The UK is introducing new payment regulations to protect customers and enhance digital payment security. This article breaks down the key changes.
In a significant regulatory overhaul, the UK has started to implement a series of new payment regulations, aiming to protect customers and enhance the safety of digital payments.
Throughout its evolution, the rise of fintech innovations and the increasing complexity of financial crime, existing frameworks struggle to keep pace. Traditional payment methods, such as debit cards, have expanded to digital wallets, such as Apple Pay and Google Pay, mobile apps, and the rapidly growing Buy Now, Pay Later systems. This led to critical gaps in fraud prevention, transparency, and operational resilience, which new and improved regulations are designed to address.
Led by the Financial Conduct Authority (FCA) and the Payment Systems Regulator (PSR), the UK payment reform is a decisive step toward fairer financial outcomes, higher trust across the payments ecosystem, and stronger consumer protection.
In this article, we'll explore the key changes taking place under the new regulations. Additionally, we'll explore their broader impacts.
The new regulations mark a pivotal upgrade to the UK's payments system. They introduce tighter requirements aimed at protecting financial data and safeguarding customers against fraudulent transactions.
Traditional banks, payment apps, and modern payment solution providers (PSPs) will need to integrate advanced reporting protocols and fraud detection tools to meet the heightened regulatory expectations and avoid financial losses.
The FCA has updated its Safeguarding Guidance to ensure operational compliance and the adequate protection of customer funds at all times.
Payment institutions, e-money institutions, and credit unions that issue e-money (collectively referred to as payments firms) are liable to maintain control and protect funds they receive in connection with making a payment or in exchange for e-money issued.
The FCA requires enhanced reporting, monitoring, and recording in order to reduce the risk of shortfalls in case a payments firm enters an insolvency process. Firms are required to maintain robust internal and external reports, as well as arrange safeguarding audits to ensure operational compliance. Firms must also ensure that customer funds are directly deposited into a separate safeguarding account by the end of the next business day, demonstrating their responsibilities toward consumer financial protection.
The FCA also emphasises the importance for financial institutions and PSPs to meet their obligations under the Consumer Duty. This includes a requirement for payment firms and all parties to deliver good outcomes for their retail customers and act in the customers' best interests.
The Payment Services (Amendment) Regulations 2024 allow a payment service provider to delay a transaction to a payee's account in cases of suspected authorised push payment (APP) fraud. APP fraud occurs when a consumer is tricked into authorising a payment to an account that belongs to a fraudster. These scams have increased significantly in recent years.
According to the new regulations, PSPs can pause payments for up to four business days if there are reasonable grounds to suspect the payment is fraudulent. These delay powers took effect alongside reimbursement in October 2024.
The delay gives PSPs the necessary time to investigate suspicious payments, assess the risk of fraud, and protect users. The grounds for the delay must be established no later than the end of the business day following receipt of the payment order.
PSPs must inform the payer that the payment has been delayed for investigation purposes. They must clearly explain the reason for the delay, outline any action required from the payer to take to support the investigation, and keep the payer updated on progress.
The payer's and payee's PSPs are encouraged to exchange information to enable effective investigations and prevent losses.
If the investigation confirms that APP fraud has occurred, the sending PSP is expected to refund the customer promptly and later settle 50:50 costs with the receiving PSP under PSR rules. These protections apply to both Faster Payments and CHAPS. Under the new regulations, victims of APP fraud are entitled to mandatory reimbursement. The cost of reimbursement is shared equally between the payer's (sending) PSP and the payee's (receiving) PSP.
Reimbursement should occur within 5 business days of the fraud being reported. However, the sending PSP can extend this time frame to gather additional information or verify the legitimacy of the claim, as long as they complete their assessment within 35 business days.
The cost of reimbursement is currently capped at £85,000. However, reimbursement is not required where the customer has acted fraudulently or where the customer has acted with gross negligence (that is, outside the consumer standard of caution).
In June 2025, the Payment Services and Payment Accounts (Contract Termination) (Amendment) Regulations 2025 were published together with an explanatory memorandum. The regulations govern the termination of framework contracts for payment services concluded for an indefinite period of time.
The new requirements require PSPs to give a 90-day notice and a specific written reason, and signpost the Financial Ombudsman Service, instead of the previous two-month period, before unilaterally terminating a contract. Termination notices must be in writing and contain certain information, including a detailed explanation of the reasons for termination. Payment services customers can complain to the Financial Ombudsman Service regarding the termination of the framework contract.
This regulatory update, focusing on key areas of customer protection, aims to give customers sufficient time to respond to termination notices or switch providers without disruption.
By way of exception, no termination notice is required if the PSP is unable to apply customer due diligence measures required under anti-money laundering legislation. This exception applies, for example, when a PSP is unable to verify a customer's identity or the legitimacy of their transactions.
The new notice rules come into force on 28 April 2026 and apply to indefinite-term framework contracts entered into on or after that date.