Firms that provide payment services must be authorised or registered by us, comply with our conduct requirements and give us information that allows us to regulate their businesses accurately.
If your firm provides payment services, it must:
- be registered or authorised by us, unless you’re exempt
- meet the conduct of business requirements of the Payment Services Regulations 2009 (the PSRs)
- provide us with annual ‘reporting information’ so we can supervise your business (for example, details of the value of your payment transactions)
- keep us informed of any changes in your firm (for example, if you want to vary the payment services you provide)
- ensure that your customers’ payments are secure and safe
- money remitters
- non-bank credit card issuers, and
- non-bank merchant acquirers
The revised payment services directive (PSD2)
PSD2 was published in the European Union's Official Journal on 23 December 2015. PSD2 will be implemented in the UK by the Payment Services Regulations 2017 (PSRs 2017) from 13 January 2018. It will impact all firms that provide payment services. Firms that are authorised or registered under the PSRs will need to apply to be re-authorised or re-registered under the PSRs 2017 in order to continue providing payment services. New businesses that are seeking authorisation or registration will also be affected.
PSD2 aims to bring regulation up to date with developments in the payment services industry and to promote further innovation. It also aims to improve consumer protection, make payments safer and more secure, and drive down the cost of services by encouraging competition in the marketplace.
Registration and authorisation
Firms that do not need to register or be authorised
You don’t need to register or be authorised under the PSRs if your firm is a:
- credit union
- building society
- e-money issuer
- municipal bank, or
- the National Savings Bank
Firms that need to be registered
If your firm operates below an average monthly turnover in payment transactions of €3m, it may register as a small payment institution (SPI). Applications under PSD2 can be submitted from 13 October 2017, find out more.
Firms that need to be authorised
You can apply to become an authorised PI if your firm:
- doesn’t qualify as an SPI, or
- wants to provide payment services in other European Economic Area (EEA) member states
If you are unsure whether your activities fall within the scope of the PSRs, consult our Perimeter Guidance.
Applications under PSD2 can be submitted from 13 October 2017, find out more.
What we need from you for registration or authorisation
When you apply for registration or authorisation, you must tell us (among other things):
- what payment services you want to provide
- who’ll be responsible for providing the services (for example, if a manager or an agent is acting on your behalf)
- details of any person or firm with 10% or more of the capital or voting rights in your firm
- whether or not you want to operate in other EEA states
Conduct of business requirements
All PIs must comply with the conduct of business requirements set out in the PSRs. These fall into 2 categories:
- information to be provided to the customer before and after carrying out a payment, and
- the rights and obligations of both the PI and the customer regarding payment transactions
More information is available in Chapter 8 of Our role under the Payment Services Regulations 2009: Our approach.
Reporting requirements for authorised or registered PIs
Authorised and registered PIs must:
- provide regular reporting information to comply with our supervisory and EU reporting obligations
- send ‘notifications’ when there’s a significant change in the firm’s circumstances
Notify changes in circumstances
We need accurate information on PIs to monitor your business. It is important that you tell us if you make changes to your business, such as:
- changing any of your standing data, for example your registered name, trading name and contact details
- changing your legal status, for example from a partnership to a limited company
- making a change in qualifying holding, for example a person with over 10% of your firm’s capital
- changing the people responsible for payment services or your agents
- adding or removing payment services you provide (in which case you must apply to vary your payment services)
- ceasing to provide payment services (in which case you must cancel your registration or authorisation), and
- in the case of a small PI, exceeding the maximum average monthly turnover of €3m (in which case you must apply to become an authorised payment institution and cancel your small PI registration
Security of internet payments
The European Banking Authority (EBA) has published its final Guidelines on the security of internet payments.
Read our response: