What Should UK Businesses Check When Choosing a Cross-Border Payment Provider?
Before you shortlist a cross-border payment provider, confirm that it is authorised or registered with the FCA, or registered with HMRC if it sits outside FCA…
Before you shortlist a cross-border payment provider, confirm that it is authorised or registered with the FCA, or registered with HMRC if it sits outside FCA supervision (1). All money remitters must be registered for supervision before offering these services to their customers, so confirm registration before onboarding a provider that offers remittance (1).
What should I check first when choosing a cross-border payment provider for my UK business?
Start with legal status, because businesses that provide payment services must be authorised or registered with the Financial Conduct Authority (FCA) as Payment Institutions or Electronic Money Institutions (1). Businesses that transmit money electronically or initiate payments must be authorised or registered with the Financial Conduct Authority (FCA) as Payment Institutions or Electronic Money Institutions under the Payment Services Regulations 2017, so ask the provider which regime it sits under.
A provider that is authorised or registered with the FCA is supervised by the FCA for anti-money laundering compliance (1). Payment service providers that are not FCA-supervised, such as certain bill payment providers or telecom and digital payment facilitators, must register with HMRC and are supervised by HMRC under the Money Laundering Regulations.
How should a payment provider protect my money, and what happens to it if the provider fails?
An authorised payment institution must safeguard relevant funds in accordance with either paragraphs (5) to (11) or paragraphs (12) and (13) of Regulation 23 (2). Under Regulation 23, relevant funds are sums received from, or for the benefit of, a payment service user to execute a payment transaction, and sums received from another payment service provider to execute a payment transaction on behalf of a user (2).
Under paragraphs (5) to (11), an authorised payment institution must keep relevant funds segregated from any other funds that it holds (2). If it still holds them at the end of the business day after receipt, it must place them in a separate account with an authorised credit institution or the Bank of England, or invest them in secure, liquid assets approved by the FCA and hold those with an authorised custodian. Paragraph (8) of Regulation 23 also says that no person other than the authorised payment institution may have any interest in or right over the relevant funds or relevant assets placed in an account in accordance with paragraph (6)(a) or (b), except as provided by the regulation (2).
Under paragraphs (12) and (13), the authorised payment institution instead covers relevant funds with an insurance policy from an authorised insurer, or with a comparable guarantee given by an authorised insurer or by an authorised credit institution (2). The proceeds must be payable on an insolvency event into a separate designated account, which is used only for holding those proceeds or for holding them together with funds or assets held in accordance with paragraph (7) of the regulation.
Regulation 23 also applies its organisational arrangements requirement to a small payment institution that voluntarily safeguards relevant funds, so confirm with a provider whether it safeguards your funds under this regulation.
The provider must also maintain organisational arrangements that minimise the risk of loss or diminution of funds through fraud, misuse, negligence or poor administration (2).
How should a payment provider handle UK sanctions screening and due diligence?
OFSI's guidance says that, under the Sanctions Act, financial services covers the previously used 'financial assistance', and this does include processing payments (3). It defines financial services as any service of a financial nature, including payment and money transmission services (3).
If a firm knows or has reasonable cause to suspect that it holds funds of a designated person, it must freeze them and avoid dealing with them or making them available to that person, unless an exception in the legislation applies or it holds an OFSI licence. It must also report them to the Office of Financial Sanctions Implementation (OFSI) (3).
In practice, HMRC's guidance for money service businesses (MSBs) says an MSB must screen customers, beneficial owners and transactions against the UK Consolidated Sanctions List maintained by OFSI (1). If an MSB identifies a designated person, it must immediately freeze funds and prevent transactions that would make funds or resources available to that person.
The same guidance says MSBs must carry out due diligence on their payout partners, confirming they are legitimate businesses with effective anti-money laundering and counter-terrorist-financing controls and no links to organised crime, terrorist financing or proliferation financing (1). It does not classify payment service providers as MSBs for HMRC purposes, and they have separate compliance obligations under their own supervisory authority (1).
HMRC's guidance also says MSBs are legally required to report to OFSI if they know or have reasonable cause to suspect that a customer is a designated person, or that a breach of financial sanctions has occurred (1).
Provider checks: regulatory status, safeguarding and sanctions controls
Sources
- AMLG2400 - Sector Specific Guidance: Money Service Business Guidance, HMRC, accessed 27 October 2026
- The Payment Services Regulations 2017, legislation.gov.uk, accessed 27 October 2026
- UK financial sanctions general guidance, Office of Financial Sanctions Implementation (OFSI), HM Treasury, 12 May 2026