If your business receives money from clients and transmits it to third parties — paying suppliers, making payments on behalf of clients, or managing funds that belong to someone else before forwarding them — you are likely conducting payment services under the UK Payment Services Regulations 2017. That means you need FCA registration or authorisation before operating at scale.
This is not optional, and it is not as complicated as the FCA's website makes it appear. Here is a plain account of the Small Payment Institution (SPI) route, which is the appropriate first step for most businesses at the scale HBF is at.
What is an SPI and who needs one
A Small Payment Institution is a business that provides payment services and processes less than €3 million per month in transactions. Registration (not full authorisation) is sufficient. The SPI route is lighter-touch than full API authorisation and does not require the €125,000 initial capital that full authorisation demands.
You need an SPI if you are: receiving money from clients and paying it to third parties on their behalf; transmitting funds between parties; or providing any payment service where you have custody of client funds at any point.
What you actually need to apply
- Net assets of at least €20,000 (approximately £17,000) — this must be evidenced by an accountant
- A documented AML/CFT policy covering how your business identifies and manages money laundering risk
- A KYC procedure specifying the exact steps for verifying individual and business clients
- A safeguarding policy — this is how you demonstrate client funds are protected from your own operating funds
- A dedicated safeguarding bank account (separate from your operating account, labelled as safeguarding)
- Fit and proper persons assessment — this is a standard form for all directors and anyone with 10% or more ownership
- A business plan showing your payment services model and projected volumes over three years
- A complaints procedure and operational resilience policy
"The most common reason SPI applications are delayed is not missing documents. It is documents that exist but are generic — clearly downloaded from a template site rather than written for the specific business."
The three mistakes that slow most applications by six months
- Generic policy documents. The FCA reads dozens of AML policies every week. Template policies are identifiable immediately and trigger information requests. Every policy document must describe your specific business, your specific client types, your specific transaction flow, and your specific risk profile.
- No safeguarding account before applying. The FCA expects the safeguarding account to exist at the time of application, not to be opened upon approval. Open a dedicated account labelled as a safeguarding account at a UK bank before you submit.
- Submitting on Connect without a complete application. FCA's Connect system accepts incomplete applications and then issues information requests that restart the clock. Have a solicitor or regulated advisor review the application before submission. The application fee is £500 — the cost of a rejected or delayed application is far higher.
Timeline and cost
FCA target: three months from complete application. In practice, four to six months is more typical for a first-time applicant without an FCA-specialist solicitor. With specialist support, applications that are genuinely complete on submission tend to complete closer to the three-month target.
Costs: £500 application fee. £3,000 to £8,000 for specialist solicitor support. Budget a further £2,000 to £4,000 for document preparation if you need help writing the policy documents to the required standard.