Harper James is a UK full-service commercial law firm advising businesses on financial services regulation under the laws of England and Wales. Payment services compliance begins by identifying the activities a business performs, the customers it serves and the flow of funds through its systems.
The Payment Services Regulations 2017 (PSRs) regulate activities such as executing payment transactions, operating payment accounts, issuing payment instruments and providing account information or payment initiation services. The Electronic Money Regulations 2011 apply to businesses issuing electronic money. Banks and other firms conducting regulated activities under the Financial Services and Markets Act 2000 have additional requirements.
A business should map each product and payment flow, including who receives customer money, who controls the payment account, whether funds are held temporarily and whether another provider performs part of the service. The analysis should then address authorisation, registration, agency arrangements and any applicable exclusion or exemption. Marketing descriptions, customer terms and contracts with banking or payment partners should match the regulatory analysis.
An authorised or registered firm needs governance proportionate to its activities. Core documents generally cover customer onboarding, financial crime controls, complaints, safeguarding, outsourcing, information security, incident management and business continuity. Anti-money laundering obligations apply where the business falls within the relevant regulated scope, and customer due diligence should reflect the firm’s products, customers, jurisdictions and transaction risks.
Safeguarding is a central control for payment and electronic money firms that hold relevant customer funds. The firm should identify safeguarded funds, maintain appropriate records and reconciliations, restrict access to those funds and establish procedures for addressing discrepancies. Outsourcing a function does not transfer the firm’s regulatory responsibility, so supplier due diligence, contractual protections, access rights and ongoing monitoring form part of the compliance framework.
Customer-facing processes should address authentication, transaction information, execution times, payment errors, unauthorised transactions, refunds and complaints. Strong customer authentication requirements apply to relevant electronic payments, subject to defined exemptions. Terms and conditions should explain the service accurately, state applicable fees and set out the parties’ responsibilities.
The firm should maintain controls for operational resilience, cyber security, record keeping and regulatory reporting. A practical review involves testing access controls, incident escalation, reconciliation processes, complaint handling and the ability to continue critical services after a system or supplier failure. Compliance is an ongoing operating process rather than a one-off authorisation exercise, and changes to products, technology, ownership or outsourcing arrangements should trigger a fresh regulatory assessment.