PSRs 2017: The Payment Services Regulations 2017

At a glance

Full text

Official full text: The Payment Services Regulations 2017 (HTML, en)¹ · 1,525 KB · file checked 2026-10-19 · consolidated version of 2026-09-23

Official page: legislation.gov.uk¹ · archived copy

Summary

The Payment Services Regulations 2017 (SI 2017/752) form the primary statutory framework governing payment services, payment systems access, and payment institutions in the United Kingdom. Supervised primarily by the Financial Conduct Authority (FCA) alongside the Payment Systems Regulator (PSR), the regulations apply to banks, electronic money institutions, payment initiation service providers (PISPs), account information service providers (AISPs), money remitters, and merchant acquirers. The regulations establish three regulatory authorizations: Authorised Payment Institutions (APIs), Small Payment Institutions (SPIs) for firms executing an average monthly transaction volume not exceeding 3 million euros, and Registered Account Information Service Providers (RAISPs). Key statutory obligations include holding initial capital between 20,000 and 125,000 euros, maintaining ongoing own funds, strictly safeguarding customer funds in segregated accounts or through insurance, implementing strong customer authentication (SCA), complying with 90-day framework contract termination notice rules, and obtaining prior FCA approval under FSMA Part 12 for changes in corporate control.

Summary written by the Atlas from the official text; the law itself prevails.

Main articles

• reg. 6: Sets conditions for authorization as a payment institution, requiring UK head office, sound governance, fit and proper managers, and required initial capital.
• reg. 9: Requires the FCA to determine authorization applications within three months of receiving a complete application, or twelve months of an incomplete application.
• reg. 14: Establishes conditions for registration as a small payment institution, including a monthly turnover cap of 3 million euros and clean management records.
• reg. 18: Sets conditions for registration as an account information service provider, requiring professional indemnity insurance covering liabilities across operating jurisdictions.
• reg. 20: Imposes a statutory duty on payment institutions to give prompt written notice to the FCA of any significant change in relevant information.
• reg. 22: Requires authorized payment institutions to maintain own funds equal to or greater than initial capital or the amount calculated under Schedule 3.
• reg. 23: Mandates safeguarding of relevant payment funds through segregated accounts held with approved credit institutions or through comparable insurance policies or guarantees.
• reg. 25: Restricts outsourcing of operational functions, prohibiting delegation that impairs internal controls, governance quality, or the FCA's ability to monitor compliance.
• reg. 34: Governs the appointment of agents, requiring payment institutions to register agents with the FCA and ensure their fitness, propriety, and competence.
• reg. 51B: Requires payment service providers to give users at least 90 days' notice with detailed, specific reasons before terminating an indefinite framework contract.
• reg. 69 & 70: Obligates account servicing payment service providers to provide secure, non-discriminatory access to payment accounts for licensed payment initiation and account information providers.
• reg. 100: Mandates payment service providers to apply strong customer authentication whenever a payer accesses accounts online, initiates electronic payments, or performs remote transactions.
• reg. 105: Requires credit institutions to provide payment institutions with access to bank account services on a proportionate, objective, and non-discriminatory basis.
• reg. 111: Empowers the FCA to impose financial penalties of any amount it considers appropriate on payment service providers contravening statutory requirements.
• reg. 118: Empowers the FCA to levy fees on payment service providers to cover its costs of exercising supervisory functions under the regulations.
• reg. 138: Makes the provision or purported provision of payment services without authorization, registration, or exemption a criminal offence punishable by imprisonment and fines.
• Schedule 3: Specifies initial capital tiers of 20,000, 50,000, or 125,000 euros and defines Methods A, B, and C for calculating ongoing own funds requirements.
• Schedule 6, para. 5: Applies Part 12 of FSMA 2000, requiring proposed controllers to obtain prior FCA approval before acquiring or increasing control over payment institutions.

Licences it governs

• PI · United Kingdom

  Registered Account Information Service Provider (RAISP)

  FCA

• PI · United Kingdom

  Small Payment Institution (SPI) Registration

  FCA

• PI · United Kingdom

  Authorised Payment Institution (API)

  FCA

Regulators that apply it

• United Kingdom

  Financial Conduct Authority (FCA)

  The Financial Conduct Authority regulates the conduct of around 35,500 financial services firms and markets across the United Kingdom, and a

Upcoming changes

• Phased repeal under Financial Services and Markets Act 2023 (c. 29), Sch. 1 Pt. 2: Revocation of retained EU law provisions and transition of payment services regulation into the FCA Handbook under the Smarter Regulatory Framework.²
• Prospective amendments under Financial Services Act 2021 (c. 22), s. 23: Powers conferred on HM Treasury to amend or replace Gibraltar-related provisions governing payment institutions.³