FCA priorities for payments firms articulated in a further ‘Dear CEO’ letter

Following the?Dear CEO letter on 21st February 2023 to Chief Executives of payments firms about the implementation of the Consumer Duty , which set out concerns about firms’ practices in relation to account freezing and handling of fraud cases, the FCA has published another?Dear CEO letter on 16 March?2023 addressed to payments and e-money firms.?The letter is covering three outcomes, common issues they’ve observed across the sector and priority actions they expect firms to take.

The Financial Conduct Authority’s (FCA’s) recent payments portfolio letter – ‘FCA Priorities for Payments Firms’ marks an increased focus and step change for the regulation of payments.?It is the first portfolio letter to be issued by the FCA’s new Payments and Digital Assets Division, which brings together both policy and supervision to focus specifically on the payments industry, and it foreshadows the new powers the FCA will be given, under the Financial Services and Markets (FSM) Bill, to make unrestricted rules specifically for payment services and e-money firms.

The headline message is that the FCA remains “concerned that many payments firms do not have sufficiently robust controls and that as a result some firms present an unacceptable risk of harm to their customers and to financial system integrity.” The FCA also considers that “the risk of customer harm is heightened by the tightening economic conditions and the cost-of-living crisis.”?The letter reminds firms of the FCA’s commitment to act earlier and more assertively in dealing with problem firms and warns that “where firms can’t meet the conditions for authorisation, the FCA will take more assertive action sooner and will remove or sanction firms who cannot or will not meet their standards.”

Against this backdrop, the letter sets out three high-level outcomes that the FCA is seeking from payment firms:

Outcome 1: Ensure that your customers’ money is safe

• Safeguarding
• Prudential Risk management
• Wind-down planning

An area of concern for the FCA is the quality of Wind Down Plans (WDPs).?Firms need these plans to be able to exit the market orderly, in the event of a stress. WDPs are also key documents for the authorities when they deal with a failing firm. This is not the first time that the FCA has flagged deficiencies in WDPs. A thematic review concluded that the standards for WDPs were too low with substantial gaps in the analysis of liquidity. The FCA also had reservations on the credibility of WDPs where firms outsource material activities to other Group entities. For many payment firms, wind down planning is not an established process and will require an up-front investment and continued focus.

Outcome 2: Firms do not compromise financial system integrity

• Money Laundering & Sanctions
• Fraud

Two key areas are called into focus – firstly protecting customers against fraud and secondly, ensuring that firms aren’t being used to receive the proceeds of fraud. Money mules have been a longstanding industry issue and the topic is a particular focus of the FCA in their related multi-firm review which is currently underway. Particular expectations are set out around:

• reviewing risk appetite statements and policies & procedures to ensure that they adequately address the risk of fraud against customers;
• regularly reviewing fraud prevention systems and controls to ensure that these are effective; and
• maintaining appropriate customer due diligence controls at onboarding stage and on an ongoing basis to identify and prevent accounts being used to receive proceeds of fraud or financial crime.

Outcome 3: Ensuring that your customers' needs are met through high quality products and services (Implementation of the Consumer Duty)

The FCA has also called out three cross cutting priorities that relate to all the outcomes -

• Governance and Leadership, including oversight of agents and distributors
• Operational Resilience
• Regulatory reporting

What is clear is that this Portfolio letter is not about the status quo but about raising standards and affecting real change in the sector. The FCA has put the Boards and Executive Committees of firms supervised in the payments portfolio on notice that they are expected to consider which of the risks highlighted by the FCA are applicable to their business and the actions their firm will take to address them and be ready to explain these actions if requested by the FCA.?

Furthermore, the FCA expects CEOs to:

• “ensure your customers’ money is safe with you, including in the event that your firm fails”
• “to have robust controls to prevent your firm being used for financial crime, including money laundering and fraud”
• “ensure you meet your customers’ needs, including through implementation of the Consumer Duty and robust operational resilience”
• “to have robust governance and to take action to support the ESG agenda and promote diversity and inclusion”

In addition to this heightened supervisory scrutiny, the multi-year process of repealing and replacing retained EU payment services and e-money law and replacing it with a regulatory framework tailored to the UK, will result in regulatory change for firms.?The FCA has already announced a consultation, in the first half of 2023, on strengthening requirements for safeguarding funds, held by payments and e-money firms to meet customer entitlements, using their enhanced rulemaking powers.?In the meantime, the portfolio letter gives firms clear directions on how to address the FCA’s concerns and meet expectations now and, by doing so, be in a better position to respond to the regulatory changes that are inevitably coming down the line.

What next

The FCA expects Boards or Executive Committees to consider which of the risks they highlight are applicable to their business and the action the firm will take to address them. Details of these actions will need to be explained on request.

Where the FCA identifies issues, the letter states that “we will take swift and assertive action to protect customers and ensure market integrity” and highlights the commitment set out within the 2022/2025 strategy to act earlier and more assertively in dealing with ‘problem firms’. We can expect to see continued interventions using a range of supervisory tools and the letter highlights that “in cases where firms can’t meet the conditions for authorisation, we will take more assertive action sooner and will remove or sanction firms who cannot or will not meet our standards”.

This letter is another example of the focus being given to anti-money laundering, sanctions and fraud controls by the FCA, along with the focus on Authorised Push Payment fraud and scams by the Payment Systems Regulator, as well as government, linked explicitly here to the need to safeguard financial system integrity.