Launching a fintech in the UK without becoming a bank

The licence you're trying to avoid, and why

A UK Authorised Electronic Money Institution is authorised by the FCA under the Electronic Money Regulations 2011. It needs around £350,000 of initial capital, a safeguarding arrangement for customer funds, senior managers under the SMCR regime, and, from May 2026, a bank-style client-money framework. The application typically takes six to twelve months. For a product that hasn't proven demand yet, that's a lot of time and capital spent before you know if anyone wants it.

So most fintechs launch on someone else's authorisation first.

Route 1: become an agent

An EMD agent (for e-money) or a payments agent (for payment services) distributes and redeems the regulated product on behalf of an authorised principal (an EMI or PI). You're listed on the FCA's public register under that principal, you are not individually authorised, and the capital, safeguarding, SMCR, and CASS obligations sit with the principal, not you. The FCA processes an agent notification in roughly 30 to 60 days.

This is how a branded card, wallet, or payout product can go live quickly. You build the experience; the principal provides the regulated rails and supervises your conduct.

Route 2: banking-as-a-service

A banking-as-a-service provider packages compliant accounts, cards, and payments behind an API. You integrate, they hold the authorisation and often the agent relationship too. It's the fastest route to a working product. The trade-offs are a monthly platform cost, less control over the underlying features and economics, and concentration risk: if the provider has an outage or a regulatory problem, so do you. Choose one with a track record and a clear plan for the 2026 safeguarding rules.

What you still own as an agent

“Someone else holds the licence” does not mean “someone else runs your company.” You are still responsible for:

• The product, the UX, and the roadmap.
• Customer support and operations.
• Running KYC and AML checks day to day, within the principal's framework.
• Your marketing claims and how the product is represented. The principal will review these, and get them wrong and it's their licence and your contract on the line.
• Your own commercials and unit economics.

The principal supervises you, audits you, and can terminate the relationship. Treat them as a regulator you have a contract with, because functionally that's what they are.

The 2026 safeguarding change

The FCA's Policy Statement PS25/12, published August 2025 and in force from 7 May 2026, replaces the old light-touch safeguarding regime with a bank-style client-money framework under a new CASS 15 chapter. It brings in stricter record-keeping, daily reconciliation, external safeguarding audits, and more reporting.

If you're an agent, this is your principal's obligation, not yours directly, but it affects you: it raises their costs, their audit burden, and their scrutiny of agents. When you pick a principal or a BaaS provider in 2026, ask directly how ready they are for CASS 15. A principal that's scrambling in April 2026 is a risk to your launch.

Sequencing a fintech MVP

The usual path: validate with the smallest regulated surface you can, launch as an agent or on BaaS, and only pursue your own authorisation once volume and economics clearly justify carrying the capital and the compliance function yourself.

What you run day to day: AML and KYC

Even on someone else's licence, the operational anti-money-laundering and know-your-customer work is yours to run, inside the principal's framework. In practice that means:

• Identity verification at onboarding, proportionate to the risk of the product, usually through an integrated provider.
• Sanctions and politically-exposed-person screening, at onboarding and on an ongoing basis.
• Transaction monitoring for patterns that look like fraud or laundering, with a route to freeze and report.
• Suspicious activity reporting to the authorities when thresholds are met.
• Record keeping that would survive an audit by your principal or the regulator.

Budget for a compliance hire or a fractional Money Laundering Reporting Officer earlier than feels comfortable. The principal will expect one before they let you scale.

Picking a principal: the checklist

Your principal is effectively part of your infrastructure and part of your risk. Before you commit, ask:

• How ready are you for the May 2026 CASS 15 safeguarding rules? You want a concrete answer, not “we're looking at it.”
• What's your uptime and incident history on the payment rails?
• How many agents do you supervise, and what's the onboarding time for a new one?
• What can and can't we say in marketing, and how fast do you review it?
• What are the exit terms? If this relationship ends, how do customers and funds move, and how long does it take?

Don't DIY the regulatory perimeter

The one place not to save money is working out exactly which regulated activities your product performs and which permissions cover them. Get a payments-specialist compliance consultant or regulatory lawyer involved before you design the flows, not after. Misjudging the perimeter (holding funds you're not permitted to hold, or describing the product in a way that implies permissions you don't have) is the kind of mistake that ends companies, not sprints.

Common questions

Do I need FCA authorisation to launch a fintech in the UK?

Often not, to start. You can operate as an agent of an authorised EMI or Payment Institution, or use a banking-as-a-service provider, and launch on their permissions. Your own authorisation becomes worth pursuing once volumes and economics justify it.

How long does it take to become a payments agent?

The FCA typically processes an agent notification in around 30 to 60 days, compared with six to twelve months for a full Authorised EMI application.

How much capital does an Authorised EMI need?

Roughly £350,000 of initial capital, plus ongoing own-funds requirements, safeguarding arrangements, and senior-manager accountability under the SMCR.

What is changing with safeguarding in May 2026?

From 7 May 2026, the FCA's PS25/12 replaces the previous safeguarding rules with a bank-style client-money regime under a new CASS 15 chapter, adding stricter reconciliation, audit, and reporting requirements for EMIs and PIs.

What does the principal EMI actually do for me?

They hold the authorisation, carry the capital and safeguarding obligations, provide the regulated payment and e-money rails, and supervise your conduct as their agent. You build and run the product and customer experience on top.

If you're scoping a payments or e-money product, tell us what you're building and we'll help you shape an MVP around the lightest regulatory route that fits. It's how we approach fintech work.