United Kingdom — FCA Small Payment Institution (SPI) Registration 2026

What is the UK FCA Small Payment Institution?

The Financial Conduct Authority (FCA) Small Payment Institution (SPI) registration is an FCA authorization that allows companies to provide regulated payment services in the United Kingdom under the Payment Services Regulations 2017 (PSRs 2017) — the UK implementation of the EU's PSD2, which remained in UK law post-Brexit. Unlike the full Authorised Payment Institution (API) license, the SPI registration has no minimum capital requirement and a significantly lighter regulatory burden — making it the most accessible FCA payment authorization for startups and growing fintech companies.

Once registered as an SPI, the firm is listed on the FCA Register as a regulated payment service provider — the definitive public record of UK-authorized financial services firms. This FCA Register listing is recognized by UK banks, payment scheme operators, and business counterparties as confirmation of regulated status.

SPI vs. API: The Critical Distinction

The UK has two tiers of payment institution authorization. Choosing the right tier from the outset determines your operational ceiling and compliance obligations.

Permitted Payment Services Under SPI Registration

An SPI registration covers the payment services defined in the Payment Services Regulations 2017. The following activities are permitted (subject to the €3M monthly cap per service):

• •Execution of payment transactions — credit transfers, direct debits, and payment orders
• •Payment initiation services (PIS) — initiating payment orders on behalf of clients from their payment accounts held at other banks
• •Account information services (AIS) — aggregating and presenting client account information from multiple financial institutions (Open Banking)
• •Issuing payment instruments — prepaid payment instruments, payment cards (not e-money issuance)
• •Merchant acquiring — accepting payment cards and other payment instruments on behalf of merchants
• •Money remittance — receiving and transmitting funds without a payment account created in the payer's or payee's name
• •Payment gateway services — facilitating online payment transactions between buyers and merchants

What SPI Does NOT Cover

The Mind and Management Requirement

The Mind and Management requirement is the single most challenging aspect of UK SPI registration for non-UK-based operators. It is not a cosmetic requirement — the FCA applies it substantively and refuses applications where genuine UK management cannot be demonstrated.

Key Personnel Requirements

MLRO Requirements in Detail

The MLRO must have genuine expertise in UK AML/KYC compliance — not simply a title. The FCA assesses the MLRO's knowledge of UK-specific AML obligations under the Money Laundering Regulations 2017 (MLRs), the Proceeds of Crime Act 2002 (POCA), and FCA guidance on financial crime. Zitadelle AG assists with MLRO placement through our HRFinEase recruitment network for candidates who meet FCA's substantive requirements.

Full Compliance Requirements (2026)

AML/KYC Framework Requirements

• •Full AML/CTF compliance programme aligned with UK Money Laundering Regulations 2017 (MLRs)
• •Written AML/CTF policies and procedures covering all payment services
• •Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) procedures
• •Transaction monitoring systems and suspicious activity reporting (SAR) to the National Crime Agency (NCA)
• •Sanctions screening — OFSI (UK Treasury) and UN sanctions list screening for all clients and transactions
• •Annual AML/CTF risk assessment
• •Staff training programme — documented AML/CTF training for all relevant staff

IT and Operational Compliance

• •Secure and resilient IT systems for payment processing
• •Business continuity and disaster recovery planning
• •Fraud prevention and detection systems
• •Data protection compliance — UK GDPR (post-Brexit data protection framework)
• •Strong Customer Authentication (SCA) for applicable payment transactions — UK implementation of PSD2 SCA requirements

Safeguarding Requirements

For SPI registrations covering payment services where client funds are held — such as money remittance or merchant acquiring — the FCA requires safeguarding of client funds. This involves holding client funds in a designated safeguarding account at a UK credit institution, separate from the firm's own operational funds. The safeguarding obligation applies per-transaction from the moment funds are received.

Four-Stage Application Process

Zitadelle AG manages the SPI registration through four structured stages — from initial readiness assessment through FCA approval.

Stage 2 Application Documents

• •Completed SPI application form (via FCA Connect portal)
• •Safeguarding policy (for applicable payment services)
• •Payment security policy — covering transaction security measures and incident management
• •Transaction monitoring policy — describing monitoring procedures and thresholds
• •Complaints handling policy — FCA-compliant complaints procedure
• •Fraud prevention policy
• •Controller forms for all shareholders holding 10%+ of shares
• •Individual forms for all directors and the MLRO — personal declarations, criminal record disclosures, financial history, regulatory history
• •Business plan and financial projections
• •AML/CTF risk assessment and compliance programme

Timeline

UK SPI vs. Other UK Payment Authorizations

Post-Brexit: UK SPI and EU Market Access

Post-Brexit, a UK FCA SPI registration provides no access to EU/EEA payment markets. This is one of the most important distinctions between UK SPI and EU EMI authorization.

• •UK SPI authorizes payment services in the United Kingdom only — no EU passporting rights
• •EU/EEA clients are technically accessible, but without EU passporting, marketing regulated payment services to EU retail clients raises compliance questions under EU national payment regulations
• •UK SPI holders intending to serve EU clients should seek legal advice on their specific target markets' local payment regulations
• •For genuine EU market access and 30-country EU passporting, a separate EU EMI (Bank of Lithuania or equivalent) is required
• •Many global payment operators hold both a UK FCA authorization (SPI or API) and an EU EMI — covering both markets from their respective regulatory bases

The SPI-to-API Upgrade Pathway

The SPI is designed as a stepping stone, not a permanent regulatory home. As transaction volumes grow beyond €3M monthly per service, upgrade to API is required.

When monthly payment transaction volumes consistently approach or exceed €3M per payment service, the firm must apply to the FCA for full API authorization. The API application builds on the SPI's existing compliance infrastructure — the business plan, AML/CTF framework, and operational policies developed for the SPI registration form the foundation of the API application.

The API application requires additional elements not required at SPI stage — specifically, paid-up capital of £125,000 or higher depending on services, a safeguarding assessment relative to the larger transaction volumes, and a more detailed governance and business continuity framework.

How Zitadelle AG Assists

• UK readiness assessment — Mind and Management evaluation, CEO and MLRO qualification review
• UK company incorporation (if required) — Companies House registration with appropriate payment services corporate purpose
• CEO and MLRO placement — UK-resident payment professionals via HRFinEase
• Full FCA SPI application preparation — all application forms, policies, individual and controller forms, business plan
• FCA Connect portal submission — managing the complete FCA portal filing process
• FCA case officer liaison — managing all FCA correspondence, information requests, and clarifications
• AML/CTF compliance framework — UK-specific MLRs-aligned programme, SAR reporting, sanctions screening
• Safeguarding account establishment — banking introductions for designated safeguarding accounts
• Post-registration compliance support — FCA reporting, PSRs 2017 compliance maintenance
• SPI-to-API upgrade planning and management — forward planning from the outset

Frequently Asked Questions

Related Licenses