To modernity and beyond! HM Treasury's consultation on payments regulation gives a thrilling glimpse of a high-tech future – if executed well

Payments regulation is not currently part of the FSMA regime. Instead, the rules on the perimeter, conduct of business, prudential requirements and organisational structure of firms are found in the Payment Services Regulations 2017 (PSRs) and Electronic Money Regulations 2011 (EMRs). This legislative framework is supported by the FCA in the form of its Perimeter Guidance (PERG) and its publication Payment Services and Electronic Money – Our Approach. The Payment Systems Regulator, being consolidated into the FCA by the Financial Services and Markets Bill (the Bill), presently before Parliament, has its own equivalent for the parts of the PSRs for which it is responsible.

We already knew that the intention was to create a more flexible, responsive and outcomes-based regime for payments, and a key element of that is relocating most of the "firm-facing" compliance requirements into the FCA Handbook. The perimeter (see section 2 below), along with some critical underlying definitions (such as that of electronic money and, potentially, payment initiation services and account information services), will continue to be established in legislation (although the CP does not expressly state whether this will be in a residual version of the PSRs/EMRs or moved into the RAO).

What is more interesting from a long-term perspective is that this will involve the "delegation" by HMT to the FCA of a much greater role in setting firm-facing requirements through FCA rules, which raises important questions as to the proper role the FCA should play in setting the "policy" behind such requirements. The CP simply refers to "more detailed and technical provisions" (for example, those relating to strong customer authentication) being placed into the FCA Handbook. On one level, this brings the approach to payments regulation into line with most other financial services regimes. It is also consistent with the approach being taken in the Bill.

It is feasible, however, that it leads to some material changes. For example, we have long been aware that the FCA is not satisfied with the relatively light-touch prudential framework in the PSRs and EMRs, and we would expect those requirements to be near the top of the FCA's list for reconsideration. There will be opportunities to shape the FCA's thinking through consultation processes, and the CP also seeks views on whether there are elements from overseas regimes that the UK should take into consideration (for example, the final text of the third Payment Services Directive, with an accompanying Payment Services Regulation, is expected from the EU very shortly). Some aspects of regulatory alignment with the EU are important to allow the UK to retain its membership of SEPA and that is likely to act as a constraint on what HMT and the FCA can do.

The CP does, however, seek views on whether certain aspects of payments policy are so important that they should be "hardwired" into the regime by statute. It is explicit, for example, that the government will not permit the removal of the fairly recent amendments made to the statutory provisions on termination of framework contracts, requiring a longer notice period and a clearer explanation of the reasons for termination (introduced in response to concerns about "debanking").

We would suggest that there would be a real benefit in re-assessing some of the foundational definitions, including whether the regime would benefit from a clearer and more objective definition of "payment account".

The CP also discusses whether a new approach to the risks of financial crime within the sector is needed. Most eye-catchingly, the CP asks whether enhancing individual accountability for senior management might be needed. The Senior Managers & Certification Regime (SMCR) does not currently apply to payments firms (although the Financial Services and Markets Act 2023 did provide a statutory basis for the extension of the SMCR), and this is one area that firms will need to monitor. The CP is not clear whether this would take the form of a partial extension of the SMCR (which is itself being reformed by the Bill) to payments firms, or something more bespoke. It will also need to balance risk management with the ability of the sector to attract and retain high-calibre talent. 

In addition, HMT seeks views on what is needed to ensure that accelerating digital payments can be delivered in a way that protects and promotes financial inclusion. There are significant conversations taking place on that topic throughout the payments ecosystem, including, for example, Richard Lloyd's review into access to face-to-face banking, which is due to report in October. 

The CP proposes a small number of specific changes to the payment services as currently defined in Schedule 1 to the PSRs. First, services for placing funds into a payment account will be combined with services allowing for the withdrawal of funds from a payment account, such that there will be a single payment service relating to the operations of a payment account. Second, executing payment transactions will form a single defined payment service covering those both with and without the extension of credit. Both of these changes make sense to us on a first look.

The more substantive change reflects evolutions in the sector since this scope of services was constructed nearly twenty years ago. Currently, there is a single payment service that covers both acquiring payment transactions and issuing payment instruments. These will be split into two. A number of firms that started out as acquirers have expanded into issuing payment cards (both physical and virtual), and in future this will require a formal variation of permission rather than a notification to the FCA.

We would argue that what is needed is a more creative and concerted reconsideration of the perimeter, including relevant negative scope exclusions. One area where payments regulation differs from many regulated activities in the RAO is that the boundaries between the services (the perimeter within the perimeter, to put it one way) are not always clear cut. For example, some services provided in the context of marketplace platforms can look like both money remittance and acquiring payment transactions. In addition, is there any benefit derived from requiring a money remitter to add a permission for the execution of payment transactions as well? It would be helpful if boundaries like these were to be made firmer and clearer, underpinned by a strategic consideration of which activities should actually merit a specific permission.          

A major driver of this programme is the need to deal with tokenised payments, covering both tokenised deposits and stablecoins. There is no mention of a central bank digital currency (CBDC). We do not think that this should be read as a rejection of a CBDC – officially, the Bank of England continues its development work and will make a recommendation one way or the other to the government. It is also worth bearing in mind that the administration in the US is very sceptical about a CBDC, so its omission from the CP may have been a tactical choice. 

A number of banks are currently working on tokenised deposits, and specifically as part of the Great British Tokenised Deposit (GBTD) project. The adoption of tokenised deposits for payments should, in our view, be relatively straightforward in that the PSRs should not need to be rewritten to permit this: that appears to be the view of HMT as well.

The position for stablecoins is far more complicated. We now have the majority of what we need for the FCA's new regulatory regime for cryptoassets, but – as firms looking to issue or use stablecoins for payments will be well aware – there is more work to be done. We are still waiting for HMT and Parliament to finalise some additional proposed amendments to the legislative perimeter. As we covered at the time (in our article The importance of paying attention: The FCA's consultation on cryptoassets perimeter guidance has been followed almost immediately by further legislative changes to the perimeter), these changes would incorporate an exclusion from the scope of dealing as principal or agent, and arranging deals, for certain forms of activity that make up payment flows (more detail can be found in our article). This was expressly proposed to facilitate their use in payments. In addition, the FCA is working at pace to complete its Perimeter Guidance, which itself depends on the finalised legislation.

As HMT noted at the time, and repeats in the CP (but with an indication that it is carefully considering feedback on the proposed interim safeguarding requirements), it is still government policy that safeguarding UK stablecoins in the course of payments will require FCA permission. For now, that would be the activity in Article 9N of the RAO, but it appears that, for payments firms, this will ultimately be replaced by some form of payment service permission or other safeguarding requirement under the payments regulatory regime. As we have alluded to before, it seems to us plausible that this could leave many "crypto-custodians" needing both types of permission, as the current ecosystem of wallet providers have tended to permit holders to use their custodial wallets to hold stablecoins alongside different cryptoassets, such as bitcoin or NFTs. That said, new models may emerge.   

What is clear, and is acknowledged by the CP, is that requiring an Article 9N permission in the interim continues to be a barrier to adoption of UK-issued stablecoin payments. The CP hints that this may be revisited, and at the moment we would describe that as the highest priority item covered in the CP, especially with the authorisation gateway opening in a little over two months.

The intention is that a single permission will cover payments made both using UK stablecoins and fiat currency; that is, UK stablecoins will be treated as "money-like" and fully integrated into the regime. Regarding overseas stablecoins, the position could be slightly clearer, but we interpret paragraph 3.12 of the CP as proposing that this money-like status "may be extended" to overseas stablecoins from jurisdictions recognised by HMT as delivering equivalent outcomes, but there would then be an additional class of stablecoins issued in other jurisdictions that are not so recognised. These would continue to be treated like cryptoassets generally, so would not fall into payments regulation (but would remain potentially subject to the UK cryptoassets regulatory regime, for example, as relating to dealing and safeguarding).      

The CP notes that authorised deposit-takers do not also need to obtain specific payments permissions, and asks whether that should also be applied to stablecoin issuers with permission under Article 9M of the RAO. Wallet providers that are not also issuers may want to try to argue that the same rationale could apply to them as well.

Ideally, these discussions would have happened before or alongside the design of the cryptoasset regime itself, as stablecoin firms find themselves making major strategic decisions in a changing regulatory landscape. However, firms now have no alternative but to help HMT and the FCA design the right framework.    

The Data (Use and Access) Act 2025 (DUAA) gave HMT the power to grant the FCA powers in turn to establish the long-term regulatory framework for Open Banking, with particular reference to the regulation of "interface bodies" developing standards for APIs.  As is widely-known, Open Banking is currently a hybrid creature of the PSRs, competition remedies from the Competition and Markets Authority (CMA), and market-led initiatives on variable recurring payments (VRPs). 

This section of the CP is a highly-detailed set of proposals, but the summary of what is proposed is that:

• The rights to access payment accounts enjoyed by Third Party Providers (TPPs) under the PSRs will be widened to include VRPs, but HMT is still considering how to do this in a way that is not overly burdensome on Account Servicing Payment Service Providers (ASPSPs).
  
  
• The FCA will have economic regulation powers over the price of such access, including – and this will be controversial – the power to decide to introduce a right for ASPSPs to charge for access that is currently provided to TPPs for free.
  
  
• HMT will consider further whether the definition of the two types of services offered by TPPs – payment initiation services (PIS) and account information services (AIS) – remain fit for purpose. We consider that redefining AIS, in particular, could be particularly welcome in the context of extending the government's Smart Data programme to sectors beyond payments, and indeed beyond financial services.
  
  
• The FCA will receive powers under DUAA to regulate a new class of "interface bodies" and how they interact with ASPSPs and TPPs, including through the creation of a dispute resolution mechanism and by being able to set a range of rules about the price of commercial Open Banking schemes.
  
  
• The FCA will not be granted the power to mandate that ASPSPs must join commercial Open Banking schemes that emerge, but that position will be kept under review. We find that an interesting starting point, as any future change of course will necessarily take time.
  
  
• The FCA's enforcement powers will be extended to cover this wider remit.
  
  
• There remains some potential overlap between the standard-setting functions which the government contemplates may be performed by regulated payment system operators (as regulated by the FCA under FSMA) and those performed by non-core layer schemes and other bodies as "interface bodies" under DUAA. We think this may not be the intention and would advocate for this to be remedied – the most obvious immediate vehicle to do that is the Bill.

The DUAA statutory instrument should be published by the end of 2026. The UK was for some time the world leader in the regulation and development of Open Banking, but other jurisdictions have accelerated, and affected firms will want to keep up the momentum. What seems feasible is that the legislative framework for Open Banking could become denser and more complex, but it may benefit (on an optimistic reading) from an infusion of philosophical consistency – the existing UK regime is really two regimes: one based in payments and the other, fundamentally, a retail and SME banking competition intervention. This has not helped forward progress.       

AI agents – programmes that can act autonomously and carry out activities in the real world, such as making purchases – are among the hottest topics within payments and fintech. As has been widely covered – including by the FCA's Mills Review of AI in financial services – agentic AI raises a raft of questions. Most prominent is what happens when an agent does something wrong or impermissible? Is the person on whose behalf the agent is acting liable? Is it the designer/deployer of the agent? Is it the issuer of the payment instrument being used? The additional area of focus is authentication – how can counterparties identify and trust agents? With the new Burnham administration having already ended the public digital ID programme, this is an increasingly live debate.

HMT does not pretend to have the answers to these questions and instead asks some very open-ended questions about the correct policy approach. This is a field that is evolving extremely quickly, with firms from across payments, commerce, and technology seeking to lead – some have argued this will be as important a development as the internet (although many readers may recall that some were saying the same of the metaverse about five years ago).   

Firms have until 6 October 2026 to respond to the consultation. These are very big questions that could lead to a fundamental reshaping of payments regulation, especially online and on-chain. Firms interested in stablecoins face the most urgent task of continuing to press the government to minimise delay and disruption in stablecoin payments, when they may already face a sizeable task in preparing for the FCA regulated cryptoassets authorisation gateway.

Taken as a whole, the proposals in this CP – which range from very granular points on the future of Open Banking, to "blue sky" questions about liability for the acts of AI agents, with numerous other questions in between – could bring about a very bright medium-term future for payments in the UK.

 That future state will, however, require an enormous amount of policy, legal and regulatory engineering.

That task must start immediately. Please contact the Travers Smith Fintech, Market Infrastructure & Payments team to see how we could help.