer Duty, the complaints rules in the Dispute Resolution sourcebook (DISP), the safeguarding rules in CASS 15, the operational resilience rules in SYSC 15A and the reporting rules in the Supervision manual (SUP).
The FCA's supervision of payments firms concentrates on a short list of failures: safeguarding shortfalls, weak financial crime controls, poor treatment of customers and thin governance. A consultant's job is to show, with evidence, that each of these is under control, and to fix whatever is not before the FCA finds it.
Read our full guide to FCA compliance for payment institutions
For a PI, the FCA assesses directors and the persons responsible for managing the payment services as fit and proper, using the PSD Individual form rather than the SM&CR Form A. The firm must tell the FCA about changes to these people, and a new appointment should not take effect until the individual's fitness has been checked and documented. We prepare the submissions, the supporting role descriptions and the governance map that shows who is accountable for safeguarding, financial crime and the Consumer Duty.
Anyone acquiring or increasing control of a PI must notify the FCA and obtain approval in advance. The FCA has up to 60 working days to assess a complete notification, excluding any period in which it pauses the assessment to request information. Buyers, sellers and investors often underestimate the evidence required on the source of funds and the acquirer's plans, which is where most delays start. We prepare the notification, the business plan for the post-deal firm and the answers to the FCA's follow-up questions.
Every PI is within the MLRs. It must carry out a written business-wide risk assessment, apply customer due diligence and enhanced due diligence where risk is higher, monitor transactions, screen for sanctions and report suspicions. Regulation 21 of the MLRs requires a nominated officer, usually called the money laundering reporting officer (MLRO), and, where appropriate to the firm's size and nature, a board-level officer responsible for compliance with the regulations.
Payments firms are exposed to fast-moving fraud and mule activity, so the FCA expects transaction monitoring rules to be calibrated to the firm's own products and customers, not copied from a vendor's default settings. We review the risk assessment, test a sample of customer files, check alert handling times and the quality of suspicious activity reports, and deliver an MLRO annual report the board can act on. Where the firm has no suitable MLRO, we provide one.
Safeguarding is the most closely supervised area for PIs. Since 7 May 2026, the FCA's supplementary safeguarding rules in CASS 15, introduced by Policy Statement PS25/12, sit alongside the PSRs. They require daily reconciliations of safeguarded funds, a monthly safeguarding return to the FCA under SUP 16.14A, an annual safeguarding audit by a qualified auditor unless an exemption applies, a resolution pack that would let an administrator return funds quickly, and a named individual responsible for safeguarding.
We test the safeguarding method against the actual flow of funds, rebuild reconciliation procedures, check that safeguarding account acknowledgement letters are in place, prepare the firm for its audit and review each monthly return before submission. Firms that want evidence before an audit can start with our safeguarding readiness checker.
A PI's policy set has to match how the firm actually operates. The FCA reads policies against complaints data, outcomes and the firm's own management information, and it treats a polished document that nobody follows as a weakness, not a strength. We write or rewrite the core set: financial crime, safeguarding, complaints, vulnerable customers, outsourcing, incident management and business continuity.
The Consumer Duty in PRIN 2A applies to payment services provided to consumers. The firm must show good outcomes on products and services, price and value, consumer understanding and consumer support, and its board must review an assessment of those outcomes at least once a year. Complaints about payment services must receive a final response within 15 business days under DISP 1.6.2A, or 35 business days in exceptional circumstances with a holding response. We build the outcome testing, the board report and the complaints root cause analysis that link the two.
A compliance monitoring programme is the firm's evidence that its controls work. It sets out which controls will be tested, how often, by whom and how findings are reported to the board. For a PI, the plan should weight testing towards safeguarding, transaction monitoring, onboarding and complaints, and it should be refreshed each year from the risk assessment.
PIs submit returns through the FCA's RegData system under SUP 16.13. Authorised PIs file the FSA056 return, small PIs file FSA057, payment service providers file the REP017 payment fraud report, and safeguarding firms now file the monthly safeguarding return. Errors in these returns are visible to supervisors and are a frequent trigger for questions. We prepare or review each return, reconcile it to the management accounts and keep a reporting calendar so nothing is filed late.
SYSC 15A applies to PIs. The firm must identify its important business services, set an impact tolerance for each, map the people, systems and suppliers behind them and test that it can stay within tolerance in severe but plausible scenarios. The FCA's transition period ended on 31 March 2025, so firms are now expected to be operating within their tolerances, not still building the framework.
Most PIs rely on outsourced technology, banking and processing partners. Regulation 25 of the PSRs requires an API to notify the FCA before outsourcing an operational function, and an important operational function may only be outsourced where internal control and the FCA's ability to supervise are not impaired and senior management keep responsibility. An API must also hold initial capital under Schedule 3 to the PSRs (from 20,000 euros for money remittance to 125,000 euros for most payment services) and maintain own funds calculated under Method A, B or C. We review outsourcing registers, contracts and capital calculations together, because a failed supplier is usually also a capital and resilience problem.
Every engagement follows the same four stages, scaled to the size of the payment institution and the urgency of the issue.
Assessment comes first: we review your permissions, governance, policies, management information and recent FCA correspondence against the rules that apply to you. You then receive written findings, ranked by regulatory risk, with each gap tied to the specific rule it breaches and a named owner for the fix. Remediation follows: we redraft policies and procedures, rebuild monitoring plans, correct returns and prepare board papers, and we can attend FCA meetings alongside your senior managers. Finally, ongoing support keeps the position steady after remediation, through a retained monthly review, an annual compliance monitoring programme or outsourced roles such as an outsourced MLRO or compliance officer.
Buckingham Capital Consulting (BCC) was established in 2013 and has obtained more than 250 licences in over 60 countries for payment, e-money and crypto firms. We open global markets to payment, e-money and crypto businesses: the licences to enter, the banking to operate and the compliance to scale.
For payment institutions, that means we understand the business from the authorisation file forward: the business plan the FCA approved, the safeguarding model the firm described and the controls it committed to. Ongoing compliance is measured against those commitments, which is exactly how FCA supervisors read a payments firm.
Because BCC also arranges banking for regulated firms, our compliance work is written with the questions banks and safeguarding providers ask in mind. A firm whose controls satisfy the FCA and its bank at the same time spends less time answering the same questions twice. To discuss your firm, use the contact form and tell us your permissions, your current team and the issue you need resolved.
A payment services compliance consultant reviews a payment institution against the PSRs, CASS 15 safeguarding, the MLRs, the Consumer Duty and FCA reporting rules, writes up the gaps, and fixes policies, controls and returns. Many also provide ongoing monitoring or outsourced roles, such as the MLRO or a compliance officer.
Payment institutions authorised under the PSRs are not generally within the Senior Managers and Certification Regime. The FCA instead assesses directors and those responsible for managing payment services as fit and proper, and the firm must notify it of changes. The Principles for Businesses, the Consumer Duty and DISP still apply.
Under CASS 15, which took effect on 7 May 2026, a safeguarding firm submits a monthly safeguarding return under SUP 16.14A, carries out daily reconciliations, keeps a resolution pack and, unless an exemption applies, obtains an annual safeguarding audit from a qualified auditor.
Under DISP 1.6.2A, a payment services complaint needs a final response within 15 business days of receipt. In exceptional circumstances outside the firm's control, it can send a holding response within that period and must then give a final response within 35 business days.
An SPI has lighter capital and reporting requirements but is still within the MLRs, the Consumer Duty, DISP and, where it safeguards, CASS 15. Small firms often lack in-house depth, so periodic external review or an outsourced MLRO is a common and proportionate arrangement.
Yes. BCC can provide an outsourced MLRO, supported by a monitoring plan, a written risk assessment and an annual MLRO report to the board. We also support firms appointing their own MLRO, including the fitness assessment and handover.
Tell us what you need and where you operate.