The FCA's 2026 priorities for payment institutions and e-money firms are set out in its Payments Regulatory Priorities report, published on 25 March 2026. It asks firms to do four things: prepare for regulatory change and innovation, meet the Consumer Duty in full, strengthen financial crime and operational resilience controls, and keep customers' money safe through safeguarding, financial resilience and credible wind-down plans. This article sets out what each priority means in practice and the dates that follow from it.
| Priority | What the FCA expects | Key date |
|---|---|---|
| Preparing for the future | Invest to stay compliant as rules change; use pre-application support before applying | Ongoing |
| Consumer Duty | Close gaps now, including international payment pricing and vulnerable customers | Ongoing |
| Financial system integrity | Tackle money laundering and fraud, including APP fraud; embed operational resilience | Incident and third-party reporting from 18 March 2027 |
| Keeping customers' money safe | CASS 15 safeguarding, stronger financial resilience, credible wind-down plans | CASS 15 in force since 7 May 2026 |
The New Regulatory Priorities Format
The FCA's Regulatory Priorities reports replace the portfolio letters, often called Dear CEO letters, that it previously sent to each sector. They are published once a year and are aimed at boards and chief executives. The payments report covers firms authorised or registered under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011. The previous payments portfolio letter was issued in February 2025.
Keeping Customers' Money Safe: Safeguarding
The FCA's PS25/12 safeguarding rules, in the CASS 15 sourcebook, came into force on 7 May 2026. Firms now need CASS 15 records, internal and external reconciliations each reconciliation day, a named director or senior manager responsible for safeguarding, a monthly safeguarding return within 15 business days of each month end (SUP 16.14A), and an annual safeguarding audit. The report says firms should have made the changes by the start date, and the FCA expects to see more adverse audit opinions in the short term as the new standard bites. Firms should treat any gap as a breach to fix now. Our guides to the UK electronic money institution licence and the UK authorised payment institution licence set out the full standard.
Keeping Customers' Money Safe: Financial Resilience and Wind-Down
The report says the FCA has found some firms lack strong governance and risk management over their financial resilience, and that some have not fully developed their wind-down plans. Firms should review the FCA's published good and poor practice on wind-down planning, stress test their capital and liquidity, and make sure the wind-down plan shows how customer funds would be returned.
Financial System Integrity: Financial Crime
The FCA expects firms to keep effective governance, systems and controls, and the skills to identify, assess and reduce financial crime risk. The report highlights money laundering and slowing the growth of fraud, including authorised push payment (APP) fraud, where a customer is tricked into sending money to a fraudster. Firms should also reflect the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 in their policies and training.
Consumer Duty
The report asks firms to assess products, services and processes against the Consumer Duty on an ongoing basis and to close gaps immediately. It points firms to the FCA's good and poor practice publications, including the May 2025 review of international payment pricing transparency and its work on vulnerable customers, and says the FCA will act against firms that do not address gaps. A common issue is describing a transfer as "zero cost" while charging an exchange rate mark-up.
Financial System Integrity: Operational Resilience
Firms should invest to embed operational resilience and prepare for the FCA's incident and third-party reporting rules in PS26/2. From 18 March 2027 payment service providers must report operational incidents that meet set thresholds, and authorised payment institutions and EMIs must keep a register of material third-party arrangements and submit it to the FCA each year.
Preparing for the Future
The FCA asks firms to invest so they stay compliant as rules change and to engage with its policy work and innovation services. It is working with HM Treasury on modernising payments regulation, including whether rule changes are needed for payments made by AI agents, and with the sector on how stablecoins and tokenised payment instruments can be used in regulated payments. Firms planning stablecoin services should read our guide to UK cryptoasset authorisation, as the application window closes on 28 February 2027.
What Firms Should Do Now
- Take the Payments Regulatory Priorities report to the board and record how each priority applies to the firm.
- Test CASS 15 compliance now, including a dry run of the annual safeguarding audit.
- Update the wind-down plan against the FCA's good and poor practice and stress test capital and liquidity.
- Review pricing disclosures, especially exchange rate mark-ups, against the Consumer Duty.
- Build the incident and third-party reporting processes needed for 18 March 2027.
Regulatory Counsel helps payment institutions prepare for FCA supervisory priorities through compliance gap analysis, framework development and ongoing advisory support. Contact us for a written proposal.
Frequently asked questions
They are annual reports, one per sector, that replace the FCA's portfolio letters. The Payments Regulatory Priorities report was published on 25 March 2026 and covers firms under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011.
Keeping customers' money safe. The CASS 15 safeguarding rules came into force on 7 May 2026, and the FCA also wants stronger financial resilience and credible wind-down plans.
The report asks firms to assess products and processes against the Duty continuously, close gaps immediately and review the FCA's good and poor practice publications, including on international payment pricing and vulnerable customers. The FCA says it will act against firms that do not address gaps.
No. CASS 15 has applied since 7 May 2026 and the report says firms should have made the necessary changes by then. The FCA expects more adverse audit opinions in the short term.
The FCA says it will work with the sector on how stablecoins and tokenised payment instruments can be used in regulated payments. Separately, issuing a qualifying stablecoin in the UK becomes a regulated activity on 25 October 2027, and the FCA application window closes on 28 February 2027.
From 18 March 2027 payment service providers must report operational incidents that meet the FCA's thresholds, and authorised payment institutions and EMIs must keep and submit a register of material third-party arrangements (PS26/2). A new single complaints return also applies from the first half of 2027.
Definitive guides on this topic
The permanent reference pages this article relates to.