TRW & Co · Funds & Financial Services
Fintech Lawyers in London
Fintech lawyers London businesses instruct help payments, lending, wealth and embedded-finance firms decide whether they need a licence, which one, and how to build compliant products and partnerships. With new safeguarding rules, BNPL regulation and the Consumer Duty now in force, the regulatory model you choose shapes cost, launch timing and valuation.
Key pointThe licence decision is also a valuation decision: investors scrutinise who holds the regulatory permission, who owns the customer and who controls the data, so the operating model should be fixed before the first funding round, not after.
At a glance
Core statute
Section 19 FSMA 2000 makes carrying on a regulated activity without authorisation or exemption a criminal offence, and section 21 restricts financial promotions.
Payments and e-money
The Payment Services Regulations 2017 and Electronic Money Regulations 2011 govern payment and e-money institutions, supervised by the FCA.
New safeguarding rules
FCA safeguarding rules in force since 7 May 2026 require daily reconciliations, a monthly return, a resolution pack and, for most firms, an annual audit.
BNPL now regulated
Deferred payment credit came within FCA regulation on 15 July 2026, with a temporary permissions regime for existing lenders that notified in time.
APP fraud reimbursement
Faster Payments providers must reimburse eligible authorised push payment scam victims, capped at £85,000 per claim, under rules in force since October 2024.
Swipe or scroll →
What fintech law covers in England and Wales
Fintech lawyers London businesses instruct are rarely asked a single question. A payments start-up, a lending platform, a wealth app or an embedded-finance provider usually needs regulatory permissions, commercial contracts, data protection, financial crime controls and investor documents all at once, and each workstream depends on the others. The legal question begins the moment a product touches customer money, credit, investments or regulated data.
In practice, the analysis starts with the business model rather than the technology. The same app can be an unregulated software provider, an agent of an authorised firm, a payment institution, an electronic money institution, a consumer credit lender or an investment firm, depending on who holds the funds, who bears the credit risk and who owns the customer relationship. Getting that characterisation right early is the single biggest determinant of cost, timeline and fundraising risk.
Most fintech work in London sits at the intersection of three bodies of law: the financial services perimeter under the Financial Services and Markets Act 2000, the payments and e-money regulations, and general commercial law covering partnerships with banks, card schemes, cloud providers and distributors. Our work as fintech lawyers London clients rely on is to map all three before a product launches, not after a regulator or a bank partner raises a concern.
The legal and regulatory framework for UK fintech
The starting point is the general prohibition in section 19 of the Financial Services and Markets Act 2000 (FSMA): no person may carry on a regulated activity in the UK unless authorised or exempt. Breach is a criminal offence and agreements made in breach can be unenforceable. Section 21 FSMA separately restricts financial promotions, which catches marketing copy, app onboarding screens and social media content.
Payments and e-money sit in a parallel regime. The Payment Services Regulations 2017 govern payment institutions, account information and payment initiation providers, while the Electronic Money Regulations 2011 govern e-money issuers. The FCA supervises both regimes; see its payment services and e-money guidance. Our separate page on payments and e-money covers licensing in more depth.
Regulators and bodies fintech lawyers London firms deal with
The Financial Conduct Authority is the main conduct and authorisation regulator. The Prudential Regulation Authority, part of the Bank of England, authorises banks and insurers. The Payment Systems Regulator oversees payment systems and their participants, although the government has confirmed that its functions will move into the FCA through future legislation; until that transfer, the PSR keeps its statutory powers. The Financial Ombudsman Service handles eligible complaints, and the ICO enforces UK GDPR.
Rules that have changed recently
Several recent reforms now shape fintech compliance:
- Consumer Duty. The FCA's Consumer Duty requires firms serving retail customers to deliver good outcomes on products, price and value, consumer understanding and support, and to evidence them with data.
- Safeguarding. New FCA safeguarding rules for payments and e-money firms took effect on 7 May 2026, introducing daily reconciliations, a monthly safeguarding return, a resolution pack and, for most firms, an annual safeguarding audit.
- Buy now, pay later. Deferred payment credit came within FCA regulation on 15 July 2026, with a temporary permissions regime for existing lenders who notified the FCA in time.
- APP fraud reimbursement. Since 7 October 2024, payment service providers on Faster Payments must reimburse eligible authorised push payment scam victims, up to a maximum of £85,000 per claim, under the PSR's rules.
Scotland and Northern Ireland are covered by the same UK-wide financial services legislation, but contract, insolvency and property law differ, so security packages and terms of business may need local adjustment.
Choosing a regulatory model: the key decisions
The most consequential early decision is whether to seek your own licence or operate under someone else's. Each route has a different cost profile, time to market and exit value. Investors increasingly ask about this in due diligence, because a business built on a partner's licence can be harder to value and easier to disrupt.
| Model | How it works | Advantages | Trade-offs |
|---|---|---|---|
| Full FCA authorisation (FSMA Part 4A) | The firm holds its own permissions for investment, lending or insurance activities | Control of the customer relationship; higher valuation | Longest timeline; senior managers regime; capital and reporting |
| Payment or e-money institution | Authorised or registered under the PSRs 2017 or EMRs 2011 | Direct access to payments business; passport-free UK model | Safeguarding, capital and audit obligations; bank account access can be hard |
| Appointed representative or agent | The firm acts under a principal's permission and supervision | Fastest route to market | Principal controls oversight and can terminate; FCA scrutiny of AR models has increased |
| Technology provider only | Software or infrastructure supplied to regulated firms, outside the perimeter | No authorisation | Perimeter must be documented carefully; outsourcing and operational resilience terms imposed by clients |
| Regulatory or Digital Securities Sandbox | Testing under FCA or Bank of England supervision | Regulatory dialogue and tailored conditions | Competitive entry; limited scale; exit plan required |
The FCA's Regulatory Sandbox and wider innovation services suit propositions that genuinely do not fit existing rules. The Bank of England and FCA jointly operate the Digital Securities Sandbox for firms using distributed ledger technology in financial market infrastructure.
The licence decision is a valuation decision. Fintech lawyers London investors trust will ask who owns the permission, the customer and the data before they ask about the code.
Where a full licence is the right answer, our FCA authorisation team prepares the application, business plan and regulatory business case, and our guide to the FCA authorisation process sets out what the regulator expects to see.
From concept to launch: a typical process
- Perimeter analysis. We map each product feature against the regulated activities and the PSRs and EMRs, record why each feature is or is not regulated, and identify exclusions that need to be preserved in the product design.
- Operating model choice. We compare own-licence, agent, appointed representative and partnership models against your funding runway, investor expectations and target launch date.
- Application or partnership documents. For authorisation, we draft the regulatory business plan, policies and governance map. For partnership models, we negotiate the programme agreement with the bank, issuer or principal.
- Financial crime framework. We build the customer due diligence, transaction monitoring and sanctions controls required under the Money Laundering Regulations 2017, proportionate to your risk assessment.
- Customer terms and disclosures. We draft framework contracts, privacy notices and promotions that satisfy the PSRs, the Consumer Duty and the financial promotion rules.
- Third-party and outsourcing contracts. We negotiate cloud, card scheme, safeguarding bank and BaaS contracts with the audit, termination and exit rights the FCA expects for material outsourcing.
- Go-live and post-launch review. We support the first Consumer Duty outcomes monitoring cycle, complaints handling and regulatory reporting, and adjust controls as volumes grow.
Documents and evidence regulators and partners expect
Regulators, partner banks and investors each want to see evidence that the business is controlled, not just that it has written policies. Assembling the following early saves months later:
- A regulatory business plan with three-year financial projections, stress scenarios and a wind-down plan.
- A governance map showing board composition, committees, senior management functions and reporting lines.
- A business-wide money laundering risk assessment, customer risk assessment methodology and sanctions screening procedure.
- Safeguarding arrangements, account acknowledgement letters, reconciliation procedures and, where relevant, the resolution pack required under the new safeguarding rules.
- Consumer Duty documentation: target market assessments, fair value assessments, customer journey testing and outcome metrics.
- An operational resilience self-assessment identifying important business services, impact tolerances and mapping of third-party dependencies.
- Data protection records, including data protection impact assessments for profiling, open banking data use and automated decision-making.
- A register of outsourcing and material third-party arrangements with contract summaries and exit plans.
Safeguarding is the most common reason payment and e-money firms fall into difficulty. If your reconciliations, account letters and resolution pack would not let an insolvency practitioner return customer funds quickly, fix that before you raise your next round or onboard a large partner.
Risks and common mistakes
The issues below are the ones fintech lawyers London start-ups and scale-ups instruct most often see after the event, when they are harder and more expensive to fix.
Assuming the product sits outside the perimeter
Founders often rely on a single exclusion, such as the commercial agent exclusion or a limited network exclusion, without testing how it applies as the product grows. Exclusions are narrow and fact-specific. A feature added after launch, such as holding balances overnight or offering instalment payments, can move the whole business into regulated territory. Because carrying on a regulated activity without permission is a criminal offence under section 19 FSMA and can make agreements unenforceable, the perimeter analysis should be written down, reviewed at every product change and shared with the board.
Unlawful financial promotions
Section 21 FSMA prohibits communicating a financial promotion unless it is made or approved by an appropriately authorised person or an exemption applies. Influencer campaigns, referral rewards and comparison content are frequent problem areas. Since the FCA introduced a gateway for firms that approve promotions for unauthorised businesses, not every authorised firm can sign off third-party promotions. Our guide to the financial promotions regime explains who can approve what.
Weak oversight of appointed representatives and agents
Principals remain responsible for the regulated activities of their appointed representatives and agents. The FCA has tightened expectations on onboarding due diligence, ongoing monitoring and the ability to terminate quickly. For the representative, the risk is commercial: the principal can withdraw support with little notice, leaving the business unable to trade. Contracts should address transition periods, data portability and customer communications on termination, and both sides should plan for the possibility of a direct authorisation application.
Treating Consumer Duty as a documentation exercise
The Consumer Duty is outcomes-focused. The FCA expects firms to use data to show that customers understand products, receive fair value and can get support, including vulnerable customers. A fintech whose app design creates sludge in cancellation journeys, or whose pricing relies on customers not understanding fees, is exposed even if its terms are technically compliant. Boards must approve an annual report on outcomes, and that report should be candid about weaknesses and the actions taken to address them.
Under-negotiated partner bank and BaaS contracts
Many fintechs depend on one bank for safeguarding accounts, sponsorship into payment schemes or a banking-as-a-service platform. Those contracts often allow termination at short notice for regulatory or reputational reasons. Without negotiated notice periods, cooperation obligations and data return rights, a de-risking decision by the partner can stop the business overnight. Contingency arrangements with a second provider are worth the cost for any firm with material customer balances.
Data, open finance and AI in financial products
Data is the asset most fintechs are really built on, and it is regulated from several directions at once. Account information and payment initiation services are regulated payment services under the PSRs 2017, so open banking providers need FCA authorisation or registration as well as UK GDPR compliance. Customers' explicit consent, the scope of data accessed and how long it is retained all need to line up across the regulatory terms, the privacy notice and the technical implementation.
The Data (Use and Access) Act 2025 gives the government powers to create smart data schemes in other sectors, and open finance is widely expected to build on the open banking model. Firms planning products that rely on access to savings, pensions, mortgage or investment data should design consent and data-sharing architecture so that it can adapt as schemes are introduced, rather than relying on screen-scraping or bilateral arrangements that may not survive.
Credit decisions, profiling and AI
Lenders and insurers using machine learning for credit decisions or pricing must reconcile three sets of obligations. UK GDPR restricts solely automated decisions with legal or similarly significant effects and requires meaningful information about the logic involved. The Consumer Duty requires firms to show that pricing and eligibility models deliver fair value and do not produce poor outcomes for groups of customers with characteristics of vulnerability. The Equality Act 2010 prohibits indirect discrimination, which a model trained on historic data can reproduce.
In practice, fintech lawyers London lenders instruct will want to see a model governance policy, explainability documentation, bias testing results and a human review route for declined applicants. Contracts with model vendors should give you audit rights and access to the information you need to answer the FCA, the ICO and the Financial Ombudsman Service. Our artificial intelligence team advises on vendor contracts and AI governance.
Cross-border fintech: Bangladesh, the EU, the Gulf and Asia
UK fintechs rarely stay domestic, and overseas fintechs often enter the UK first. The legal position differs sharply by market, and early structuring avoids duplicated licences.
Bangladesh
Bangladesh Bank regulates payment systems and mobile financial services, and foreign exchange remains tightly controlled. UK remittance and payments firms working in the corridor need Bangladeshi partner arrangements that respect those controls. Our UK–Bangladesh trade and finance team coordinates both sides with our Dhaka office.
European Union
UK licences no longer passport into the EU, so firms serving EU customers usually need an authorised EU entity. The EU's crypto, payments and operational resilience rules differ from the UK's, and group policies should be mapped to each regime separately.
Gulf states
Dubai and Abu Dhabi offer onshore and financial free zone regimes with their own regulators and sandboxes. UK firms often use a free zone entity for regional expansion, with English-law contracts and London arbitration for cross-border agreements.
Singapore and China
Singapore regulates payments and digital token services through the Monetary Authority of Singapore, with licensing requirements that do not mirror the UK's. Mainland China's payments and data export rules are restrictive, so data localisation must be designed in from the start.
Where foreign law governs a key element, we work with local counsel and our international offices so that the UK structure and the overseas licence fit together. For data flows, see our data protection page.
How TRW & Co's fintech lawyers London clients instruct can help
TRW & Co's London office is authorised and regulated by the Solicitors Regulation Authority. We act for founders, scale-ups, investors and established financial institutions entering digital finance. Our work covers:
Perimeter and licensing
Written perimeter opinions, regulatory business plans and applications for FCA authorisation, payment institution and e-money licences, and variations of permission as products expand.
Compliance frameworks
Consumer Duty implementation, safeguarding procedures, operational resilience mapping, financial promotions review and anti-money laundering controls tailored to your risk profile.
Commercial contracts
Programme agreements, BaaS and card issuing contracts, open banking and API agreements, cloud and outsourcing contracts, and customer terms that satisfy the PSRs.
Investment and M&A
Regulatory due diligence, change in control notifications to the FCA, and fundraising documents. Our venture capital team handles the transaction side.
Regulatory engagement
Responses to FCA information requests, skilled person reviews and supervisory concerns. Where matters escalate, our FCA enforcement team takes over.
Disputes
Disputes with partner banks, schemes, merchants and investors, including urgent injunctions where a termination threatens the business. Where advocacy in the higher courts is required, we instruct specialist counsel.
We do not promise outcomes or timescales the regulator controls. We give a realistic plan and tell you early where the risks are. Browse all our practices, read our financial services regulation page, or contact us at info@trw.co.
Checklist for fintech decision-makers
Before launch, before a funding round and at each significant product change, fintech lawyers London boards rely on would expect you to be able to answer yes to the following:
- Do we have a written, current perimeter analysis for every product feature?
- Is our operating model (own licence, agent, appointed representative or partnership) still right for our scale and investor expectations?
- Are our financial promotions made or approved by someone who is permitted to do so?
- Can we evidence Consumer Duty outcomes with data, and has the board approved its annual outcomes report?
- Do our safeguarding reconciliations, account letters and resolution pack meet the rules in force since May 2026?
- Have we identified important business services and tested them against impact tolerances?
- Do our partner bank and outsourcing contracts give us adequate notice, cooperation and exit rights?
- Are our anti-money laundering and sanctions controls proportionate to our customer base and corridors?
- Have we mapped which overseas licences we need before marketing to customers outside the UK?
- Do we know which planned regulatory changes, such as the transfer of PSR functions to the FCA, will affect our business in the next year?
If any answer is uncertain, a short scoping call is usually the most efficient next step. Related reading: our pages on cryptoassets and consumer credit.
Frequently asked questions
01Do I need FCA authorisation to launch a fintech app?
It depends on what the app does, not on the technology. If it holds customer money, executes payments, issues e-money, lends, arranges credit, advises on or arranges investments, or provides insurance distribution, it is likely to need authorisation, registration or an exemption. Pure software supplied to regulated firms can sit outside the perimeter. Because operating without permission is a criminal offence under section 19 FSMA, the safest approach is a written perimeter analysis before launch, reviewed every time a feature changes.
02Should we become an appointed representative or seek our own licence?
An appointed representative arrangement is usually faster and cheaper to start, because you operate under a principal's permissions. The trade-off is dependency: the principal controls oversight, can terminate, and the FCA has tightened its expectations of principals. Your own licence takes longer and brings capital, reporting and senior manager responsibilities, but gives control and is often valued more highly by investors. Many firms start as representatives with a planned migration to direct authorisation once revenue and governance mature.
03What is the difference between a payment institution and an e-money institution?
A payment institution executes payment transactions, such as money remittance or merchant acquiring, without issuing stored value. An e-money institution issues electronic money, a stored monetary value that customers can hold and spend. E-money institutions face different capital requirements and may also provide payment services. Both must safeguard customer funds, and neither offers Financial Services Compensation Scheme protection on those funds, which is why the safeguarding rules matter so much.
04What changed in the safeguarding rules in 2026?
New FCA rules for payments and e-money firms came into force on 7 May 2026. Firms must carry out internal and external reconciliations each reconciliation day, submit a monthly safeguarding return to the FCA, maintain a resolution pack to help return customer funds quickly on insolvency and, unless an exemption for small amounts applies, obtain an annual safeguarding audit. The FCA has said a later statutory trust model will not proceed without further consultation.
05How does the Consumer Duty affect fintech firms?
The Consumer Duty applies to firms providing products and services to retail customers in the UK. It requires firms to act to deliver good outcomes across products and services, price and value, consumer understanding and consumer support. For fintechs, that means testing app journeys, cancellation flows and communications with real users, monitoring outcomes for different customer groups, including vulnerable customers, and having the board review and approve an annual outcomes report.
06Is buy now, pay later regulated in the UK?
Yes. Deferred payment credit, the FCA's term for most BNPL products, came within FCA regulation on 15 July 2026. Lenders must comply with FCA rules, including the Consumer Duty, and providers that were already active and notified the FCA in time can operate under a temporary permissions regime while they apply for full authorisation. Retailers offering BNPL at checkout should review their contracts with lenders and their own role in promoting the credit.
07Can TRW & Co act for an overseas fintech entering the UK?
Yes. We advise overseas fintechs, including firms from Bangladesh, the Gulf and Asia, on whether to establish a UK subsidiary, the right licence, partnership options with UK banks and payment providers, and the documents the FCA and partner banks expect. Our London office is SRA-regulated and works with our international offices and local counsel where foreign law matters. Contact us at info@trw.co to arrange an initial discussion.
Sources and official materials
- Financial Services and Markets Act 2000 — General prohibition and financial promotion restriction
- Payment Services Regulations 2017 — Authorisation and conduct rules for payment services
- Electronic Money Regulations 2011 — Regime for e-money issuers
- FCA: Consumer Duty — FCA rules and guidance on retail customer outcomes
- FCA: Regulatory Sandbox — Testing innovative propositions with the FCA
- PSR: APP scams — Mandatory APP fraud reimbursement rules
- Bank of England: Digital Securities Sandbox — DLT-based financial market infrastructure sandbox
- FCA PS26/1: Regulating deferred payment credit — Final BNPL rules from 15 July 2026
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.