How to Become a Legal Payment Acquirer in the UK

Payment acquiring in the UK is regulated by the Financial Conduct Authority (FCA), the Payment Systems Regulator (PSR) and the international card schemes.

This guide walks through the process step by step, covering FCA authorisation, capital thresholds, safeguarding obligations, AML compliance, technical standards and scheme membership, from the initial licensing steps to the ongoing compliance responsibilities of firms that enter the acquiring market or work with established acquirers.

Who Regulates Payment Acquirers in the UK

Payment acquiring is a regulated activity in the UK, so the first step is knowing which bodies set the rules. Businesses that provide this service must meet strict legal and compliance standards before they can operate, and three key entities regulate and oversee acquirers.

Financial Conduct Authority (FCA)

The FCA regulates UK financial services firms. If your firm intends to act as an acquirer, helping merchants accept card payments, you must obtain authorisation under the Payment Services Regulations 2017. Acting as a payment acquirer without FCA authorisation constitutes a criminal offence under UK law.

Payment Systems Regulator (PSR)

While the FCA regulates individual firms, the PSR oversees the systems enabling UK payments, such as Bacs, Faster Payments, CHAPS, and card networks. The PSR ensures that these systems remain competitive and accessible.

This affects acquirers who must use settlement networks and clearing infrastructure or gain scheme access through banking or related services. If you plan to clear and settle transactions via a major system or through an integrator, you must meet the PSR's access requirements, though access terms may not always be favourable.

The PSR's role is set to change. The Financial Services and Markets Bill, introduced in May 2026, proposes abolishing the PSR and transferring its functions to the FCA, with Royal Assent expected in 2027. Until that transfer takes effect, the PSR remains an independent regulator, so acquirers should plan for its access requirements now and track the move to the FCA.

Card Schemes (Visa, Mastercard)

Beyond UK regulators, acquirers must engage with international card schemes such as Visa and Mastercard. Though not governmental bodies, these schemes enforce strict membership and scheme compliance standards for routing card transactions through their networks.

You will need either direct membership or a sponsorship agreement with a principal member. Compliance obligations cover transaction processing, fraud monitoring, technical certification, and dispute handling.

Key UK Legislation Governing Payment Acquirers

The legal foundation for payment acquiring in the UK is built on several key pieces of legislation. These laws define what acquiring activity is, when it becomes regulated, and what obligations apply to businesses involved in processing card payments.

Payment Services Regulations 2017 (PSRs 2017)

The Payment Services Regulations 2017 (PSRs 2017) are the legislative provisions that control payment services within the UK. They implement the European Union's Second Payment Services Directive (PSD2), which continues to shape UK law post-Brexit.

The PSRs 2017 stipulate that acquiring of payment transactions is a regulated payment service. Therefore, any company working with merchants to effect card payment for goods and services to the consumer, and settling that payment in conjunction with card schemes, is engaging in a regulated payment service.

The PSRs 2017 set out:

Electronic Money Regulations 2011 (EMRs 2011)

The Electronic Money Regulations 2011 (EMRs 2011) require a licence for firms that issue electronic money (e-money). They also apply to acquirers, particularly those operating hybrid models that combine e-money provision and acquiring in one channel.

For example, if your acquiring business also offers e-wallets or prepaid accounts where users can deposit money and use it for other services, you will need to be dual-licensed as both:

• An Authorised Payment Institution (API) under the Payment Services Regulations 2017 (PSRs 2017)
• An Authorised Electronic Money Institution (EMI) under the Electronic Money Regulations 2011 (EMRs 2011)

Financial Services (Banking Reform) Act 2013

The Financial Services (Banking Reform) Act 2013 is not directly related to the operations of payment institutions but is part of the broader UK regulatory framework for the financial infrastructure that supports payment systems.

Among other things, this Act established the Payment Systems Regulator (PSR) in 2015 and empowered it to:

• Encourage competition in payment systems and development
• Ensure fair access to infrastructure offered by larger service providers (including acquirers)
• Prevent anti-competitive practices within the payment value chain

For payment acquirers, particularly those requiring direct access to schemes or the settlement infrastructure, this Act formalises your potential claims to access and operate within the payments network at commercially reasonable rates.

Steps for Payment Service Providers to Become a Licensed Acquirer in the UK

Becoming a licensed payment acquirer in the UK is a structured, regulator-led process. From selecting your regulatory status to onboarding your first merchant, each step must meet the standards set by the FCA and align with broader payment scheme requirements.

This section outlines the six key steps your business must follow, in order, to legally launch acquiring services and secure a UK acquiring licence.

1. Decide on Entity Type: Authorised vs Small Payment Institution

Your first decision is whether you're going to be an Authorised Payment Institution (API) or a Small Payment Institution (SPI).

For the majority of acquirers looking to expand, the route is typically through an API choice.

2. Prepare Your FCA Application Pack

After determining the suitable entity, the next step is to assemble the complete FCA Application Pack for the FCA's review and approval. It must include:

According to the FCA's guidance, acquiring businesses in regulated industries must create a bespoke application. Failure to provide the requested information will increase processing time.

3. Submit Application and Pay Regulatory Fees

Once your application is ready, submit it via the FCA Connect system, which you reach through the My FCA portal. You'll also need to pay the non-refundable regulatory fees, which depend on your acquisition model and transaction volume.

Once submitted, you're in the FCA review queue. The FCA must decide a complete application within 3 months, and an incomplete one within up to 12 months, although actual timelines often extend to 6 to 9 months due to FCA feedback timeframes.

4. Undergo FCA Assessment and Respond to Queries

The FCA will assess your application, so be ready to respond to follow-up questions in these areas:

The FCA may need clarification, additional documentation, or resolution of concerns before proceeding.

5. Receive Authorisation and Begin Onboarding Merchants

Once the FCA is satisfied with all information and requirements, you'll be listed on the FCA Register. Authorisation allows your business to legally conduct regulated acquiring activity in the UK.

However, you still cannot process card payments until the next step: applying to the relevant card schemes.

6. Apply for Card Scheme Membership or Partnership

To accept card payments, you must either become a direct member of card schemes (Visa, Mastercard) or partner with a principal acquirer already approved by a scheme.

With direct membership, you control your acquiring process, but the technical and compliance requirements are substantial. You must complete scheme onboarding and scheme audits, and demonstrate the ability to manage fraud handling, chargebacks, and scheme compliance.

Many new acquirers opt to partner with established processors or scheme members before switching to direct membership as transaction volumes increase.

Core Requirements to Obtain FCA Authorisation

Securing FCA authorisation for payment acquirers means proving that your business is structured, funded, and governed in a way that meets the regulator's expectations.

Minimum Capital Thresholds

The FCA expects all applicants to demonstrate adequate initial capital appropriate to the payment services being provided.

For acquirers operating as Authorised Payment Institutions (APIs), the minimum initial capital is €125,000, the level the PSRs 2017 set for acquiring of payment transactions and the other services in Schedule 1, paragraph 1(a) to (e). Money remittance on its own carries a lower €20,000 requirement, and a firm offering several services must meet the highest applicable amount.

This capital must be liquid, available, and verifiable, not reliant on projected income. Audited confirmations or bank statements must be provided.

Governance and Senior Management

The FCA requires acquirers to have a clear governance structure with well-defined responsibilities and a senior leadership team suitable for a regulated financial entity.

You must have:

Payment institutions authorised only under the PSRs 2017 are not covered by the Senior Managers and Certification Regime (SM&CR). Instead, each director and person responsible for managing payment services submits a PSD Individual form, and the FCA assesses all key personnel for good repute, competence, integrity, and financial soundness.

Operational and Risk Control Systems

Applicants must demonstrate operational readiness and risk control capabilities appropriate to their acquiring activity. This includes:

The FCA expects these policies to be implemented, maintained, and periodically reviewed.

Business Continuity and IT Infrastructure

Acquiring is infrastructure-intensive, and the FCA requires assurance of your systems' reliability, security, and scalability. You must provide:

If you plan to outsource any core function, such as transaction processing, fraud detection, or data hosting, you must disclose related contracts and demonstrate how you will manage risks in line with outsourcing guidelines in the FCA Handbook (SYSC 8).

Safeguarding and Fund Protection Obligations

Safeguarding is the compliance requirement that protects customer funds if a UK-authorised payment acquirer goes insolvent or fails to operate as expected. For acquirers that hold merchant funds directly, receive settlement amounts and take revenue payments, non-compliance with safeguarding requirements results in regulatory enforcement actions and reputational damage.

Since 7 May 2026, the FCA's CASS 15 regime has tightened these duties for payment and e-money institutions. Firms must run internal and external safeguarding reconciliations every reconciliation day, file a monthly safeguarding return (REP027) through My FCA within 15 business days of month-end, and commission an annual safeguarding audit. DECTA's guide to the new safeguarding legislation for UK payment and e-money firms covers the regime in detail.

Segregation vs Insurance-Backed Safeguarding

Per the Payment Services Regulations 2017, authorised payment institutions must protect customer funds through one of two safeguarding measures:

Segregation (the most common method): Customer funds are placed in a separate safeguarding account with an authorised credit institution (normally a UK or EEA bank). This account must be separate from the firm's own operating accounts, so the funds are clearly distinguished from operational activity and never used for operating income or investment purposes.

Insurance-backed safeguarding: A safeguarding insurance policy or comparable guarantee can be purchased from an insurance company registered with the FCA. This method requires insurance coverage at 100% of safeguarded amounts, subject to eligibility requirements.

Most firms choose the segregation method as it is simpler and aligned with FCA expectations.

Safeguarding Account Setup, Reconciliation, and Audits

If a firm chooses to segregate, requirements apply at three stages: account opening, ongoing reconciliation, and audits.

Opening of safeguarding accounts: These must be named in a way that clearly indicates they are safeguarding accounts (e.g., "Client Safeguarding Account - XYZ Ltd"), and the agreement with the banking institution must stipulate restrictions on access to and use of such funds.

Daily reconciliation: A firm must reconcile the actual amounts safeguarded against the record of what is owed to clients or merchants, at minimum each business day. Any shortfall must be rectified by the end of that business day using the firm's own unsegregated assets.

Annual audit of safeguarding arrangements: An independent auditor must provide an opinion on the firm's safeguarding arrangements each year, confirming compliance with safeguarding requirements, and the firm submits it to the FCA.

Non-compliance with safeguarding is one of the more common regulatory concerns identified through FCA enforcement and supervisory actions. It remains a focus of both pre-approval assessment and post-approval supervision.

FCA Monitoring and Best Practices

After obtaining approval, the FCA expects firms to demonstrate compliance with safeguarding requirements at any time, including:

Aside from assessments triggered by firm-specific issues (e.g., complaints), the FCA may request bank confirmations, reconciliation data, and safeguarding figures during thematic assessments or firm reviews.

Recently, enforcement actions have increased against firms misallocating funds, delaying reconciliation, or failing to separate firm money from client money.

Anti-Money Laundering (AML) and Financial Crime Compliance

Payment acquirers sit at a critical point in the financial system, facilitating the movement of funds between customers, merchants, and banks. That position comes with a heightened risk of exposure to money laundering, terrorist financing, and fraud. As a result, the UK imposes strict obligations on all regulated acquirers under its anti-financial crime framework.

MLR 2017 Obligations for Acquirers

All FCA-authorised payment institutions must comply with the Money Laundering Regulations 2017 (MLR 2017). Your firm, as an acquirer, will be considered a relevant person and must take the necessary steps to ensure your service is not used to facilitate crime. Requirements include:

Your AML framework will be reviewed during your application, and the FCA will assess compliance during ongoing supervision.

Customer Due Diligence (CDD), Monitoring, and Screening

For acquirers, the primary AML risk involves onboarding and maintaining relationships with merchant clients. You must conduct Customer Due Diligence (CDD) at the beginning of every merchant relationship and apply Enhanced Due Diligence (EDD) for high-risk geographies or high-risk industries (e.g., crypto, gaming), Politically Exposed Persons (PEPs), and complex ownership structures.

CDD must include:

You must also conduct ongoing monitoring, assessing merchant transaction behaviour in real-time or near-real-time using automated rules and behavioural flags to identify suspicious activity.

Suspicious Activity Reports (SARs) and Reporting to the NCA

If ongoing monitoring raises unresolved concerns, you may be required to submit a Suspicious Activity Report (SAR) to the National Crime Agency (NCA). SARs are required when there is suspicion or awareness that a transaction involves criminal property, proceeds of crime, or terrorist financing.

Your firm must have:

The NCA may issue a defence against money laundering (DAML), which means you must halt the transaction during the moratorium period until further instruction is given.

PCI DSS, SCA, and Technical Compliance Standards

In addition to financial and operational compliance, payment acquirers in the UK must meet stringent technical, security, and fraud prevention standards. These are essential not only for regulatory approval but also for maintaining card scheme membership and customer trust.

PCI DSS Scope for Acquirers

PCI DSS (Payment Card Industry Data Security Standard) is a global standard developed by the card schemes (Visa, Mastercard, etc.) to protect cardholder data. Acquirers must maintain PCI compliance.

Acquirers are within PCI scope if any systems interface with, process, or store cardholder data or sensitive authentication data. This includes acquiring platforms and payment gateways, payment routing and tokenisation systems, and any merchant-facing services operated from your infrastructure.

Affected entities must:

Acquirers must demonstrate compliance to the card schemes annually. If payment processors are not PCI-certified, they risk fines, scheme non-compliance sanctions, or loss of ability to support credit card processing.

Strong Customer Authentication (SCA) and RTS Compliance

Strong Customer Authentication (SCA) is required under the UK implementation of the EU Regulatory Technical Standards (RTS) on SCA and Secure Communication, as mandated by PSD2.

SCA enforces two-factor authentication for most card-not-present transactions. While acquirers don't execute authentication, they must:

Non-compliance with SCA can result in declined transactions and chargebacks that cannot be contested. Acquirers are expected to proactively monitor authentication performance and act on fraud detection and red flags.

Fraud Detection and Incident Reporting

Fraud detection and effective response are core compliance obligations for payment acquirers. In practice, acquirers deploy transaction monitoring systems using rule-based or machine learning-based fraud prevention tailored to merchant behaviour, and implement chargeback management and structured dispute-handling processes.

If a major security incident occurs (e.g., data breach, or significant fraud), you are required to notify the FCA without undue delay. Notification obligations are detailed in SUP 15 of the FCA Handbook. Incidents that may trigger reporting include:

Additionally, card schemes may require separate notifications and initiate forensic investigations, especially in cases involving compromised PAN or CVV data.

Post-Authorisation FCA Compliance Requirements

Once authorised by the FCA, payment acquirers must comply with ongoing post-authorisation obligations. These standards are mandatory: non-compliance can risk your regulated status, endanger client funds, or result in conduct breaches under UK regulations.

All regulated payment firms must submit regulatory returns through the RegData platform on a scheduled basis. Acquirers are primarily responsible for submitting:

These reports are used by the FCA to monitor your risk profile. Submissions must be timely, accurate, and consistent with previous filings to avoid scrutiny for misreporting or delays.

Under SUP 15 of the FCA Handbook, authorised firms must notify the FCA of material changes or incidents, including changes to control, directors, senior management, or regulated activities, as well as data breaches, major fraud incidents, or operational suspensions.

Such events must be reported within the window the relevant rule sets, which for most matters means immediately or without undue delay. Notifications must be submitted through official channels, clearly and promptly.

Acquirers must also keep their directors and managers fit and proper, which includes ensuring that senior staff demonstrate integrity, uphold effective risk management, and promote fair customer outcomes.

Additionally, firms are subject to extensive recordkeeping practices, including:

These records must be retained for a minimum of five years and be available for FCA review at any time.

Finally, all FCA-regulated acquirers are responsible for paying FCA annual fees, determined by firm size and regulatory permissions. These must be paid on time to avoid penalties or enforcement action.

Card Scheme Membership and Acquirer Licences

Authorisation from the FCA allows you to operate as a payment acquirer under UK law, but it does not, by itself, give you access to the card networks. To process card transactions for merchants, you must either become a licensed member of card schemes like Visa and Mastercard or work with a scheme-approved partner.

Visa/Mastercard Scheme Onboarding Process

There is a scheme-specific onboarding and certification testing process. This is a secondary, intensive approval that runs alongside your FCA application and is reviewed just as rigorously. During Visa scheme onboarding and Mastercard scheme onboarding, the card schemes will assess your:

In addition, scheme network integration is required, including transaction testing and approval, and may involve letters of support from bank sponsorship or processing partners. Scheme onboarding can take several months and should be factored into your launch timeline.

Direct vs Sponsored Membership Models

New and scaling acquirers must decide between direct membership and sponsored membership.

Scheme Compliance Obligations and Audits

Joining a scheme through Visa or Mastercard brings ongoing scheme compliance requirements and regular scheme audits, including:

• Ongoing PCI DSS compliance
• Fraud data reporting, chargeback data reporting, and performance data reporting
• Participation in scheme-led reviews or audits
• Addressing compliance alerts for issues such as fraud thresholds or late settlements

Card schemes take swift action against non-compliant acquirers, ranging from fines to membership termination. To mitigate risk, acquirers must stay aligned with scheme updates and conduct regular internal reviews in collaboration with compliance and revenue operations teams.

How DECTA Supports Licensed Acquirers with Turnkey Acquirer Processing

DECTA offers a comprehensive turnkey acquirer processing solution through a unified platform that delivers tailored services to meet the needs of banks and financial institutions. These solutions simplify acquiring from a regulatory compliance, payment data security, and functional standpoint.

What DECTA Offers for Acquirer Processing:

Merchant Onboarding and Management: Automated MID (Merchant Identification Number) and TID (Terminal Identification Number) management are available 24/7. DECTA's legal entity handling, rate plans, and visibility into merchant and terminal IDs reduce administrative burdens for faster merchant onboarding.

Transaction Routing and Processing: Supports omnichannel payment processing. DECTA consolidates sales channels into a single system that enables seamless POS (Point of Sale) integration and mobile payments.

3D Secure Payment Authentication: DECTA enables support for the latest 3D Secure (3DS v2.2) standards and full PSD2 compliance, including Strong Customer Authentication (SCA). This helps reduce fraud risk and increase payment acceptance rates.

Tokenized Payments: Accept tokenized payments through eWallet integration with Apple Pay, Google Pay, and Samsung Pay. Tokenization provides fast and secure transactions both in-store and online.

Direct Scheme Connectivity and PCI-Compliant Stack: DECTA provides direct scheme connectivity, including both Mastercard connectivity and Visa connectivity, supported by a PCI DSS Level 1 certification infrastructure for maximum payment data security.

DECTA's acquirer processing platform provides licensed acquirers with a secure, scalable infrastructure trusted by merchants for reliable transaction routing and varied payment processing capabilities.