Our findings on enterprise and liquidity risk management and wind-down planning. Find out more on our expectations, good practice and areas for improvement.
1. Who this will interest
This multi-firm review will interest firms authorised to provide services under the:
In this review, we refer to these firms as ‘firms’ or ‘payments firms’.
2. Executive summary
The UK payments sector is innovative and evolving, which brings competition and choice for customers. This innovation is leading to growth and expansion in firms.
As payment firms increase the scale, breadth and complexity of their activities, they should develop their risk management frameworks in line with this growth. A well-organised firm, with a risk framework that reflects the activities it undertakes and potential harm it could generate, will be able to make informed decisions and achieve sustainable growth.
Supporting growth and innovation in UK financial services is one of our strategic priorities[3].
However, in a recent review we found that risk management frameworks and wind-down plans (WDPs) in firms remain underdeveloped. These are capabilities that we expect firms to have in place, in line with our Principles of Business[4] (see Principle 4) and FCA priorities for this portfolio[5].
We identified 3 main areas of improvement for firms’ risk management frameworks:
- enterprise-wide risk management frameworks
- liquidity risk management
- consideration of group risk
Firms have made efforts to make sure WDPs have a structure in-line with our expectations. But the underlying content is often incomplete, high-level and not aligned with the risk management framework, with inadequate triggers and links between financial resources held and resources required for wind-down.
None of the firms we reviewed fully met our expectations, and in particular were not following the guidance in FG20/1[6]. By reviewing existing practices and capabilities, firms will be able to make sure they meet our expectations and are positioned for sustainable growth and an orderly market exit if required.
After we completed our reviews, foreign exchange markets entered a turbulent period, affecting some firms' liquidity resources. Such events reinforce the importance of adequate risk management and wind-down planning.
3. What you need to do
Compare our findings to your firm’s arrangements to see if you meet our existing expectations. This will help you identify where you may need to invest in risk management and wind-down planning.
You should consider the nature, scale and complexity of your business when applying these findings. Regardless of size, all firms should consider the underlying principles of these findings.
Publication of these findings does not set new FCA expectations. They are intended to help firms understand our existing expectations by providing additional payment-firm specific examples.
4. What we did
During 2024/2025, we reviewed a sample of 14 firms with e-money and payments permissions, representing a variety of business models. We focused on enterprise and liquidity risk management and wind-down planning, as we highlighted these as priorities in 2023 [7]and 2025[5].
We asked firms for information, held on-site meetings and, after the review, gave individual feedback.
We have aggregated our findings to identify themes, good practices and areas for improvement. Our specific payments firms' observations aim to help firms understand existing FCA expectations.
Our review did not include an in-depth assessment of firms’ compliance with safeguarding rules. Instead, it covered the implications of safeguarding on financial resilience and wind-down planning.
For further information on safeguarding, see CP24/20[8].
5. Findings
5.1. Risk management frameworks
Effective risk management frameworks promote financial resilience by identifying and assessing risks, and quantifying the resources needed to cover them. They allow senior managers to be better informed when making decisions. This, in turn, supports firms’ sustainable growth.
All firms have made a start at implementing our expectations, for example, embedding elements of stress testing in risk management. But frameworks are generally inadequate for the level and complexity of activities firms undertake or not mature enough to support informed decision-making. We encourage firms to review FG20/1[6], which outlines our expectations of good practice in risk management.
We identified 3 main areas of improvement for firms’ risk management frameworks: enterprise-wide risk management frameworks, liquidity risk management, and consideration of group risk.
We saw that:
Good practice
We saw elements of the following good practice, but at differing levels across firms reviewed.
Enterprise-wide risk management framework
- Embedding risk management fundamentals in FG20/1[9].
- Risk management frameworks that are commensurate with the complexity and scope of activities, enabling firms to identify and document material risks specific to their business model.
- Using the risk management framework to support informed decision-making.
- Establishing a risk appetite agreed at board level, reviewed at least annually, with quantitative elements calibrated through risk assessment and stress testing.
- Having an enterprise-wide view of risk, rather than a siloed approach.
- Holding financial resources that are proportionate to the activities of the firm and its risk profile, not just the minimum regulatory requirement.
- Using stress testing to understand business vulnerabilities and potential losses in relevant scenarios, as well as using stress testing to calibrate risk appetite, risk tolerances, wind-down triggers and adequate resources.
Liquidity risk management
- Explicitly considering liquidity risk in the risk management framework and using stress testing to inform liquidity risk appetite, key risk indicators, limits and adequate resources.
- Establishing a liquidity risk framework that not only models routine payments such as customer withdrawals, regular operational costs and margin payments, but also unexpected stress events. As a result, holding adequate liquidity resources considering the impact of stress events and the firm’s risk appetite.
- Including all available information about the liquidity position in the stress testing. For example, the amount of credit facilities extended to customers to cover margin calls should be captured in the stress testing.
- Establishing a contingency funding plan defining reliable funding sources and clearly delegated management actions.
- Considering the impact of a stress on uncommitted intra-group liquidity facilities when assessing liquidity adequacy.
Group risk
- Identifying and managing material group risks and tailoring group risk management policies to the firm’s specific conditions.
- Documenting conflicts of interest policy and lines of authority over intra-group arrangements, including access to shared financial resources.
- Considering the interlinkages between individual firm WDPs and group WDPs.
Areas for improvement
Enterprise-wide risk management framework
- Having a risk management framework that is not appropriate for the current business and insufficient to support sustainable growth.
- Failing to regularly identify and quantify material risks faced by the business.
- Having a narrow, siloed view of risk, preventing senior management from managing risk across the business.
- Setting financial resource risk appetite at the minimum regulatory requirement without considering the firm's actual risk profile.
- Inadequate understanding or assessment of risks arising from new activities, preventing management from assessing resource requirements.
- Not stress testing material risks to verify that resources are proportionate to the complexity of the business model.
- Having a risk appetite that is solely based on judgement, making no use of stress testing.
- Not having risk appetite and an appropriate risk management framework for the credit facilities extended to customers to fully or partially waive their margin calls.
- Not differentiating between capital and liquidity resources.
Liquidity risk management
- Not clearly identifying and articulating liquidity risks given the activities of the firm.
- No link between the size of credit facilities extended to customers around margin call payments and liquidity stress testing. This results in underestimating the firm’s liquidity needs in crisis.
- Lack of control and monitoring of liquidity risks.
- Relying on existing cash balances to manage a liquidity stress, without considering whether sufficient cash will be available when risks crystallise.
- Not considering the impact of a stress(es) on cash balances or on funding sources. Relying on overdrafts without considering their availability in stress.
- Not understanding all liquidity risks arising from safeguarding arrangements, including shortfalls.
- No consideration of reduced market liquidity for safeguarded assets.
Group risk
- Relying on the group risk management such as risk appetite, key risk indicators, limits or triggers without verifying the suitability for the individual firm’s specific risks.
- Crisis decision-making involving multiple layers of group governance and unclear delegated authority, slowing decision-making.
- Material intra-group dependency for operations without assessing risks of such arrangements on financial and operational resilience.
5.2. Wind-down plans
Overall, almost all the wind-down plans (WDPs) we reviewed were disconnected from the firm’s risk management framework and needed more work to be credible and operable.
Firms should embed wind-down planning into their risk management framework, recognising that disorderly wind-down is a key driver of harm. Shortcomings in wind-down triggers sometimes indicate broader issues with firms’ risk management and risk appetite frameworks.
The WDPs we reviewed lacked sufficient detail, testing and validation.
Plans should consider:
- operations
- treatment of residual safeguarded funds
- liquidity needs
- wind-down triggers which should be driven by the risk appetite
WDPs also need to have realistic timescales and assessments of how financial and non-financial resources are maintained while the firm exits the market.
These considerations will result in more operable WDPs which can reduce harms to consumers and markets, if a market exit is required.
We encourage firms to review our Wind-down Planning Guide[10] and TR22/1[11] to help them develop their WDPs.
Good practice
We saw elements of the following good practice, but to differing levels of maturity and completeness of coverage across firms reviewed.
- WDPs that have sufficient detail and consider all material activities, making them operable.
- Appropriate structure and documentation of WDPs, assessing stresses and quantifying resources required.
- Integration of wind-down planning with the wider risk management framework.
- Reverse stress testing to inform points of non-viability and wind-down triggers. Consideration of the impact of stresses on resources before the start of wind-down.
- Detailed modelling of resources required for wind-down including advisory fees, redundancy and employee retention costs.
- Identifying key risks to the WDP, considering how they could crystallise and putting in place mitigation measures such as holding additional resources.
- Regular testing of WDP operability via run-throughs or workshops.
Areas for improvement
- Setting wind-down triggers that are inconsistent with the risks identified in the risk management framework and that are not quantified according to risk appetite.
- Not considering triggers around safeguarding asset shortages or lapsing of safeguarding insurance, where relevant, as set out in paragraph 10.65 of our approach to payment services and electronic money[12] (September 2017).
- Insufficient detail in the WDP about how it would work in practice, making it inoperable.
- Limited financial modelling through wind-down. No consideration of impact on capital from changes to revenues and costs, or impact on liquidity when sufficient cash may not be available to execute the plan.
- Assuming key risks would not crystallise during wind-down and not testing the impact of stresses that take place after the wind-down is started.
- Not analysing how the wind-down timeline can be delayed by issues such as safeguarding, financial crime or contacting customers. For example, not considering meeting obligations to safeguard residual customer funds for 6 years.
- Undue reliance on group wind-down plans or resources.
6. Next steps
We expect firms to review their arrangements against our findings and make any necessary improvements.
We have set out our expectations in our published guidance (see below). By sharing the findings of our review, we are supporting firms to meet these expectations.
The payment sector is an important one, and effective risk management is crucial for future growth and innovation.
We will continue to engage with the sector as it ensures it has effective risk management and WDPs in place.
7. Useful references
Read our review findings alongside the publications below. They collectively set out the FCA's prudential and wind-down planning expectations, and prudential priorities for these firms.
Read the Principles for Businesses (PRIN)[13].
All UK authorised firms providing payment services or issuing electronic money are subject to the Principles for Businesses (PRIN). PRIN is a general statement of the fundamental obligations of regulated firms. It includes maintaining adequate financial resources in Principle 4 (PRIN 2.1.1[4], subject to PRIN 3.1.1A[14]). A firm must be able to show that its level of financial resources is consistent with this obligation.
We set out:
- More specific expectations in Payment services and electronic money – our approach[14] (2017).
- Current priorities in Dear CEO Letter: FCA Priorities for Payment Portfolio Firms[8] (3 February 2025).
We also encourage firms to read our:
- Finalised Guidance, FG20/1: Assessing adequate financial resources[11] (June 2020)
- Wind-down Planning Guide (WDPG)[12]
- Thematic Review, TR22/1: Observations on wind-down planning: liquidity, triggers and intragroup dependencies[13] (April 2022)