13 November 2017
With two key cut-off dates for compliance with the new Payment Services Directive (PSD2) coming up in early 2018, all payment services and e-money firms should be working towards fulfilling their new obligations, as well as applying for re-authorisation or re-registration (as appropriate) as soon as they possibly can – or take the risk of forfeiting their licensed status.
The first cut-off date will require authorised payment institutions (APIs) and authorised e-money institutions (AEMIs) to comply with the majority of the new requirements introduced by PSD2 from 13 January 2018. Firms should also factor in the need to give two months' notice of changes to terms of business, i.e. by 13 November 2017.
The new requirements to be met by the January deadline include changes to the conduct of business rules, new complaints handling timeframes and new reporting and notification duties, including in respect of security incidents, fraud data and complaints. Exceptions to this are limited:
Additionally, firms, including small payment institutions (SPIs) and small e-money institutions (SEMIs), must submit their applications for re-authorisation / re-registration by 12 April 2018 (extended to 12 October 2018 for SPI re-registration) if they are to be re-authorised by 12 July 2018 – being the date on which transitional authorisations will cease. This process has been developed to ensure that all existing payment services firms and e-money firms are PSD2 compliant and held to the same standard as new firms applying for authorisation.
The FCA must make a decision on a complete application within 3 months and must determine an incomplete application within 12 months.
However, the transitional provisions in the Payment Services Regulations 2017 (PSRs) implementing PSD2 and associated FCA guidance do not address what would happen where an application is made in good faith before the 13 April deadline, but is subsequently found not to have contained all the information required. As drafted, the PSRs would entitle the FCA to treat such an application as incomplete, and take the decision timeline beyond 12 July 2018 – meaning the transitional period would be over and the firm would lose its licence at that point, even if the FCA were still working on the application in a positive manner.
For this reason we suggest firms ensure they submit fully complete applications, and against the contingency that the FCA does not deem them complete, submit sooner rather than later to allow the FCA time to ask questions or request further information before 12 April 2018.
The relevant re-authorisation or re-registration form is available on and should be submitted through the FCA website, complete with all the additional information relating to their updated security and compliance frameworks, including:
Firms with agents would also need to take these operations into account in their answers.
Clearly, an API/EMI's ability to complete the application successfully is dependent on it having in place the relevant policies and processes required under PSD2, which, as set out above, should be in place by 13 January 2018. The proper development of these should not be underestimated and depending on the status of their existing arrangements, firms might find that they have a significant amount of work to do before they are in a position to begin applying for FCA re-authorisation.
Please contact the FSR team if you would like assistance with navigating this process and the changes being introduced by PSD2.