UK Payment Institution Licensing for Money Transfer Businesses: Small or Authorised, and What the FCA Expects

Money remittance is a regulated payment service in the UK. Before you take a single customer payment you need the FCA's permission, either as a small payment institution or as an authorised payment institution. The choice shapes your capital, your safeguarding, how much you can process and how long the application takes. Choosing well at the start saves a second application later.

This guide is for founders and compliance leads planning a UK money transfer business: choosing the route, preparing the application, safeguarding, running anti-money laundering (AML) controls, and what your platform must show the FCA. It is general guidance, not legal advice: confirm current requirements with the FCA or a UK regulatory adviser before you apply.

If you accept money from a customer in the UK in order to pay it to someone else, you are providing money remittance. That needs FCA permission under the Payment Services Regulations, held by you or by someone you operate under. A white label platform does not change this: the business that faces the customer and takes their money is the one the regulator looks at.

There are three common ways to be covered:

• Register as a small payment institution (SPI). A lighter route for businesses whose payment volumes stay under a monthly limit.
• Become an authorised payment institution (API). Full authorisation, with no volume cap and more demanding requirements on capital, governance and safeguarding.
• Operate under a licensed partner. You run the brand and the customer relationship as the partner's agent or under a similar arrangement, while they hold the permission. Agree in writing who holds which obligation, and plan when to move to your own permission.

If you plan to let customers hold a balance, you are likely into e-money territory, which needs electronic money institution permission rather than payment institution permission. Offer wallets only where your licence allows, and take advice before you design the product around stored balances.

Both routes are regulated by the FCA for payment services, need fit and proper owners and managers, and carry full AML obligations. They differ in scale, capital, safeguarding and depth of assessment.

Three questions usually decide it.

1. Where will your volume be in two years? If your plan crosses the small institution limit within that time, apply for authorisation now. Upgrading later is a new application for authorisation, with the capital, governance and safeguarding requirements that come with it.
2. What will your banks and payout partners accept? Some will only work with authorised institutions, or with small institutions that safeguard. Ask before you choose. Our guide to opening a business bank account for a UK money service business covers what banks look for.
3. Can you fund it? Authorisation needs initial capital, a stronger compliance team and more preparation time. If that is out of reach today, a small institution or a partner launch buys you a track record.

Applications go in through the FCA's online system, and the decision clock only starts once the FCA treats the application as complete. Most delays come from a vague description of how money moves, template AML documents, and no evidence that the technology does what the policies say.

Prepare these before you submit:

• Programme of operations. Which services, corridors, payment and payout methods.
• Fund flow diagram. Every account customer money passes through, in whose name, and how long it stays there. The FCA wants to follow a pound from the customer to the recipient.
• Business plan and forecasts. Realistic customer numbers, costs and break-even, with the funding to get there.
• Governance and people. Directors and controllers with relevant experience, clear reporting lines, and a money laundering reporting officer (MLRO) with the authority and time to do the job.
• AML policies and a business-wide risk assessment. Written for your customers, corridors and channels, not generic. Show how your limits, document requests and monitoring follow from the risks you identified.
• Money laundering registration. The FCA asks for your HMRC money laundering registration number, or your application number if HMRC is still assessing you.
• Safeguarding arrangements (mandatory for authorised institutions): the method, the account, the reconciliation process and who signs it off.
• Outsourcing. Your platform provider is an important outsourced service. Show how you oversee it, what happens if it fails, and how you get your data back.
• Wind-down plan for authorised institutions: how customers would be paid or refunded if you stopped trading.

Safeguarding protects customer money if your business fails. For an authorised institution it is mandatory; a small institution can choose to safeguard. There are two methods.

• Segregation. Customer money is kept apart from your own and, if not paid out by the end of the business day after you receive it, placed in a designated safeguarding account at a bank or invested in approved secure assets.
• Insurance or a comparable guarantee covering the customer money, from a provider outside your group.

Most money transfer businesses segregate. The hard part is knowing, every day, exactly how much you owe customers and proving that the safeguarded amount matches. New FCA safeguarding rules took effect on 7 May 2026. They require a reconciliation at least once each reconciliation day, a monthly safeguarding return to the FCA, a resolution pack and, for most firms, an annual safeguarding audit by a qualified auditor. A small institution that opts in must meet the same standard. Check the current rules before you design your process.

A daily reconciliation answers three questions:

1. How much customer money have we received that has not yet been paid out or refunded?
2. How much is in the safeguarding account, or covered by insurance?
3. If the two differ, why, and who fixed it and when?

Your platform's accounting decides how easy that is. In RemitSo, every payment, payout, refund, fee and FX movement is recorded automatically in a double-entry ledger. Entries are never edited; mistakes are reversed and both stay visible. The chart of accounts lets you select an account and read the entries behind its balance, and manual corrections are posted as journals. Deposits are matched to what the customer declared, to the cent: if the amount does not match, the money does not move, so unexplained differences do not leak into what you owe. For more, see double-entry accounting for remittance and matching deposits to the cent.

Check who your AML supervisor is. A money transmitter that only provides payment services as a small or authorised payment institution is supervised by HMRC under the Money Laundering Regulations, as a money service business, while the FCA registers or authorises it for payment services. Where a firm also carries on other FCA-regulated activity, the FCA can become the sole supervisor. Whoever supervises you, the programme has a familiar shape:

• An MLRO who receives internal suspicion reports, decides whether to report to the National Crime Agency (NCA), and reports to the board on how the programme is working.
• Customer due diligence proportionate to risk, with enhanced due diligence for higher-risk customers, corridors and patterns.
• Sanctions screening of customers and recipients against the UK Sanctions List, and other lists where your corridors and partners require them. See our UK screening guide.
• Transaction monitoring that looks at behaviour over time, not just single transfers.
• Suspicious activity reports to the NCA, including a request for a defence against money laundering where you need to proceed with a transaction you suspect. Staff must not tip off the customer. See our guide to suspicious activity reports.
• Training for staff, matched to their role, with records of completion.
• Record keeping of identity, transactions and decisions for the period the regulations require.

The usual weak point is the gap between policy and system. If your policy asks for proof of funds above a 90-day total, the platform must count that window and ask for the document every time.

During the application and in later supervision, the FCA will ask how your controls work and for evidence that they did. Map each question to the record that answers it before anyone asks.

For preparing the first visit, see your first regulatory audit.

The figures below are illustrative, not drawn from any real operator.

The plan. A founder plans a GBP corridor to one payout country. Year one forecasts sit comfortably inside the small institution limit; year three, with two more corridors, could approach it. The founder registers as a small institution, opts in to safeguarding because the payout partner asks for it, and starts preparing for authorisation from month 12.

The application. The compliance lead sets the GBP AML rule before submitting: any customer whose total passes £2,000 over 90 days asked for proof of address and source of funds; anyone passing £8,000 over a year moved to enhanced due diligence. Screenshots of the rule, its change history and the access roles go into the application.

Month four. A customer sends £450 every week to the same recipient. At week five the 90-day total passes £2,000 and the next transfer asks for the documents before it can continue. Separately, a risk rule combining frequent transfers to the same recipient with a new customer baseline holds the transfer for a person. The analyst reviews, finds payslips that match the pattern, approves, and records why.

Every morning. Finance compares the ledger's customer liability account with the safeguarding account. On one day there is a £120 difference: a deposit received but matched to nothing, held rather than credited. The team contacts the customer, matches it, and records the explanation.

RemitSo is a white label remittance platform: customer apps in your brand and an admin panel where your team runs compliance, operations and finance. See the admin features.

• AML rules per currency, paying country and payout country, with windows from every transaction to one year and document tiers as totals grow: your GBP risk assessment becomes enforced limits, with a history of who changed what.
• Sanctions screening against 8 lists loaded nightly, including the UK Sanctions List, with each list's version and load history, and decisions recorded per match: screening evidence the FCA can follow.
• 46 risk indicators combined into your own rules: risky transfers wait for a person, everything else flows on its own.
• Suspicious activity reports generated, managed and submitted from the console: the MLRO's case and decision sit with the transactions behind them.
• ID check and selfie inside the first transfer, with documents approved or rejected and the reason kept: customer due diligence without losing customers at sign-up.
• Double-entry accounting with a chart of accounts and journals, and deposits matched to the declared amount: the numbers for daily safeguarding reconciliation.
• 89 permissions, two-step sign-in and login sessions, plus staff training (an optional add-on) assigned by department and signed off by someone else: governance you can show, not describe.
• ISO 27001:2022 and ISO 9001:2015 certification, a downloadable software bill of materials and your own AWS account in your region: answers for the outsourcing and security sections of the application.

Your team still writes the risk assessment and policies, appoints the MLRO, runs safeguarding with your bank, decides on suspicion and deals with the FCA. RemitSo does not file UK regulatory returns for you.

See getting started or book a demo.

• FCA: Payment institution applicants
• Payment Services Regulations 2017: registration as a small payment institution
• Payment Services Regulations 2017, Schedule 3: capital requirements
• Payment Services Regulations 2017, regulation 138: prohibition on provision of payment services
• FCA: Safeguarding requirements for payment institutions and e-money institutions
• FCA: PS25/12, Changes to the safeguarding regime for payments and e-money firms
• HMRC Economic Crime Supervision Handbook, ECSH51225: Money service business supervision
• HMRC Economic Crime Supervision Handbook, ECSH41535: when the FCA becomes sole supervisor of a money service business
• National Crime Agency, UKFIU guidance: Understanding DAMLs and DATFs
• FCDO: The UK Sanctions List

Checked October 2026. Regulations change; confirm current requirements with the regulator or your adviser.