🇬🇧UK: the FCA Authorisation Map — EMI, API, PI and the Small Regimes

A "UK payments licence" is not one document. It is a set of doors with different entry prices, different rights and radically different survival rates — and the FCA's own register tells the story better than any advisory brochure. At close of business on 19 August 2026 the e-money register extract held 263 live authorised EMIs and 25 small EMIs; the payment services extract held 385 authorised payment institutions, 420 small payment institutions and 88 registered account information service providers. Beside them sits a graveyard: 1,502 cancelled small PIs, 297 cancelled authorised PIs, 381 entries marked PSD Revoked PI and 138 dead authorised EMIs.

The doors themselves sit in two instruments the UK inherited from EMD2 and PSD2 and has still not rewritten: the Electronic Money Regulations 2011 and the Payment Services Regulations 2017. Their thresholds are still denominated in euro — €350,000 of initial capital for an EMI, €5,000,000 of average outstanding e-money for the small regime, €3,000,000 of monthly payment volume. Six years after leaving the EU, the British regulator still measures an applicant's capital in a currency the country does not use.

2026 is changing almost everything around those doors except the doors. The interim safeguarding regime took effect on 7 May. In January the FCA tightened its own determination targets — and missed them, in the payments queue specifically, in the very first quarters of measurement. On 14 July the Treasury opened a consultation that moves firm-facing requirements out of the EMRs and PSRs and into the FCA rulebook. And a second gate is being built alongside — the cryptoasset regime, whose boundary with payments is narrower than most advisers assume.

Seven doors and what sits behind each

An eighth door sits apart but is frequently needed by the same firms: credit broking is a regulated activity under FSMA, not under the PSRs. A fintech that introduces a customer to a lender inside its own app needs a separate Part 4A permission — limited permission where broking is secondary to a non-financial business, full permission where it is the business itself or is combined with another regulated activity. Buy-now-pay-later inverts the usual pattern: deferred payment credit became regulated on 15 July 2026 under PS26/1 of 11 February, the lender needs a permission or a temporary one, but broking of DPC agreements is expressly exempt.

The line between agent, appointed representative and distributor is where the market most often gets it wrong. An agent under reg 34 PSRs provides payment services on behalf of a PI, EMI or RAISP and must be on the register before it starts. An AR carries on FSMA-regulated activity under a principal's permission — the mechanics are set out in the note on appointed representatives and regulatory hosting. An e-money distributor distributes and redeems e-money, provides no payment services and needs no registration at all; the FCA says so in terms in its Approach Document. Practical consequence: selling someone else's prepaid cards requires no register entry, accepting payments on them does. The wider economics of operating under someone else's permission are covered in licence for rent and in the survey of payment agents and passporting.

Thresholds: where the small regime ends

The small EMI conditions sit in reg 13 EMRs: average outstanding electronic money not exceeding €5,000,000, a monthly average of payment transactions over the 12 months before the application not exceeding €3,000,000, and no access to AIS or PIS. For small PIs, reg 14 PSRs leaves a single test — the same €3,000,000 monthly average, counting the volumes of the firm's own agents.

Breaching a threshold buys no thinking time. Reg 16 EMRs and reg 16 PSRs are drafted identically: within 30 days of becoming aware of the change in circumstances the firm must apply for full authorisation if it intends to continue. Thirty days is the deadline for filing, not for being approved — and as the numbers below show, roughly seven more months typically pass before a decision, all of it spent operating on the old status.

The register shows the small regimes have effectively stopped functioning as an entry route. Among the 25 live small EMIs, exactly one carries a current-status date later than 2021. Small PIs tell the same story: 243 entries dated 2018, the residue of the PSD2 transition, then 66 in 2019, 44 in 2020, 51 in 2021 — and then collapse, with 7, 2, 1, 2 and 4 entries across 2022 to 2026. Cancelled small PIs number 1,502, roughly four times the live population. The small regime is marketed as the easy way in; in practice more firms leave it than enter it.

Part of the explanation is arithmetic. Under FEES 4 Annex 11 the 2026/27 annual fee for a small EMI is a flat £1,432 and for a small PI £652, while a large PI pays a £628 minimum plus £0.309 per £1,000 of relevant income. A small EMI operating near the bottom of its threshold therefore pays the regulator more than a mid-sized full API — while forfeiting AIS, PIS and any ability to operate outside the UK perimeter.

Capital: initial capital and the own funds methods

Initial capital is fixed and regime-specific. Schedule 2 EMRs requires €350,000 from an authorised EMI. Schedule 3 PSRs splits payment institutions by service: €20,000 for money remittance, €50,000 for payment initiation, €125,000 for the rest, with the highest applicable figure governing a combination. A RAISP has no initial capital requirement at all — professional indemnity insurance or a comparable guarantee replaces it. A small PI has neither: the FCA confirms in its Approach Document that no ongoing capital requirement arises.

Own funds are then calculated by method, and the governing logic matters: own funds may not fall below the greater of initial capital and the method result.

An authorised EMI applies method D to everything attributable to e-money issuance and adds method A, B or C for payment services unconnected with issuance. The firm does not choose the method — the FCA determines it, and the FCA may also direct up to 20% more or permit up to 20% less than the calculated figure on a risk assessment of the individual firm. This is rarely spelled out in advisory material: UK payments capital is a formula plus supervisory discretion, not a formula alone.

A small EMI falls under the 2% charge as soon as average outstanding e-money reaches €500,000 — and it is framed as an initial capital requirement, tested at the gate rather than only in life. A firm planning €2m of outstanding e-money is looking at €40,000 for the supposedly capital-free small regime.

What the application actually has to contain

The pack is specified by Schedule 2 PSRs and Schedule 1 EMRs, and it is longer than the website suggests: programme of operations, business plan with financial projections, evidence of initial capital, a description of safeguarding arrangements, governance and internal control structure, security incident procedures, handling of sensitive payment data, business continuity, statistical data principles, security policy, details of offices, and professional indemnity cover for anyone providing AIS or PIS.

Three requirements account for most of the attrition.

Head office and real presence. Reg 6 PSRs requires a payment institution to be a body corporate constituted under the law of a part of the United Kingdom with its head office — and registered office, if it has one — in the UK, and to carry on at least part of its payment service business there. The FCA reads head office as the location of directors, senior management and central administrative functions, and states expressly that a virtual office does not satisfy the test. EMIs are different, and this is almost never mentioned: reg 6(4) EMRs admits as an applicant not only a UK body corporate but also a "body corporate which has a branch that is located in the United Kingdom and whose head office is situated in a territory that is outside the United Kingdom". A foreign company with a UK branch can therefore be an authorised EMI but cannot be an authorised payment institution. The universal advice to "incorporate a UK Ltd first" is commercially sensible and legally imprecise.

Wind-down plan. The FCA expects one in the application: it must allow rapid identification of customer funds and their owners, fund the wind-down itself, set realistic triggers with a strategy for monitoring them, address operational resilience during the wind-down and cover termination of products and counterparty transitions. It must be reviewed at least annually and whenever operations change materially. How seriously the market takes this the FCA showed on 26 June 2025: across 14 firms holding payments and e-money permissions, none fully met its expectations. Triggers were not aligned with risk appetite, safeguarding asset shortfalls were barely modelled, and the delays safeguarding introduces into returning money were not modelled at all. The mechanics of an orderly exit are set out in licence withdrawal and wind-down.

Governance that is not copied from the rulebook. In its good and poor practice summary of 11 September 2025 the FCA lists what sinks applications: over-reliance on a compliance consultant coupled with an inability to explain one's own obligations, no time allocation for individuals holding several roles, generic policies that restate rules instead of describing implementation, documents that do not join up, opaque IT architecture and delivery timelines, missing historic accounts and unsupported assumptions in the financial model. What a working control framework looks like is covered in the compliance stack for a licensed operator.

People: PSD and EMD individuals, not the SM&CR

Here the secondary consensus is systematically wrong. The Senior Managers and Certification Regime does not apply to payment institutions and EMIs — they are authorised under the PSRs and EMRs rather than FSMA and sit outside the SM&CR perimeter. In place of senior manager approval there is a lighter mechanism: the firm must ensure that every director and every person responsible for the management of its payment or e-money services is of good repute and has appropriate knowledge and experience, and must notify the FCA through Connect when such people are added, changed or removed, using the PSD Individual and EMD Individual forms.

The regulator acknowledges the gap. In its Perimeter Report of 26 March 2026 the FCA records that e-money institutions fall outside the SM&CR and that extending the regime to them "would deliver greater accountability and improve oversight of functions that promote good conduct". That is a supervisory view, not law: the April reform package — PS26/6 of 22 April 2026, phasing in on 24 April, 10 July, 30 July and 1 September 2026 — does not widen the perimeter. The consequence cuts both ways: procedural savings now, but a retrospective re-vetting exercise for teams hired to the lighter standard if the regime is extended. An EMI that also holds consumer credit permissions already lives in both worlds — payments outside the SM&CR, credit inside it.

ICT and operational resilience

Payments firms sit inside the UK operational resilience regime on the same footing as banks. PS21/3 of 29 March 2021 applies among others to "entities authorised and registered under the Payment Services Regulations 2017 or Electronic Money Regulations 2011"; the rules took effect on 31 March 2022 and the transitional period closed on 31 March 2025. By that date a firm had to have identified its important business services, set impact tolerances, completed mapping and testing, and be able to show it can remain within tolerance.

The next layer is PS26/2 of 18 March 2026, with a compliance date of 18 March 2027. Operational incident reporting captures all neobanks; third party reporting captures a narrower list that names authorised EMIs and authorised payment institutions expressly — notification of new material third party arrangements plus an annual register of them. The small regimes are outside the second layer, one of the few remaining substantive concessions of small status. Functionally the UK pairing of PS21/3 and PS26/2 addresses the same ground as DORA in the EU, but it is built around impact tolerances for named services rather than a single prescribed ICT catalogue.

Timelines and outcomes: what the FCA's own metrics show

Under reg 9 PSRs the regulator must determine an application within three months of receiving a complete application; an incomplete one may be determined at any point but in any event within 12 months of first receipt. The operative word is "complete": the FCA itself confirms in writing the date from which it treats the application as complete, and the clock runs from there. From January 2026 the regulator tightened its own targets: for payments and e-money the goal became 95% within 3/10 months, replacing 98% within 3/12; for ordinary FSMA authorisation it became 4/10 in place of 6/12.

The first two quarters measured against the new target are published in the Q4 2025/26 authorisations metrics.

These figures deserve to be read literally. Across the whole 2025/26 financial year the FCA closed 164 payments and e-money authorisation and registration cases — 38, 39, 43 and 44 by quarter. The median case ran 207 days and the upper quartile 269, meaning a quarter of applicants waited more than eight months against a three-month statutory clock for a complete application. Twelve of forty-four missed the regulator's own target; three missed the statutory horizon. Meanwhile the FCA's 2026/27 work programme states that "99% of all authorisation applications" are now decided within current statutory deadlines. Both statements are true: the aggregate is carried by high-volume, near-instant categories — 2,112 payment agent registrations in the quarter at a median of 0 days, 1,334 SM&CR individual approvals at a median of 19 days. Payments authorisation is 44 cases inside a pool of several thousand.

The other half of the picture is the approval rate, which the FCA publishes on its application page. Of applications determined in calendar 2025, 20% of PI cases, between 40% and 45% of EMI cases and between 65% and 70% of RAISP cases ended in approval. In 2023 the figures were 10–15% for PI and 15–20% for EMI: the trend is upward, but at no point in three years has it approached what advisers imply when they promise a licence "with a properly assembled pack". The other 80% of PI cases are withdrawals, refusals and submissions returned unassessed — the FCA rejects a submission without assessing it where minimum information is missing or the correct fee is unpaid.

Against those timelines the published fee tariffs look modest: an authorised EMI application is pricing category 5 at £5,640; an API is category 4 or 5 depending on the service set, £2,820 or £5,640; small PI, small EMI and RAISP are category 3 at £1,130; a limited network exclusion notification is category 1 at £280. A variation costs half the relevant category. Annual fees for 2026/27 run to £652 for a small PI, £1,432 for a small EMI, and a £2,063 minimum plus £43.40 per £1m of average outstanding e-money above £5m for a large EMI.

What has tightened in 2025–2026

Safeguarding is the headline change. PS25/12 of 7 August 2025 introduced a supplementary regime in force from 7 May 2026: daily reconciliations, a resolution pack, monthly reporting and an annual safeguarding audit. The end state — a CASS-style statutory trust — is deferred and tied to the eventual repeal of the PSRs and EMRs; the detail and what it means for client money is set out in the note on UK safeguarding and the cryptoasset regime. The scale is in the FCA's March 2026 payments priorities report: EMIs safeguarded roughly £26bn in 2024 against £11bn in 2021, and payment institutions an estimated £6bn per day.

The second front is structural. On 14 July 2026 the Treasury opened Modernising Payment Services Regulation, closing 6 October 2026. The idea is not abolition but redistribution: the perimeter of regulated payment services and the key definitions stay in legislation, firm-facing requirements move into FCA rules, and the payment services themselves are recut into individual regulated activities. The Payments Forward Plan of February 2026 puts the Treasury's response in Q4 2026, FCA consultations and policy statements across 2027–2028, and the statutory instrument in the same window. On a parallel track, on 21 April 2026 the government confirmed that the Payment Systems Regulator's functions move into the FCA, with the FCA already consolidating operations ahead of legislation.

Third, the register is being cleaned. The basis is built into the regime itself: reg 10 PSRs lets the FCA cancel an authorisation where the firm has not provided payment services within 12 months of authorisation taking effect, has ceased for more than six months, or has lost its Money Laundering Regulations registration. Cancellations and revocations on the payments register ran at 87 entries in 2024, 66 in 2025 and 41 in an incomplete 2026. New entries dated 2026 across authorised EMIs, APIs and RAISPs combined number 26. The register is not growing; it is turning over.

Fourth, the Consumer Duty. It applies to payments firms, and consultation CP26/23 on its scope and proportionality closes on 18 September 2026; among the proposals is taking safeguarding accounts held with credit institutions out of scope as infrastructure sitting behind the product.

Crypto: where the boundary with payments actually runs

The overlap with crypto is not what the market describes. Registration under the Money Laundering Regulations 2017 is AML supervision, not a licence, and it does not convert into authorisation. The FSMA gateway for cryptoasset firms opens on 30 September 2026, the regime goes live on 25 October 2027, and the FCA warns explicitly that an MLR registration form cannot be treated as an application for FSMA authorisation, that being registered guarantees nothing, and that parallel applications are determined separately. New MLR applications after 31 July 2027 are pointless. The throughput of that channel shows in the same metrics: across 2025/26 the FCA closed just 22 5MLD registration cases, and in the final quarter the median ran to 236 days while formal compliance with the target stood at 100% — because the target runs from the completeness date, not from filing.

The substantive boundary is definitional. The FSMA 2000 (Cryptoassets) Regulations 2026 are built so that a qualifying stablecoin and electronic money are mutually exclusive: a given thing is one or the other, never both. An EMI permission therefore does not cover issuing a qualifying stablecoin, and a stablecoin issuance permission confers no right to issue e-money. A firm that wants both needs both doors. That is the exact inverse of the widely repeated claim that a sterling stablecoin is simply e-money on a blockchain. How the same fork is resolved in the EU, where an EMI and a CASP authorisation must be paired, is covered in the CASP licence guide.

After Brexit: how EU firms come in now

There is no passporting and nothing replaces it: no UK–EU equivalence exists for payment services. The transitional scaffolding has come down entirely. Passporting ceased at 11pm on 31 December 2020, and the last remnant — contractual run-off — expired on 31 December 2025 for payment institutions, account information service providers and e-money institutions without a UK branch or agent. Supervised run-off allows a maximum of five years for non-insurance contracts and in no case permits writing new UK business.

Three practical routes remain. Full UK authorisation: a UK entity is mandatory for a PI, while an EMI may also be a foreign company operating through a UK branch. Acting as agent or distributor of an already-authorised UK firm: agent registration is fast, but the principal carries the regulatory liability. And a mirrored structure — a UK permission for the UK market and a continental one for the EEA, since the PSD3 and PSR reform converges the substance of the requirements without restoring mutual recognition; among continental doors the Lithuanian and Luxembourg routes are the usual comparators, with the wider layout in the map of financial licence regimes. A fourth option is not an application at all but a purchase: acquiring a UK EMI or PI requires FCA approval before completion and runs through its own change of control gate.

Common mistakes

Treating the 30 days as a deadline for approval rather than filing. Once a small-regime threshold is breached the firm must file within 30 days. The median determination is 207 days. The transition needs a year of runway, not a month.

Deciding for yourself that the application is complete. The three-month clock starts from the date the FCA confirms in writing as the completeness date. Every information request before that point does not consume the clock — it postpones it.

Budgeting capital at the entry threshold. €125,000 is a floor, not a budget. The live requirement is the greater of initial capital and the method calculation. A money remittance business running €30m a month produces far more than €20,000 under method B, and the FCA may direct up to 20% on top.

Choosing a small EMI to save money. The annual fee is higher than a small PI's, the 2% charge bites at €500,000 of outstanding e-money and is tested at the gate, AIS and PIS are unavailable, and growth forces a full application anyway. The register records the verdict: one new small EMI in five years.

Writing the wind-down plan as a standalone compliance artefact. The review of 14 firms found precisely this — a plan disconnected from the risk framework, without quantified triggers and without modelling a safeguarding shortfall.

Building the pack around the SM&CR. For the payments side there is none; what is needed are PSD and EMD Individual forms and demonstrable fitness of directors and managers. The converse also holds: the lighter regime should not be assumed permanent, since the regulator publicly treats it as a gap.

Assuming MLR registration converts into cryptoasset authorisation. It does not, and the FCA has said so directly.

Scenarios

Launching a payments business into the UK market from scratch. An authorised payment institution with a service set matched to the product: a UK entity, initial capital at the highest applicable figure, and a safe horizon to determination of nine to twelve months from the start of preparation. A small PI only makes sense where €3m of monthly volume is genuinely out of reach for the next two years.

Issuing e-money while remaining a foreign group. Reg 6(4) EMRs admits an applicant with a UK branch and a head office outside the United Kingdom. The route is narrow but real, and it removes the need to relocate management to London. There is no equivalent for a payment institution.

Starting fast and licensing in parallel. Agent registration under an authorised firm takes days — the median for agent cases is 0. It works as a bridge, not as a destination: an agent holds no safeguarding perimeter of its own and depends wholly on the principal's standing. The question to put to any "turnkey UK licence" proposal is which status is actually meant: a small PI and an authorised EMI differ by multiples in rights, capital and running cost while looking equally respectable on the register. How such an operator gets banked is covered in banking for a licensed operator.

Building a crypto product with a fiat leg. Both doors are needed: a payments permission for the fiat flows and a cryptoasset authorisation for the assets. The application window opens on 30 September 2026 and filing early pays — the crypto queue already runs at a median of roughly eight months.