The Payment Services Regulations 2017

PART 2Registration

The register

The register of certain payment service providers

4.—(1) The FCA must maintain a register of—

(a)authorised payment institutions and their EEA branches;

(b)small payment institutions;

(c)registered account information service providers;

(d)persons providing a service falling within paragraph 2(k)(i) to (iii) or (l) of Schedule 1 who have notified the FCA under regulation 38 or 39 (notification of use of limited network or electronic communications exclusion);

(e)agents of authorised payment institutions, small payment institutions and registered account information service providers, registered under regulation 34 (use of agents); and

(f)the persons specified in regulation 3(1) (exemption for certain bodies) where they provide payment services.

(2) The FCA may include on the register any of the persons mentioned in paragraphs (d) to (i) of the definition of a payment service provider in regulation 2(1) (interpretation) where such persons provide payment services.

(3) Where a person mentioned in paragraph (h), (i) or (j) of the definition of a payment service provider in regulation 2(1)—

(a)is not included on the register; and

(b)provides, or proposes to provide, payment services,

the person must give notice to the FCA.

(4) The FCA may—

(a)keep the register in any form it thinks fit;

(b)include on it such information as the FCA considers appropriate, provided that the register identifies the payment services for which an institution is authorised or registered under this Part; and

(c)exploit commercially the information contained in the register, or any part of that information.

(5) The FCA must—

(a)publish the register online and make it available for public inspection;

(b)enter in the register any cancellation of an authorisation or registration;

(c)enter in the register a description of the service provided by a person included on the register by virtue of paragraph (1)(d);

(d)update the register without delay; and

(e)provide a certified copy of the register, or any part of it, to any person who asks for it—

(i)on payment of the fee (if any) fixed by the FCA; and

(ii)in a form (either written or electronic) in which it is legible to the person asking for it.

(6) The FCA must, without delay, notify the European Banking Authority of—

(a)the information entered in the register;

(b)any changes to the information in the register;

(c)the reasons for the cancellation of any authorisation or registration; and

(d)where a person is included on the register by virtue of paragraph (1)(d), the particular exclusion which applies to the services provided by the person.

Authorisation as a payment institution

Application for authorisation as a payment institution or variation of an existing authorisation

5.—(1) An application for authorisation as a payment institution must contain or be accompanied by the information specified in Schedule 2 (information to be included in or with an application for authorisation).

(2) An application for the variation of an authorisation as a payment institution must—

(a)contain a statement of the proposed variation;

(b)contain a statement of the payment services which the applicant proposes to carry on if the authorisation is varied; and

(c)contain, or be accompanied by, such other information as the FCA may reasonably require.

(3) An application under paragraph (1) or (2) must be made in such manner as the FCA may direct.

(4) At any time after receiving an application and before determining it, the FCA may require the applicant to provide it with such further information as it reasonably considers necessary to enable it to determine the application.

(5) Different directions may be given, and different requirements imposed, in relation to different applications or categories of application.

Conditions for authorisation as a payment institution

6.—(1) The FCA may refuse to grant all or part of an application for authorisation as a payment institution only if any of the conditions set out in paragraphs (2) to (9) is not met.

(2) The application must comply with the requirements of, and any requirements imposed under, regulations 5 (application for authorisation) and 20 (duty to notify changes).

(3) The applicant must immediately before the time of authorisation hold the amount of initial capital specified in Part 1 of Schedule 3 (capital requirements).

(4) The applicant must be a body corporate constituted under the law of a part of the United Kingdom having—

(a)its head office, and

(b)if it has a registered office, that office,

in the United Kingdom.

(5) The applicant carries on, or will carry on, at least part of its payment service business in the United Kingdom.

(6) The applicant must satisfy the FCA that, taking into account the need to ensure the sound and prudent conduct of the affairs of the institution, it has—

(a)robust governance arrangements for its payment service business, including a clear organisational structure with well-defined, transparent and consistent lines of responsibility;

(b)effective procedures to identify, manage, monitor and report any risks to which it might be exposed;

(c)adequate internal control mechanisms, including sound administrative, risk management and accounting procedures,

which are comprehensive and proportionate to the nature, scale and complexity of the payment services to be provided by the institution.

(7) The applicant must satisfy the FCA that—

(a)any persons having a qualifying holding in it are fit and proper persons having regard to the need to ensure the sound and prudent conduct of the affairs of an authorised payment institution;

(b)the directors and persons responsible for the management of the institution and, where relevant, the persons responsible for the management of payment services, are of good repute and possess appropriate knowledge and experience to provide payment services;

(c)it has a business plan (including, for the first three years, a forecast budget calculation) under which appropriate and proportionate systems, resources and procedures will be employed by the institution to operate soundly;

(d)it has taken adequate measures for the purpose of safeguarding payment service users’ funds in accordance with regulation 23 (safeguarding requirements);

(e)in the case of an applicant which proposes to carry on payment initiation services, it holds professional indemnity insurance or a comparable guarantee, which covers—

(i)the territories in which the applicant proposes to offer payment initiation services; and

(ii)the applicant’s potential liability under regulations 76 (payment service provider’s liability for unauthorised payment transactions) and 91 to 95 (non-execution or defective or late execution of transactions, liability for charges and interest and right of recourse), up to such amount as the FCA may direct; and

(f)in the case of an applicant which proposes to carry on account information services, it holds professional indemnity insurance or a comparable guarantee, which covers—

(i)the territories in which the applicant proposes to offer account information services; and

(ii)the applicant’s potential liability to account servicing payment service providers and payment service users resulting from unauthorised or fraudulent access to, or use of, payment account information, up to such amount as the FCA may direct.

(8) The applicant must comply with a requirement of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017(1) to be included in a register maintained under those Regulations where such a requirement applies to the applicant.

(9) If the applicant has close links with another person (“CL”) the applicant must satisfy the FCA—

(a)that those links are not likely to prevent the FCA’s effective supervision of the applicant; and

(b)if it appears to the FCA that CL is subject to the laws, regulations or administrative provisions of a territory which is not an EEA State (“the foreign provisions”), that neither the foreign provisions, nor any deficiency in their enforcement, would prevent the FCA’s effective supervision of the applicant.

(10) For the purposes of paragraph (9), an applicant has close links with CL if--

(a)CL is a parent undertaking of the applicant;

(b)CL is a subsidiary undertaking of the applicant;

(c)CL is a parent undertaking of a subsidiary undertaking of the applicant;

(d)CL is a subsidiary undertaking of a parent undertaking of the applicant;

(e)CL owns or controls 20% or more of the voting rights or capital of the applicant; or

(f)the applicant owns or controls 20% or more of the voting rights or capital of CL.

Imposition of requirements

7.—(1) The FCA may include in an authorisation such requirements as it considers appropriate.

(2) A requirement may, in particular, be imposed so as to require the person concerned to—

(a)take a specified action;

(b)refrain from taking a specified action.

(3) A requirement may be imposed by reference to the person’s relationship with its group or other members of its group.

(4) Where—

(a)an applicant for authorisation as a payment institution intends to carry on business activities other than the provision of payment services; and

(b)the FCA considers that the carrying on of such other business activities will impair, or is likely to impair—

(i)the financial soundness of the applicant, or

(ii)the FCA’s effective supervision of the applicant,

the FCA may require the applicant to establish a separate body corporate to carry on the payment service business.

(5) A requirement expires at the end of such period as the FCA may specify in the authorisation.

(6) Paragraph (5) does not affect the FCA’s powers under regulation 8 or 12 (variation of authorisation).

Variation etc. at request of authorised payment institution

8.  The FCA may, on the application of an authorised payment institution, vary that person’s authorisation by—

(a)adding a payment service to those for which it has granted authorisation;

(b)removing a payment service from those for which it has granted authorisation;

(c)imposing a requirement such as may, under regulation 7 (imposition of requirements), be included in an authorisation;

(d)cancelling a requirement included in the authorisation or previously imposed under paragraph (c); or

(e)varying such a requirement,

provided that the FCA is satisfied that the conditions set out in regulation 6(4) to (9) (conditions for authorisation) and, if applicable, the requirement in regulation 22(1) (capital requirements) to maintain own funds, are being or are likely to be met.

Determination of application for authorisation or variation of authorisation

9.—(1) The FCA must determine an application for authorisation or the variation of an authorisation before the end of the period of three months beginning with the date on which it received the completed application.

(2) The FCA may determine an incomplete application if it considers it appropriate to do so, and it must in any event determine any such application within 12 months beginning with the date on which it received the application.

(3) The applicant may withdraw its application, by giving the FCA notice, at any time before the FCA determines it.

(4) The FCA may grant authorisation to carry out the payment services to which the application relates or such of them as may be specified in the grant of the authorisation.

(5) If the FCA decides to grant an application for authorisation, or for the variation of an authorisation, it must give the applicant notice of its decision specifying—

(a)the payment services for which authorisation has been granted; or

(b)the variation granted,

described in such manner as the FCA considers appropriate.

(6) The notice must state the date on which the authorisation or variation takes effect.

(7) If the FCA proposes to refuse an application or to impose a requirement it must give the applicant a warning notice.

(8) The FCA must, having considered any representations made in response to the warning notice—

(a)if it decides to refuse the application or to impose a requirement, give the applicant a decision notice; or

(b)if it grants the application without imposing a requirement, give the applicant notice of its decision, stating the date on which the authorisation or variation takes effect.

(9) If the FCA decides to refuse the application or to impose a requirement the applicant may refer the matter to the Upper Tribunal.

(10) If the FCA decides to authorise the applicant, or vary its authorisation, it must update the register as soon as practicable.

Cancellation of authorisation

10.—(1) The FCA may cancel a person’s authorisation and enter such cancellation in the register where—

(a)the person does not provide payment services within 12 months beginning with the date on which the authorisation took effect;

(b)the person requests, or consents to, the cancellation of the authorisation;

(c)the person ceases to engage in business activity for more than six months;

(d)the person has obtained authorisation through false statements or any other irregular means;

(e)the person no longer meets, or is unlikely to continue to meet, any of the conditions set out in regulation 6(4) to (9) (conditions for authorisation) or, if applicable, the requirement in regulation 22(1) (capital requirements) to maintain own funds, or does not inform the FCA of a major change in circumstances which is relevant to its meeting those conditions or that requirement, as required by regulation 37 (duty to notify change in circumstance);

(f)the person has provided payment services other than in accordance with the authorisation granted to it;

(g)the person would constitute a threat to the stability of, or trust in, a payment system by continuing its payment services business;

(h)the cancellation is desirable in order to protect the interests of consumers; or

(i)the person’s provision of payment services is otherwise unlawful, including where such provision of services is unlawful because the person’s registration in a register maintained under regulation 54 or 55 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (duty and power to maintain registers) has been cancelled under regulation 60 of those Regulations (cancellation and suspension of registration).

(2) Where the FCA proposes to cancel a person’s authorisation, other than at the person’s request, it must give the person a warning notice.

(3) The FCA must, having considered any representations made in response to the warning notice—

(a)if it decides to cancel the authorisation, give the person a decision notice; or

(b)if it decides not to cancel the authorisation, give the person notice of its decision.

(4) If the FCA decides to cancel the authorisation, other than at the person’s request, the person may refer the matter to the Upper Tribunal.

(5) Where the period for a reference to the Upper Tribunal has expired without a reference being made, the FCA must as soon as practicable update the register accordingly.

Request for cancellation of authorisation

11.—(1) A request for cancellation of a person’s authorisation under regulation 10(1)(b) (cancellation of authorisation) must be made in such manner as the FCA may direct.

(2) At any time after receiving a request and before determining it, the FCA may require the person making the request to provide it with such further information as it reasonably considers necessary to enable it to determine the request.

(3) Different directions may be given and different requirements imposed, in relation to different requests or categories of request.

Variation of authorisation on FCA’s own initiative

12.—(1) The FCA may vary a person’s authorisation in any of the ways mentioned in regulation 8 if it appears to the FCA that—

(a)the person no longer meets, or is unlikely to continue to meet, any of the conditions set out in regulation 6(4) to (9) (conditions for authorisation) or, if applicable, the requirement in regulation 22(1) (capital requirements) to maintain own funds, or does not inform the FCA of a major change in circumstances which is relevant to its meeting those conditions or that requirement, as required by regulation 37 (duty to notify change in circumstance);

(b)the person has provided a particular payment service or payment services other than in accordance with the authorisation granted to it;

(c)the person would constitute a threat to the stability of, or trust in, a payment system by continuing to provide a particular payment service or payment services;

(d)the variation is desirable in order to protect the interests of consumers; or

(e)the person’s provision of a particular payment service or payment services is otherwise unlawful, including where such provision of services is unlawful because the person’s registration in a register maintained under regulation 54 or 55 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (duty and power to maintain registers) has been cancelled under regulation 60 of those Regulations (cancellation and suspension of registration).

(2) A variation under this regulation takes effect—

(a)immediately, if the notice given under paragraph (6) states that that is the case;

(b)on such date as may be specified in the notice; or

(c)if no date is specified in the notice, when the matter to which the notice relates is no longer open to review.

(3) A variation may be expressed to take effect immediately or on a specified date only if the FCA, having regard to the ground on which it is exercising the power under paragraph (1), reasonably considers that it is necessary for the variation to take effect immediately or, as the case may be, on that date.

(4) The FCA must as soon as practicable after the variation takes effect update the register accordingly.

(5) A person who is aggrieved by the variation of their authorisation under this regulation may refer the matter to the Upper Tribunal.

(6) Where the FCA proposes to vary a person’s authorisation under this regulation, it must give the person notice.

(7) The notice must—

(a)give details of the variation;

(b)state the FCA’s reasons for the variation and for its determination as to when the variation takes effect;

(c)inform the person that they may make representations to the FCA within such period as may be specified in the notice (whether or not the person has referred the matter to the Upper Tribunal);

(d)inform the person of the date on which the variation takes effect; and

(e)inform the person of their right to refer the matter to the Upper Tribunal and the procedure for such a reference.

(8) The FCA may extend the period allowed under the notice for making representations.

(9) If, having considered any representations made by the person, the FCA decides—

(a)to vary the authorisation in the way proposed, or

(b)if the authorisation has been varied, not to rescind the variation,

it must give the person notice.

(10) If, having considered any representations made by the person, the FCA decides—

(a)not to vary the authorisation in the way proposed,

(b)to vary the authorisation in a different way, or

(c)to rescind a variation which has taken effect,

it must give the person notice.

(11) A notice given under paragraph (9) must inform the person of their right to refer the matter to the Upper Tribunal and the procedure for such a reference.

(12) A notice under paragraph (10)(b) must comply with paragraph (7).

(13) For the purposes of paragraph (2)(c), paragraphs (a) to (d) of section 391(8) of the 2000 Act (publication) apply to determine whether a matter is open to review.

Registration as a small payment institution

Application for registration as a small payment institution or variation of an existing registration

13.—(1) An application for registration as a small payment institution must contain, or be accompanied by, such information as the FCA may reasonably require.

(2) An application for the variation of a registration as a small payment institution must—

(a)contain a statement of the proposed variation;

(b)contain a statement of the payment services which the applicant proposes to carry on if the registration is varied; and

(c)contain, or be accompanied by, such other information as the FCA may reasonably require.

(3) An application under paragraph (1) or (2) must be made in such manner as the FCA may direct.

(4) At any time after receiving an application and before determining it, the FCA may require the applicant to provide it with such further information as it reasonably considers necessary to enable it to determine the application.

(5) Different directions may be given, and different requirements imposed, in relation to different applications or categories of application.

Conditions for registration as a small payment institution

14.—(1) The FCA may refuse to register an applicant as a small payment institution only if any of the conditions set out in paragraphs (2) to (11) is not met.

(2) The application must comply with the requirements of, and any requirements imposed under, regulations 13 and 20.

(3) The monthly average over the period of 12 months preceding the application of the total amount of payment transactions executed by the applicant, including any of its agents in the United Kingdom, must not exceed 3 million euros.

(4) The business to which the application relates must not include the provision of account information services or payment initiation services.

(5) None of the individuals responsible for the management or operation of the business has been convicted of—

(a)an offence under Part 7 of the Proceeds of Crime Act 2002 (money laundering)(2) or under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017;

(b)an offence under section 15 (fund-raising), 16 (use and possession), 17 (funding arrangements), 18 (money laundering) or 63 (terrorist finance: jurisdiction) of the Terrorism Act 2000(3);

(c)an offence under the 2000 Act;

(d)an offence under regulation 3, 4 or 6 of the Al-Qaida and Taliban (Asset-Freezing) Regulations 2010(4), or regulation 10 of the ISIL (Da’esh) and Al-Qaida (Asset-Freezing) Regulations 2011 (contravention and circumvention of prohibitions)(5);

(e)an offence under section 11, 12, 13, 14, 15 or 18 of the Terrorist Asset-Freezing etc Act 2010 (offences relating to the freezing of funds etc. of designated persons)(6);

(f)an offence under these Regulations or the Electronic Money Regulations 2011(7); or

(g)any other financial crimes.

(6) Where the applicant is a partnership, an unincorporated association or a body corporate, the applicant must satisfy the FCA that any persons having a qualifying holding in it are fit and proper persons having regard to the need to ensure the sound and prudent conduct of the affairs of a small payment institution.

(7) The applicant must satisfy the FCA that—

(a)where the applicant is a body corporate, the directors;

(b)the persons responsible for the management of the institution; and

(c)where relevant, the persons responsible for the management of payment services,

are of good repute and possess appropriate knowledge and experience to provide payment services.

(8) If the applicant is a body corporate which has close links with another person (“CL”) the applicant must satisfy the FCA—

(a)that those links are not likely to prevent the FCA’s effective supervision of the applicant; and

(b)if it appears to the FCA that CL is subject to the laws, regulations or administrative provisions of a territory which is not an EEA State (“the foreign provisions”), that neither the foreign provisions, nor any deficiency in their enforcement, would prevent the FCA’s effective supervision of the applicant.

(9) Regulation 6(10) (conditions for authorisation: definition of close links) applies for the purposes of paragraph (8) of this regulation as it applies for the purposes of regulation 6(9).

(10) The applicant’s head office, registered office or place of residence, as the case may be, must be in the United Kingdom.

(11) The applicant must comply with a requirement of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 to be included in a register maintained under those Regulations where such a requirement applies to the applicant.

(12) For the purposes of paragraph (3) where the applicant has yet to commence the provision of payment services, or has been providing payment services for less than 12 months, the monthly average may be based on the projected total amount of payment transactions over a 12 month period.

(13) In paragraph (5) “financial crime” includes any offence involving fraud or dishonesty and, for this purpose, “offence” includes any act or omission which would be an offence if it had taken place in the United Kingdom.

Supplementary provisions

15.  Regulations 7 to 12 apply to registration as a small payment institution as they apply to authorisation as a payment institution as if—

(a)references to authorisation were references to registration;

(b)in regulation 7 (imposition of requirements), paragraph (4) were omitted;

(c)in regulation 8 (variation at request of authorised payment institution)—

(i)for “an authorised payment institution” there were substituted “small payment institution”; and

(ii)for “provided that” to the end there were substituted—

“provided that the FCA is satisfied that the conditions set out in regulation 14(4) to (11) are being or are likely to be met and that the monthly average over any period of 12 months of the total amount of payment transactions executed by the institution, including any of its agents in the United Kingdom, continues not to exceed 3 million euros (“the financial limit”).”;

(d)in regulation 10(1) (cancellation of authorisation) for sub-paragraph (e) there were substituted—

“(e)the person does not meet, or is unlikely to meet, any of the conditions set out in regulation 14(4) to (11) (conditions for registration as small payment institution) or the financial limit referred to in regulation 8 or does not inform the FCA of a major change in circumstances which is relevant to its meeting those conditions or that requirement, as required by regulation 37 (duty to notify change in circumstance);”; and

(e)in regulation 12(1) (variation of authorisation on FCA’s own initiative) for sub-paragraph (a) there were substituted—

“(a)the person does not meet, or is unlikely to meet, any of the conditions set out in regulation 14(4) to (11) or the financial limit referred to in regulation 8;”.

Application for authorisation or registration if requirements cease to be met

16.  If a small payment institution no longer meets a condition in regulation 14(3), (5) or (10) (conditions for registration as small payment institution) or intends to provide services other than those permitted by regulation 32 (additional activities), the institution concerned must, within 30 days of becoming aware of the change in circumstances, apply for authorisation as a payment institution under regulation 5 or registration as an account information service provider under regulation 17, as appropriate, if it intends to continue providing payment services in the United Kingdom.

Registration as an account information service provider

Application for registration as an account information service provider or variation of an existing registration

17.—(1) An application for registration as an account information service provider or for the variation of a registration as an account information service provider must—

(a)contain or be accompanied by the information specified in paragraphs 1, 2, 5 to 8, 10, 12, 14 and 16 to 19 of Schedule 2 (information to be provided in or with an application for authorisation); and

(b)be made in such manner as the FCA may direct.

(2) At any time after receiving an application and before determining it, the FCA may require the applicant to provide it with such further information as it reasonably considers necessary to enable it to determine the application.

(3) Different directions may be given, and different requirements imposed, in relation to different applications or categories of application.

Conditions for registration as an account information service provider

18.—(1) The FCA may refuse to register an applicant as an account information service provider if—

(a)any of the conditions set out in paragraphs (2) to (4) is not met; or

(b)any of the grounds in regulation 10(1) (as applied by regulation 19) would be met if the applicant were registered.

(2) The application must comply with the requirements of, and any requirements imposed under, regulations 17 (application for registration as an account information service provider) and 20 (duty to notify changes).

(3) The business to which the application relates must not include the provision of any payment service other than account information services.

(4) The applicant must hold professional indemnity insurance or a comparable guarantee, which covers—

(a)the territories in which the applicant proposes to offer account information services; and

(b)the applicant’s potential liability to account servicing payment service providers and payment service users resulting from unauthorised or fraudulent access to, or use of, payment account information, up to such amount as the FCA may direct.

Supplementary provisions

19.  Regulations 7 to 12 apply to registration as an account information service provider as they apply to authorisation as a payment institution, but as if—

(a)references to authorisation were references to registration;

(b)in regulation 7 (imposition of requirements), paragraph (4) were omitted;

(c)in regulation 8 (variation at request of authorised payment institution)—

(i)for “an authorised payment institution” there were substituted “registered account information service provider”;

(ii)paragraphs (a) and (b) were omitted; and

(iii)for “provided that” to the end there were substituted “provided that the conditions set out in regulation 18(3) and (4) are being or are likely to be met.”;

(d)in regulation 10(1) (cancellation of authorisation) for sub-paragraph (e) there were substituted—

“(e)the person does not meet, or is unlikely to meet, the conditions set out in regulation 18(3) and (4);”; and

(e)in regulation 12(1) (variation of authorisation on FCA’s own initiative) for sub-paragraph (a) there were substituted—

“(a)the person does not meet, or is unlikely to meet, the conditions set out in regulation 18(3) and (4);”.

Common provisions

Duty to notify changes

20.—(1) If at any time after an applicant has provided the FCA with any information under regulation 5(1), (2), or (4) (application for authorisation or variation of authorisation), 13(1), (2) or (4) (application for registration as a small payment institution or variation of registration) or 17(1) or (2) (application for registration as an account information service provider or variation of registration) and before the FCA has determined the application—

(a)there is, or is likely to be, a material change affecting any matter contained in that information; or

(b)it becomes apparent to the applicant that the information is incomplete or contains a material inaccuracy,

the applicant must provide the FCA with details of the change, the complete information or a correction of the inaccuracy (as the case may be) without undue delay, or, in the case of a material change which has not yet taken place, the applicant must provide details of the likely change as soon as the applicant is aware of such change.

(2) The obligation in paragraph (1) also applies to material changes or significant inaccuracies affecting any matter contained in any supplementary information provided pursuant to that paragraph.

(3) Any information to be provided to the FCA under this regulation must be in such form or verified in such manner as it may direct.

Authorised payment institutions, small payment institutions and registered account information service providers acting without permission

21.  If an authorised payment institution, a small payment institution or a registered account information service provider carries on a payment service in the United Kingdom, or purports to do so, other than in accordance with an authorisation or registration granted to it by the FCA, it is to be taken to have contravened a requirement imposed on it under these Regulations.