End of Temporary Permissions Regime

The Temporary Permissions Regime allowed EEA-authorised payment institutions to continue serving UK customers after Brexit without FCA authorisation. The TPR ended on December 31 2025. Any EEA payment institution that operated into the UK under the TPR is now required to hold full FCA authorisation as an API or SPI if it wishes to continue UK regulated business.

For the EU-UK M&A market, this creates a specific dynamic. EU-headquartered payment fintechs that built UK customer bases under TPR face a binary choice: obtain FCA authorisation (a 6 to 10 month process with full documentation requirements) or acquire a UK-authorised entity that already has it. The second option is faster — and for companies that need UK market continuity without a gap in operations, it may be the only viable option.

CASS 15 Safeguarding from May 7 2026

FCA Policy Statement PS25/12, published in 2025, materially strengthened safeguarding requirements for payment institutions and EMIs effective May 7 2026. The Supplemental Regime introduces a CASS-style statutory trust framework for client funds, requiring daily reconciliation, monthly FCA returns, annual safeguarding audits, and 48-hour resolution packs.

This is a significant operational change for existing UK PIs and a material new compliance obligation for applicants. Daily reconciliation of client funds against safeguarding accounts, monthly reporting to the FCA, and annual audits of safeguarding arrangements — these were not requirements under the original PSRs 2017 regime. Firms applying now must demonstrate they can meet these standards from day one.

Consumer Duty and SM&CR

UK API applicants must comply with the SM&CR regime — Senior Managers and Certification Regime — with senior managers certified individually. Real UK office, UK-resident senior manager, and meaningful UK staff are substance requirements enforced by the FCA. The Consumer Duty, which came into force in July 2023, requires firms to demonstrate they consistently act to deliver good outcomes for retail customers. For payment institutions serving retail users, this adds a conduct assessment layer to the application that wasn't present in earlier years.

The UK is ahead of the EU on fraud liability — the PSR's APP fraud reimbursement requirement has been in force since October 2024, with 88% of in-scope losses returned to victims. The FCA has made clear that firms will be in breach of Consumer Duty where consumers fall victim to APP fraud because of inadequate detection or warning systems. For payment institutions handling consumer-facing flows, the fraud detection and warning infrastructure is now a compliance requirement, not a product feature.

A UK Authorised Payment Institution can provide every PSRs 2017 Annex I service: execution of payments, acquiring, remittance, issuance of payment instruments, PISP, and AISP. It cannot issue e-money — that requires an EMI licence — and cannot take deposits or lend on its own account, which requires a bank charter.

The scope question that most applicants get wrong: an API can issue non-EMI cards and payment instruments that draw on an underlying account held with another PSP. It cannot issue stored-value products, prepaid cards with a balance held by the issuer, or IBANs. The line between PI-scope and EMI-scope activity is one of the most common source of scope creep in UK payment businesses — and a source of regulatory findings that show up in M&A due diligence.

A UK-authorised API may not passport into EEA member states. Passporting is no longer available post-Brexit. A UK PI seeking to provide services in Europe must either establish a regulated subsidiary in a target jurisdiction or rely on bilateral regulatory recognition arrangements.

This is the single most consequential structural difference between a UK PI licence and an EU PI licence in 2026. A Lithuanian PI passports across 30 EEA countries under a single authorisation. A UK PI provides access to the UK domestic market only. For a buyer evaluating UK and EU PI assets, the commercial value of each is directly proportional to the geographic scope it unlocks — and the UK-only coverage of a post-Brexit UK PI is a material factor in deal pricing.

The UK retained its on-shored version of PSD2 — the Payment Services Regulations 2017 — after Brexit and is conducting its own review. The Payments Forward Plan, published in February 2026 by HM Treasury, the FCA, the PSR, and the Bank of England, sets out a 2026–2028 regulatory roadmap that covers much of the same ground as PSD3, though the legislative mechanism is different.

Application fee: approximately £5,000, scaled to scope. Capital requirements: £20,000 to £125,000 depending on the payment services provided. Real-world end-to-end timeline: 6 to 10 months for an Authorised PI application with a complete file.

The application fee and minimum capital are the visible costs. The total cost of obtaining FCA authorisation in 2026 includes legal and compliance preparation (typically £30,000 to £80,000 for a straightforward API application), UK office establishment, MLRO appointment or outsourced MLRO cost, technology infrastructure to meet the CASS 15 safeguarding requirements from day one, and the operational build required to demonstrate Consumer Duty compliance.

For founders comparing build-vs-buy, the acquisition of an existing UK-authorised PI compresses the 6 to 10 month application timeline into a change of control notification process — and delivers an entity with an established FCA relationship, documented compliance history, and safeguarding arrangements already in place. For buyers mapping UK-licensed PI assets available for acquisition, N5Deal catalogues FCA-authorised entities with the documentation needed to assess regulatory standing and compliance history before formal processes begin.

This page is for informational purposes only. It does not constitute legal, financial, or regulatory advice. Readers should consult qualified professionals before making any decisions.