This guide is written for fintech founders, payment service providers, remittance businesses, open-banking firms, e-commerce platforms, and foreign businesses planning UK payment operations. Getting authorisation right matters because it determines whether you can legally onboard customers, move their money, and protect their funds if something goes wrong.
API licensing often gets lumped in with EMI, SPI, banking, and agent models, but the differences are rarely explained clearly. The UK's payment infrastructure handles enormous volumes each year, with the Bank of England reporting a record 53.3 million CHAPS payments settling £93.9 trillion in 2025, underscoring how central robust payments regulation is to the market you're entering. This guide covers licence scope, the application process, costs, safeguarding duties, and whether an API is even the right route for your business.
Key Takeaways
- An API licence covers regulated payment services; an EMI licence is needed mainly if you issue electronic money.
- Regulated activities include payment execution, merchant acquiring, money remittance, PIS, AIS, and issuing payment instruments.
- The FCA expects a coherent business plan, governance framework, financial resources, and safeguarding model, not just an idea.
- Authorisation brings ongoing duties: safeguarding, AML controls, reporting, governance, and data protection.
What Is an FCA Authorised Payment Institution Licence and Why Is It Needed?
Definition and regulatory role
Under the Payment Services Regulations 2017 (PSRs), an authorised payment institution is a person authorised by the FCA under regulation 6 and entered on its public register. The FCA's job during the application is to assess whether you can run the proposed payment business responsibly: governance, financial resources, systems, controls, and management competence all come under scrutiny.
It helps to see how an API sits alongside similar statuses:
- API – authorised to provide one or more specified payment services, with no cap on transaction volumes.
- Small Payment Institution (SPI) – a lighter-touch registration for firms below certain monthly transaction thresholds, but without passporting rights even historically.
- Authorised Electronic Money Institution (EMI) – required where the firm issues electronic money (stored monetary value), not merely executes payments.
- Bank – a deposit-taking credit institution, dual-regulated by the FCA and the Prudential Regulation Authority (PRA).
The right route depends on your money flows, whether you issue e-money, and your expected scale, not on what you call your product.
Services and activities covered
Schedule 1 to the PSRs sets out the regulated payment services an API can be authorised for:
| Schedule 1 reference | Payment service |
|---|---|
| 1(a)–(b) | Placing or withdrawing cash on a payment account |
| 1(c)–(d) | Executing payment transactions (direct debits, card payments, credit transfers) |
| 1(e) | Issuing payment instruments or acquiring payment transactions |
| 1(f) | Money remittance |
| 1(g) | Payment initiation services |
| 1(h) | Account information services |
Your actual permission depends on your operating model, not your marketing copy. A remittance app might need only 1(f); a merchant acquirer typically needs 1(e); an open-banking provider often needs only 1(g) and 1(h), with lighter capital requirements as a result.
Why authorisation matters
Regulation 138 of the PSRs makes it an offence to provide, or purport to provide, a payment service in the UK without authorisation or another permitted status. The consequences of getting this wrong include enforcement action, forced business disruption, and reputational damage that's hard to undo with customers and banking partners.
Beyond the legal requirement, authorisation signals to customers, partners, and acquiring banks that your business meets a baseline of financial-crime controls, fund safeguarding, and supervisory accountability. That trust is often the real commercial reason firms pursue it.
How the FCA API Authorisation Process Works
Pre-application assessment
Before drafting anything, map every customer, merchant, wallet, settlement step, and fund movement in your model. That map shows whether each activity is a regulated payment service, falls under an exclusion, sits in an agent arrangement, or is unregulated technology provision.
Examples:
- Remittance platform moving customer funds cross-border: almost certainly needs API authorisation (or EMI if it holds balances)
- Merchant acquirer processing card transactions for retailers: needs acquiring permission
- Open-banking provider that only initiates payments or retrieves account data: may need only registration as an account information service provider
Application preparation
The FCA expects a complete, internally consistent application package. Core materials include:
- Regulatory business plan and programme of operations
- Proposed permissions and financial forecasts
- Governance structure, ownership information, and management biographies
- Risk-management framework and safeguarding arrangements
- AML/CTF controls, outsourcing details, and technology/security controls
- Incident-management processes
Your business plan, financial model, customer journey, and safeguarding approach must all describe the same operating model. Inconsistencies between documents are one of the fastest ways to trigger FCA queries.
Applications go through the FCA's Connect system, and fees depend on the services sought. Under the FCA's current fee schedule, Category 4 (money remittance, payment initiation, and account information) costs £2,820. Category 5 (payment-account, transaction-execution, and issuing/acquiring services) costs £5,640. Confirm current fees before submitting, since the FCA updates these periodically.
FCA review and decision
Once submitted, the review generally follows this sequence:
- Completeness check against the required application fields
- Requests for clarification or additional information
- Assessment of controllers, qualifying shareholders, and senior management
- Final authorisation decision
The PSRs set statutory determination periods: three months from receipt of a complete application, or up to 12 months if the application is incomplete. These are legal deadlines for a decision, not promises of approval. End-to-end project timelines are usually longer once you include pre-application preparation.
Common causes of delay include:
- Unclear or overlapping permission requests
- Financial projections that don't match the business plan
- Incomplete safeguarding arrangements
- Weak allocation of governance responsibilities
- Slow or incomplete responses to FCA information requests
After authorisation
Authorisation brings continuing obligations. You must:
- Operate within the approved model
- Notify the FCA of material changes
- Meet ongoing reporting obligations
- Apply for a variation of permission before expanding into new services or restructuring the business
Where an API Licence Applies and Which Factors Affect Approval
Business models and use cases
Typical API use cases include money remittance, payment processing, merchant acquiring, corporate payments, marketplace payments, payment initiation, account information, and embedded payment services within software platforms.
Think about where regulated activity actually sits in your product lifecycle: onboarding, transaction initiation, settlement, reconciliation, refunds, complaints handling, and safeguarding. A technology provider that never touches customer funds or executes the regulated service itself may not need its own authorisation. That conclusion depends entirely on the contractual and operational detail, not assumptions.
Scope and permission factors
Several variables shape what permissions you need and how much scrutiny your application attracts:
- Proposed services and customer types (consumers vs. businesses)
- Transaction flows and anticipated transaction volumes
- Geographic reach of your customer base
- Use of agents or outsourcing providers
APIs cannot issue electronic money, accept deposits, or lend in the way a bank or EMI can. If your model involves holding customer balances for future use rather than simply executing transactions, you're likely looking at an EMI licence instead of an API.
Financial and operational readiness
Initial capital requirements under Schedule 3 to the PSRs depend on the services proposed, with the highest applicable band governing where multiple services apply:
| Proposed service | Initial capital required |
|---|---|
| Money remittance only | €20,000 |
| Payment initiation services | €50,000 |
| Payment-account, execution, issuing/acquiring services | €125,000 |
Ongoing own-funds requirements are calculated using one of three FCA-directed methods: Method A (10% of fixed overheads), Method B (a tiered payment-volume calculation), or Method C (an income-based calculation). Firms offering only payment initiation or account information services are exempt from this calculated own-funds limb, though initial capital rules can still apply.
Beyond capital, budget for:
- FCA application and ongoing supervision fees
- Legal and compliance advisory costs
- Technology, security, and operational infrastructure
- Audit, insurance, and staffing costs
Safeguarding and customer protection
Meeting these capital thresholds doesn't end your obligations; protecting customer money once you're authorised carries its own distinct rules. Regulation 23 of the PSRs requires APIs to safeguard relevant customer funds, either through segregation in a designated account or through insurance/guarantee arrangements. The FCA's CASS 15 rules apply supplementary safeguarding requirements to payment institutions, covering reconciliation, record-keeping, and resolution planning if the firm fails.
Related obligations you'll need to build into your operating model include:
- Strong customer authentication for payment transactions
- Complaints handling and fair customer communications
- Consumer Duty, where it applies to your customer base
- UK GDPR compliance and operational resilience planning
- AML/CTF controls proportionate to your risk profile
Common Issues, Misconceptions, and When an API May Not Be Appropriate
Several assumptions trip up founders before they've even submitted an application:
"Every fintech needs an API licence." Not true. Depending on your model, the correct outcome might be:
- EMI authorisation
- SPI registration
- Account information provider registration
- An agent relationship under an authorised principal
- A bank partnership
- An exclusion that removes you from regulation entirely
"If I can execute payments, I can issue wallets or stored value." Also wrong. Holding customer balances as stored monetary value is an e-money activity, requiring EMI authorisation, not API permission. Executing a transaction and issuing e-money are legally distinct activities.
"My UK API licence lets me operate across Europe." It doesn't. The FCA has confirmed that passporting between the UK and EEA states ended with the Brexit transition period, meaning EEA market access now requires separate local authorisation in each country where you want to operate.
An API may also be premature if:
- Your product is still unvalidated and could launch under an authorised principal's permission first
- Your business genuinely only provides technology, without touching regulated activity or customer funds
- Your real activity involves e-money issuance or deposit-taking, pointing to an EMI or banking licence instead
Conclusion
An FCA API licence lets an eligible UK business provide specific, approved payment services. It is not a blanket authorisation covering every financial activity you might want to add later.
Before applying:
- Map your regulatory perimeter carefully
- Confirm you are pursuing the correct permission type
- Build genuine operational and safeguarding capability, not a paper exercise
Always verify current FCA fees, forms, and timelines directly, since these change periodically.
For foreign businesses that have already defined their UK payment operating model, VJM Global supports the accounting, tax compliance, and payroll side of establishing and running UK operations, drawing on its work with 250+ UK businesses.
That support sits alongside FCA authorisation. It does not replace specialist regulatory advice, which should come from authorised compliance or legal advisers.
Frequently Asked Questions
What is an FCA Authorised Payment Institution licence?
It's authorisation granted by the FCA under the Payment Services Regulations 2017, allowing a business to provide specific regulated payment services. It covers approved payment activities only, not general banking or e-money issuance.
How much does it cost to get an API licence in the UK?
FCA application fees for Authorised Payment Institutions vary by fee category and sit separate from minimum capital, legal, technology and ongoing compliance costs. EMI figures (such as the Category 5 fee of £5,640) do not apply—confirm the current API fee on the FCA schedule.
What's the difference between PRA and FCA?
The FCA regulates conduct across financial services firms, including payment institutions, while the PRA focuses on the safety and soundness of banks and other dual-regulated firms. API authorisation is handled solely by the FCA; the PRA isn't normally involved.
Is the FCA only in the UK?
Yes. The FCA is the UK's conduct regulator for financial services and doesn't authorise firms to operate in other countries. Overseas activity generally requires separate local permissions in each jurisdiction.
How long does FCA API authorisation take in the UK?
By statute, the FCA must determine a complete application within three months, extending to 12 months for incomplete ones. Real-world timelines often run longer once preparation and FCA follow-up questions are factored in, so always confirm current targets directly with the FCA.
