Payment Institution Authorisation (2026 Guide)

A regulated fintech operation in the UK requires more preparation than forming a legal entity and putting a product online. Firms executing payment transactions, providing payment initiation services or giving users access to account information may fall within the FCA’s payment services regulation.

The route chosen at the outset affects the structure of the operation, the resources it needs and the range of functions it can provide. In 2026, firms also need to account for changes to safeguarding arrangements and wider supervisory expectations.

Businesses may also search for a PSP license or payment gateway license. In the UK, however, the regulatory position depends on what the business actually does rather than the commercial name attached to the product. 

Quick Answer

What is a payment institution authorisation in the UK? It is regulatory approval for certain firms carrying out regulated payment functions in the UK.

The principal UK rules are contained in the Payment Services Regulations 2017. They set out categories of payment services, authorisation and registration requirements, and ongoing obligations. The Electronic Money Regulations 2011 are also relevant when a business intends to issue e-money rather than provide payment functions alone. 

The distinction between these models is important when deciding which regulatory route is appropriate. For a broader comparison, see the guide to EMI License vs MSB License. 

The exact permission depends on what the firm intends to offer. A transfer provider, for example, may fall into a different category from a platform that initiates transactions through another provider.

Who Needs an FCA Payment Institution License?

A firm may need a payment services license when it provides regulated payment offerings in the UK as part of its business activities. The distinction is based on what the firm actually does. A technology provider that only supplies software may fall outside the regulatory perimeter, while a platform that initiates payments or receives funds from users may fall within it. Such providers may apply for registration as enrolled account information service providers rather than seeking full PI authorisation.

Typical examples include:

• money transfer platforms;
• remittance providers;
• open-banking platforms providing payment initiation services;
• firms executing payment transactions;
• platforms combining several regulated functions.

The legal nature of each feature should be established before choosing the regulatory route.

What Services Can an Authorised Payment Institution Provide?

An organization with a payment provider license can offer different regulated functions depending on the scope approved by the FCA. The main options include:

The permitted scope should reflect what the PI actually intends to offer. A firm combining several functions should define each one clearly when preparing its payment institution application.

What Are the Main Payment Institution Requirements?

The FCA assesses whether the proposed operation is capable of running properly and consistently with the rules.

Key areas normally include:

• ownership and qualifying holdings;
• directors and senior personnel;
• projected income and expenditure;
• risk identification and mitigation;
• a suitable governance framework;
• AML compliance arrangements;
• KYC procedures;
• information-security controls;
• safeguarding arrangements;
• continuity planning;
• technology architecture.

The FCA also considers whether people responsible for directing the firm have suitable knowledge, experience and reputation. 

The submission should explain who performs each important function and how problems are escalated. The product description, organisational chart, forecasts and control arrangements should all describe the same operation.

How Are Customer Funds Protected?

Where a firm receives relevant funds from payment service users, it must establish appropriate safeguarding arrangements to keep those funds separate from money used for its own operations. This is generally referred to as safeguarding client funds.

The FCA’s safeguarding regime changed on 7 May 2026, making this area particularly relevant to firms preparing for authorisation or reviewing existing arrangements.

A firm should be able to explain:

• where relevant money is held;
• how balances are reconciled;
• who performs reconciliation checks;
• how discrepancies are escalated;
• what happens if the firm becomes insolvent.

These procedures need to work in practice rather than exist only as written policies.

How Does the Application Process Work?

The process starts with determining exactly what the firm intends to do. Once the regulatory category is established, the supporting material can be prepared around that scope.

A practical sequence:

1. Identify regulated functions and how money moves.
2. Establish whether PI authorisation or another route applies.
3. Identify shareholders, directors and responsible individuals.
4. Explain staffing, technology and suppliers.
5. Cover risk, security, AML, KYC and safeguarding.
6. Show expected revenue, expenditure and available resources.
7. Submit the application.
8. Deal with follow-up questions.
9. Receive the decision and operate within the approved scope.

The FCA notes that an incomplete submission may not proceed to substantive assessment and recommends practical information such as flow-of-funds diagrams and typical user journeys. 

How Long Does Authorisation Take?

The statutory assessment period is generally three months from receipt of a complete submission. Where the submission is incomplete, the period can extend to 12 months. 

The practical timetable can vary. Questions from the FCA, structural changes or missing information can all add time.

The FCA also states that allocation of a case officer can currently take up to 20 working days. 

A launch date should therefore leave room for regulatory correspondence.

Can Foreign Founders Obtain a Permit?

Yes. Overseas founders can establish and own a local PI, provided the proposed structure satisfies the applicable conditions.

Overseas ownership does not remove the need for a genuine UK presence. The FCA expects an authorised organization to have its head office and registered workplace in the UK and to conduct some relevant work here.

The structure should make clear:

• who owns the entity;
• who makes key decisions;
• where important functions are performed;
• who oversees risk;
• how the UK operation is supervised.

Overseas founders can therefore be involved at ownership level, but the local setup still needs to be credible and workable.

Besides, for founders seeking an existing regulated structure rather than building one from the beginning, acquiring a licensed fintech company may be an option. 

In case EMI permission is a decision, the best EMI license jurisdictions should be checked before deciding where to establish wider operation. 

What Ongoing Compliance Does a Firm Need?

Receiving payment institution authorisation is not the end of the regulatory work. An authorised PI has continuing duties covering reporting, own funds, safeguarding, governance, financial crime controls and operational risk.

Technology deserves particular attention as a firm grows. Operational resilience means having arrangements that allow important functions to continue or recover when systems fail, suppliers become unavailable or a security incident affects the operation.

Ongoing oversight may become necessary when the firm:

• introduces a new product;
• changes its ownership;
• appoints new senior personnel;
• expands its use of third-party providers;
• changes how money moves through the platform;
• enters additional markets.

FAQ