FCA payments regulatory priorities

The FCA has replaced more than 40 portfolio letters with a new suite of Regulatory Priorities reports, published annually by sector. The payments edition arrives at a moment of profound structural change.

The payments sector has continued to develop, driven by technological advances like open banking, and digital payment methods like stablecoins and tokenised deposits. Over 16 million people and businesses used open banking in the UK in 2025.

The potential for innovation to deliver better outcomes for consumers and markets is encouraging - including offering consumers and businesses more payment methods that meet their needs. Yet alongside that opportunity runs a harder supervisory message. Some firms have improved their governance and systems and controls to protect financial system integrity and keep their customers' money safe - but others have more to do. The FCA has been robust to mitigate the risk of harm, using its supervisory and enforcement tools. 

These reports are addressed squarely at Boards and Chief Executives, who are expected to read them carefully, review the priorities within them, and act where they need to. Four priorities define the agenda for the next twelve months. This briefing sets out what each demands of firms, explains what is genuinely new in the FCA's thinking, and offers practical steps your firm should take now.

This report is addressed to firms authorised or registered under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011.

Priority 1: Preparing for the future to support effective competition, innovation and growth

The FCA expects the payments sector to continue developing, driven by innovations that have the potential to boost growth and competition. As it continues policy work on open banking, stablecoins, and modernising payments regulation, firms should make any changes needed to comply with the applicable regulation on an ongoing basis and invest where needed to ensure they are ready to comply with regulatory change. 

The FCA encourages firms to respond to its policy papers and join events like its Tech Sprints and Policy Sprints. Firms that meet the relevant criteria can use the FCA's innovation services to bring ideas to market in a controlled and sustainable way, and those intending to apply for authorisation or registration should prepare thoroughly and consider using the FCA's pre-application support service.

What is new

Previous FCA portfolio letters for payments contained incremental supervisory nudges within a largely static regulatory framework. The ambition on display here is of a different order entirely. The FCA will support the Treasury in introducing legislation to grant it powers to set new rules for the long-term open banking regulatory framework, and has already brought sector leaders together to help the industry develop commercial models for variable recurring payments, helped industry incorporate a new entity to unlock low-risk use cases including utility payments, financial services payments and payments to local and central government, and has laid the foundations for e-commerce use cases.

The FCA will also work with the Treasury to modernise and future-proof the regulation of payment services and electronic money - including considering whether change or development of regulation is needed to support agentic AI payments.

That last point - regulatory consideration of agentic AI - is an entirely new dimension absent from any prior supervisory communications to this sector. The FCA will also work with the sector to consider the appropriate way in which stablecoins and other tokenised payment instruments can be brought into regulated payments. The Payments Forward Plan, published in February 2026, presents a consolidated view of the regulatory pipeline and its intended outcomes to help firms plan and innovate.

Practical steps for firms

Begin an immediate assessment of where your firm's current compliance with applicable regulations may need updating as policy work on open banking, stablecoins, and payments modernisation progresses - and build a budget for that investment now, not reactively.

Respond to the FCA's policy papers and participate in Tech Sprints and Policy Sprints: firms that engage in shaping future regulation will be better placed to comply with it and may gain competitive advantage from early sight of emerging requirements.

Begin scoping the potential impact of agentic AI on your payment services model now - do not wait for the FCA's regulatory conclusions before understanding how your firm's use of AI in payments processes may need to be governed.

If your firm is preparing for authorisation or registration, use the FCA's pre-application support service - the FCA has flagged higher approval rates for the sector, but continues to see failures on senior managers' competence and inadequate financial crime controls.

Engage with the independent consultancy-led exercise to support the selection of the body to lead the set-up of the open banking Future Entity, including the series of workshops planned over summer and into autumn 2026.

Priority 2: Ensuring firms implement the Consumer Duty effectively

When firms implement the Consumer Duty effectively, they protect consumers and deepen trust. The FCA has seen improvements, but there are still instances where firms are not acting to deliver good outcomes for retail consumers. The FCA recently found that firms could be more transparent about the cost of international money remittance and cross-border payments. Firms should assess their products, services and processes against all the relevant rules and guidance, including the Consumer Duty, on an ongoing basis, and address gaps in their compliance immediately.

What is new

Previous Dear CEO letters for payments firms treated the Consumer Duty largely as an implementation exercise - something to be embedded and evidenced. The FCA is now moving into active enforcement mode, signalling that it will continue to engage with firms on their obligations under the Duty, identifying gaps in compliance and taking appropriate action against firms that fail to address them - with international payment pricing transparency and the treatment of consumers in vulnerable circumstances as the two named areas of focus.

Total customer complaints submitted to the Financial Ombudsman Service against payments firms fell 9% from 2024 to 2025 - encouraging data, but the FCA makes clear that headline complaint volumes do not tell the full story of outcomes quality. The shift from implementation to ongoing assurance - with enforcement consequences - marks a meaningful escalation in tone.

Practical steps for firms

• Conduct a structured, documented Consumer Duty self-assessment at product and service level - if you have not reviewed your assessment since initial implementation, it is now overdue.
• Review the FCA's good and poor practice publications specifically on implementing the Consumer Duty, international payment pricing transparency, delivering good outcomes for consumers in vulnerable circumstances, and cryptoasset financial promotions and fiat-to-crypto on/off ramp services.
• If your firm offers international payment or cross-border remittance services, treat pricing transparency as an immediate compliance priority - the FCA has signalled this is a named area of active focus.
• Ensure your Board receives regular, data-driven reporting on consumer outcomes under the Consumer Duty - the FCA's supervisory model is increasingly data-led, and firms that cannot demonstrate outcome monitoring will face disproportionate scrutiny.

Priority 3: Protecting financial system integrity

Protecting and enhancing the integrity of the UK financial system helps to ensure that markets are effective, efficient, and reliable - and is the foundation of long-term competitiveness and growth. The FCA has been encouraged by some firms significantly enhancing their governance, oversight, and systems and controls.

However, weaknesses in this area still pose risks to market integrity. Firms should have effective governance arrangements and systems and controls to identify, assess and mitigate risk, and should have the right skills to deliver their governance priorities and to design and test systems and controls.

What is new

Prior FCA Dear CEO letters acknowledged financial crime and operational resilience as standing concerns. The register has sharpened considerably.

The FCA will tackle financial crime, including money laundering, and slow the growth of fraud, including authorised push payment fraud, cooperating with industry, other regulators, and law enforcement agencies to reduce harm and exploring opportunities for greater data sharing. Collaborating with industry, regulators and law enforcement agencies to fight financial crime has been a priority, in line with the Government's and FCA's strategic approach - and the FCA has improved its mechanisms for exchanging information with law enforcement agencies. 

The FCA will also publish its policy statement alongside the Bank of England and Prudential Regulation Authority on Incident and Third-Party Reporting rules - a concrete new regulatory obligation for which firms must begin preparing now. Where firms have been unsuccessful in applying for authorisation or registration, the FCA has seen issues with senior managers' competence and inadequate systems and controls, including financial crime controls. The message is unambiguous: financial crime controls are a gateway requirement, not an afterthought.

Practical steps for firms

• Conduct an honest assessment of the adequacy of your financial crime governance - not merely whether controls exist, but whether the right skills and oversight capabilities are in place to design, test, and challenge them.
• Begin mapping your firm's current incident reporting workflows and third-party data sources against the forthcoming Incident and Third-Party Reporting rules in the FCA's upcoming policy statement - firms that begin implementation planning now will avoid a last-minute scramble.
• Note the FCA's available remediation tools: these include requirements applied to firms to limit risks until controls improve, and the appointment of independent skilled persons to review systems and controls and assure remediation - these are not theoretical powers.
• Invest in operational resilience, including embedding resilience considerations into new product design processes - the FCA expects this to be a standing feature of how payments firms operate, not a retrospective exercise.

Priority 4: Keeping customers' money safe

Over the past year, some firms have improved their financial resilience and safeguarding arrangements. However, some don't have robust safeguarding practices and haven't fully developed their risk management frameworks and wind-down plans. 

This presents a risk to customer funds and market integrity. Electronic money institutions safeguarded approximately £26bn in 2024, up from £11bn in 2021, and payment institutions safeguarded an estimated £6bn per day in 2024. The scale of customer funds at risk makes this the priority with the most immediate compliance deadline.

What is new

Safeguarding featured in prior FCA portfolio letters as a conduct standard to be maintained. It has become something qualitatively different. The FCA published a policy statement on changes to the safeguarding regime to address current weaknesses in firms' practices. The Safeguarding Supplementary Regime will come into force in May 2026, and firms should be ready to comply with the new rules.

The FCA will consider the outcomes of safeguarding audits and address issues with firms, and has warned that as it has strengthened standards, it may see an increase in adverse audit opinions in the short term. That candid acknowledgement - that the new rules are demanding enough that failures will surface - is a signal that firms should treat as a prompt to act, not as reassurance.

The FCA has also shared examples of good and poor practice for risk management and wind-down planning - firms should review these findings and take appropriate action.

Practical steps for firms

• Assess your firm's readiness to comply with the new safeguarding rules that come into force in May 2026 - this is not a horizon issue; it requires action now.
• Review the FCA's good and poor practice examples on risk management and wind-down planning and benchmark your firm's current arrangements against them.
• Ensure your Board has genuine oversight of safeguarding governance - not delegated operational sign-off, but board-level accountability for identifying, assessing and mitigating safeguarding risk.
• If your firm's safeguarding audit returns an adverse opinion, treat it as a supervisory early warning and engage proactively with the FCA - do not wait for the FCA to initiate contact.
• Ensure wind-down plans are documented, tested, and genuinely executable - the FCA has identified inadequate wind-down planning as a market-wide weakness, and it will use its supervisory tools against firms that cannot demonstrate readiness.

Additional areas requiring attention

Beyond the four headline priorities, the FCA will build on the success of open banking to launch open finance, with its open finance roadmap to be published by the end of March 2026 and the regulatory framework for the first scheme expected to be in place by the end of 2027.

1. On stablecoins, the FCA will publish its final policy statements on its cryptoasset regime in 2026, including final rules on the issuance of stablecoins in the UK.
2. Following its first dedicated Tech Sprint for stablecoins in March 2026 covering retail payments, cross-border payments, e-commerce, business-to-business transactions and remittance, the FCA will hold a trade payments roundtable in May.
3. On artificial intelligence, the FCA will continue to give firms a safe space to experiment and test, including continuing cohort 1 and launching cohort 2 of the Supercharged Sandbox and AI Live Testing.
4. The FCA's international work includes contributing to initiatives to enhance the transparency, speed, affordability, accessibility and security of cross-border payments, working through multilateral bodies including the OECD, FATF, and the Financial Stability Board.

Conclusion

The FCA's new Regulatory Priorities report for payments is not a reformatted version of familiar portfolio letter communications. It is the latest example of how the FCA is transforming the way it supervises - with expanded dedicated supervisory contacts, a more risk-based approach for its largest firms, and more targeted and efficient data collection. The stated goal - less intensive attention on firms doing the right thing, and stronger, faster action where harm is greatest - should not be read as reassurance. It is a direct statement of enforcement intent, calibrated by risk.

The four priorities: preparing for the future to support competition, innovation and growth; implementing the Consumer Duty effectively; protecting financial system integrity; and keeping customers' money safe - span every aspect of how a payments firm operates, from its gateway application through to its wind-down plan. The volume of live regulatory change - the Safeguarding Supplementary Regime coming into force in May, the forthcoming policy statement on Incident and Third-Party Reporting, the modernisation of payment services and e-money regulation including for agentic AI, and final stablecoin rules - means the compliance burden will intensify before it eases. 

Equally, the FCA explicitly welcomes engagement: it invites firms to share their insights, challenge its thinking, and work with it as it refines its new supervisory model. Open banking, open finance, the stablecoin framework, the Future Entity, and the AI sandbox all represent genuine opportunities for firms that move early to influence the rules they will live by.

Trust and confidence are essential for growth and competition, and they are built on firms meeting proportionate standards. The payments sector is undergoing the fastest period of structural change in a generation. The FCA has drawn a clear map of where it intends to focus, and what it intends to do when it finds firms falling short. The question for every Board and Chief Executive in this sector is not whether these priorities are relevant to your firm - they are. The only question is whether you are already in front of them.