How an electronic money or payment firm can obtain UK authorisation

Growth in this sector has led to a significant increase in the number of firms seeking authorisation as electronic money (e-money) and payment institutions in the UK, ranging from start-ups to international firms expanding their footprint in the UK. Last year c.352 firms submitted an application to the Financial Conduct Authority (FCA) for authorisation as an e-money or payment institution in the UK^.2

As a result, the FCA has increased its focus on the authorisation and supervision of firms in this sector. The FCA’s objectives are to ensure that consumers can make payments safely, have access to a wide variety of payments or e-money services and that the market is competitive and innovative.

The FCA has increased its scrutiny on applications, and there is a high standard for obtaining a regulatory licence in the UK. Incomplete and poor-quality applications and inadequate governance, systems, risk and control frameworks have been highlighted by the regulator as the main reasons for rejecting applications for e-money, payments and crypto firms, with one in five firms not having been authorised last year.³

Obtaining an e-money or payments licence is a rigorous process requiring detailed planning, significant investment in resources and capabilities and management focus. The process involves preparing a detailed application pack comprising of the regulatory business plan (RBP) and comprehensive policies and procedures.
 

Key areas firms should focus on and address prior to submitting an application:
 

1. Given the pace of innovation and level of competition in this sector a new entrant should differentiate itself from other new and established firms in the market. The business strategy and business model should be defined early in the process. The firm will need to articulate what types of products and services it will provide, who the target market is, the competitive position and unique selling point.
2. Demonstrate that the firm will have adequate financial resources to meet the regulatory capital requirements on an ongoing basis, under a stress and in a wind-down scenario. The firm will need to demonstrate that it has a viable and sustainable business model
3. Have in place robust governance arrangements. The governance process should be defined and the relevant governance forums, such as the Board and Committees, should be in place to oversee the application process and the design, build and mobilisation of the new entity. Senior management will need to be in place to drive the application forward and to stand up the new entity. They will need to demonstrate that they have the relevant skills and experience within the e-money and payments sector and the business or function which they will be responsible for managing. Roles and responsibilities will need to be defined and documented with ownership and accountability assigned to the relevant individuals.
4.  Develop an effective risk management framework to identify, assess and manage all applicable risks. The firm will need to demonstrate that it has a good understanding of its risks and a plan for mitigating those risks.  
5. Implement adequate safeguarding arrangements and demonstrate how the firm will segregate client funds so that the funds are protected and can be easily identified and returned in the event of the firm’s failure.
6. Develop a comprehensive anti money laundering (AML) and financial crime framework to mitigate all risks related to financial crime and demonstrate compliance with all applicable rules and requirements including the reporting obligations.
7. Demonstrate that the firm is complying with the Consumer Duty regulation from the point of authorisation, delivering good customer outcomes and has considered the potential for customer harm for the products and services that it is providing.
8. With technology and partnerships at the heart of many e-money and payment firms, there will be a focus on outsourcing, operational resilience IT and security. The firm will need to develop a robust outsourcing framework and demonstrate that it is operationally resilient and will ensure the continuity of services in the event of an operational disruption. Business continuity plans should be in place and have been tested. The firm will also need to have in place IT and security policies, procedures, systems and controls to protect sensitive data.