By Lee Werrell, Chartered FCSI | Compliance Consultant | As at 21 September 2026
The FCA has told payments firms plainly that their risk management frameworks are underdeveloped. The risk register is where that weakness shows first, and where a Compliance Manager or MLRO can fix it fastest. This guide sets out how to build one that meets the regulations, supports the board and stands up to supervisory challenge.
Key takeaways
- The regulations do not use the words ‘risk register’, but PSRs 2017 reg 6(6) and EMRs 2011 reg 6(5) require effective procedures to identify, manage, monitor and report risks. A well-run register is the most direct evidence that you meet that continuing condition.
- The FCA’s 2025 multi-firm review of 14 payments firms found that none fully met its expectations. Unclear risk appetite, immature liquidity risk management and overlooked group risk were recurring weaknesses.
- Only reduce a residual score for a control that has been tested and evidenced. Otherwise residual risk is simply an opinion.
- Do not delete outsourced or insured risks. Under PSRs 2017 reg 36 and EMRs 2011 reg 36 the firm remains responsible for what its outsourcers, agents and distributors do.
- A register earns its keep when it drives risk appetite, key risk indicators, stress testing and wind-down triggers, and when the board uses it to decide where resources go.
Why the risk register matters now
Most payment institutions (PIs) and e-money institutions (EMIs) have a risk register. Far fewer have one that would survive a supervisor asking how a particular score was reached, which control justified it, and when that control was last tested. That gap now matters more than it did.
In June 2025 the FCA published the findings of a multi-firm review of enterprise and liquidity risk management and wind-down planning at payments firms. It reviewed 14 firms during 2024/25 and found that none fully met its expectations. Frameworks were generally inadequate for the level and complexity of the firms’ activities, risk appetites were unclear, and several firms had not identified and assessed all the material risks relevant to their business model.[1]
The FCA’s Regulatory Priorities report for payments, published on 25 March 2026 to replace the old portfolio letters, repeats the message. It notes that some firms have not fully developed their risk management frameworks and wind-down plans, and it expects firms to have the governance, systems and controls, and skills to identify, assess and mitigate risk. It also links unsuccessful applications at the gateway to inadequate systems and controls.[2]
Add the Safeguarding Supplementary Regime in CASS 15, in force since 7 May 2026,[3] and the register has become one of the first documents a supervisor is likely to ask for. This guide is written for the Compliance Manager or MLRO who owns it day to day. It covers what the rules require, the failings we see most often, and a step-by-step method for building a register that works.
The regulatory position
The authorisation conditions
For an authorised payment institution (API), regulation 6(6) of the PSRs 2017 requires the firm to satisfy the FCA that it has robust governance arrangements with clear lines of responsibility; effective procedures to identify, manage, monitor and report the risks to which it might be exposed; and adequate internal control mechanisms, including sound risk management procedures. These must be comprehensive and proportionate to the nature, scale and complexity of its payment services.[4] Regulation 6(5) of the EMRs 2011 imposes the equivalent condition on authorised EMIs.[5]
These are continuing conditions, not a one-off test at authorisation. The FCA can cancel an authorisation where a firm no longer meets them, and a 2026 FCA first supervisory notice against an e-money firm cited concerns under both provisions.[6] At application, Schedule 2 to the PSRs 2017 requires a description of these arrangements, and the EBA’s authorisation guidelines (EBA/GL/2017/09) ask applicants for a mapping of the risks they have identified, with the procedures they will use to assess and prevent them.[7] The FCA expects firms to continue to apply EBA guidelines to the extent that they remain relevant.[8]
The other rules your register must reflect
The register is also where several other obligations meet. The table below shows the main ones and what each means for the register’s content.
| Source | What it requires | What the register should show |
|---|---|---|
| Principle 4 (PRIN 2.1.1R) and FG20/1 [9][10] | Adequate financial resources, assessed through risk identification and stress testing | Quantified exposures for material risks, feeding capital and liquidity assessments |
| MLRs 2017, regs 18 and 19; JMLSG Part I, chapter 4 [11][12] | A written firm-wide assessment of money laundering and terrorist financing risk, and policies and controls to mitigate it | Financial crime risks consistent with, and cross-referenced to, the business-wide risk assessment |
| Consumer Duty, PRIN 2A, including PRIN 2A.2.8R [13] | Avoid causing foreseeable harm to retail customers | Customer-harm risks, such as pricing transparency and vulnerable customers, with outcomes MI |
| SYSC 15A [14] | Identify important business services, set impact tolerances, map and test | Operational and third-party risks linked to each important business service |
| CASS 15, from PS25/12 [3][15] | Safeguarding reconciliations, a resolution pack, safeguarding audits and monthly returns | Safeguarding risks with reconciliation and audit indicators |
| PSRs 2017, regs 25 and 36; EMRs 2011, reg 36 [16][17] | Outsourcing must not delegate senior management’s responsibility; the firm is responsible for outsourcers, agents and distributors | Third-party risks retained on the register, with oversight controls |
| PS26/2 [18] | Operational incident reporting for payment service providers from 18 March 2027 | Impact scales consistent with incident reporting thresholds |
A note on SMCR
Firms authorised or registered only under the PSRs 2017 or the EMRs 2011 are outside SMCR. Do not label risk owners with Senior Management Function or Certification Regime terms unless the firm also holds a Part 4A permission. For a PI or EMI, the equivalent expectation comes from the requirement in reg 6(6)(a) for a clear organisational structure with well-defined, transparent and consistent lines of responsibility, and from the fitness and propriety of the persons responsible for its management.
What we see in practice
In the firms we have reviewed, the same weaknesses recur. None of them is exotic, and all of them are fixable.
- Template registers. Risks are copied from a generic template, with descriptions that could apply to any firm. The business model, the corridors served and the customer base are nowhere to be seen.
- Unevidenced residual scores. Residual risk is marked down because a control exists on paper, not because anyone has tested it.
- Transferred risks deleted. Outsourced functions and insured exposures are removed from the register, even though the firm remains responsible for them.
- Two versions of the truth. The MLRO’s business-wide risk assessment and the enterprise register score the same financial crime risks differently, and nobody has reconciled them.
- No link to appetite or capital. Scores are not measured against a board-approved risk appetite, and nothing in the register feeds the assessment of capital, liquidity or wind-down triggers.
- Owners who have left. Risks are assigned to named individuals rather than roles, so ownership lapses when people move on.
- Static reporting. The board sees a heat map each quarter with no movement, trend or overdue actions, so it has nothing to challenge.
These points echo the FCA’s own findings: limited oversight and challenge of first-line staff, risk appetites not grounded in the firm’s activities, and wind-down plans disconnected from the risk management framework.[1]
Building the register: a step-by-step method
The method below works for a start-up API as well as an established EMI. What changes with scale is the depth of each step, not the structure.
Step 1: Set the frame with risk appetite
A register without a risk appetite can only rank risks against each other; it cannot tell the board whether any of them is acceptable. Before you score anything, ask the board to approve a risk appetite statement for each risk category. Each statement should combine a qualitative position, such as ‘no appetite for safeguarding shortfalls’, with measurable limits that you can monitor.
The FCA’s good practice is an appetite agreed at board level, reviewed at least annually, with quantitative elements calibrated through risk assessment and stress testing.[1] Resist the temptation to set financial resource appetite at the regulatory minimum. The FCA specifically identified that as an area for improvement.
Step 2: Build a taxonomy that fits a payments business
Categories keep the register navigable and make board reporting possible. The taxonomy below is our suggested starting point for a PI or EMI. Adapt it to your permissions and business model rather than adopting it wholesale.
| Category | Typical sub-categories |
|---|---|
| Safeguarding | Reconciliation breaks; failure of a safeguarding bank or insurer; commingling; resolution pack readiness |
| Financial crime | Money laundering and terrorist financing; sanctions; fraud, including APP fraud; bribery and corruption |
| Prudential | Own funds; liquidity; foreign exchange; credit and counterparty; settlement |
| Operational and resilience | IT and cyber; important business services; data; change management; key persons |
| Third party | Outsourcing; agents and distributors; banking partners; card schemes and payment systems |
| Conduct and Consumer Duty | Product value; pricing transparency; vulnerable customers; complaints handling |
| Regulatory and legal | Regulatory change; regulatory reporting; permissions perimeter; contractual risk |
| Strategic and group | Business model; concentration; group dependencies; reputation |
Keep group risk explicit. The FCA found firms relying on group risk appetites, limits and triggers without checking whether they suited the regulated entity.[1]
Step 3: Identify risks and write them properly
Risk identification is a first-line activity supported by the second line. Draw on process walk-throughs with each function, incident and error logs, complaints data, safeguarding reconciliation breaks, audit findings, FCA publications and the change pipeline. Every new product, corridor, partner or technology change should trigger a risk review before launch.
Write each risk as cause, event and consequence. ‘Operational risk’ is a category, not a risk. A usable statement reads: because reconciliation relies on manual extraction from two banking portals (cause), a safeguarding shortfall may go undetected (event), leading to customer detriment on insolvency and a breach of CASS 15 (consequence). Someone who does not own the risk should understand it without asking.
Step 4: Score inherent risk on defined scales
Score likelihood and impact from 1 to 5 before taking account of controls. Write the scales down, or two people will score the same risk differently. Anchor impact to what matters in payments: money lost, customers harmed and regulatory consequences. Calibrate the financial bands to your own funds and liquid resources, not to someone else’s template. The scales below are illustrative.
| Score | Likelihood (next 12 months) | Impact (highest applicable dimension) |
|---|---|---|
| 1 | Rare: not expected; no internal or peer history | Negligible: immaterial loss; no customer detriment; no reportable breach |
| 2 | Unlikely: could occur; isolated history in the sector | Minor: loss well within appetite; a few customers briefly inconvenienced |
| 3 | Possible: has occurred at the firm or its peers | Moderate: loss that erodes headroom; detriment needing remediation; reportable breach |
| 4 | Likely: expected to occur during the year | Major: loss threatening own funds or liquidity headroom; widespread detriment; FCA intervention likely |
| 5 | Almost certain: occurring now or repeatedly | Severe: threatens viability or triggers wind-down; safeguarding shortfall; enforcement likely |
Multiply the two scores to give a rating out of 25, and band the results consistently. Our illustrative bands are 1 to 4 Low, 5 to 9 Moderate, 10 to 14 High, and 15 to 25 Very high. If your board wants every severe-impact risk escalated whatever its likelihood, add an explicit rule that any impact score of 5 is reported as at least High, and record why. A deliberate, documented rule is defensible; a matrix that is lopsided by accident is not.
Step 5: Map controls and test them
For each risk, record the controls that mitigate it: what each control does, whether it prevents or detects, who operates it, how often, and what evidence it leaves. Then record when it was last tested, by whom, and the result.
This is the discipline most registers lack. Only reduce the residual score for controls that have been tested and found effective. A control that exists only in a policy is a design, not a mitigation. Where testing has not yet happened, leave the residual score at or near the inherent score and show the test as an open action.
Step 6: Assess residual risk against appetite
Score residual risk on the same scales and compare it with the appetite for that category. Where residual risk sits outside appetite, the register must show the treatment decision: reduce it with new or stronger controls; avoid it by changing the activity; transfer it through insurance or contract, with the firm still accountable; or accept it through a documented decision of the appropriate governance body, with a review date.
Accepted and transferred risks stay on the register. Where you avoid a risk by exiting an activity, archive the entry with the rationale rather than deleting it. The audit trail is part of your evidence.
Step 7: Attach key risk indicators and triggers
Scores are periodic judgements. Key risk indicators (KRIs) show movement between reviews. Give each material risk at least one measurable indicator, with thresholds tied to appetite. Examples for a payments firm include:
- unresolved safeguarding reconciliation differences, by age;
- customer due diligence reviews overdue, and alerts outstanding beyond their service level;
- fraud losses and APP fraud reimbursement costs against appetite;
- availability of important business services against impact tolerances;
- headroom of own funds and liquid resources over requirements;
- complaint volumes and root causes, including complaints from customers in vulnerable circumstances;
- agent and distributor monitoring overdue.
Use the same thresholds in the wind-down plan. The FCA found wind-down triggers that were inconsistent with the risks in the risk management framework and not quantified by reference to appetite, and triggers that ignored safeguarding shortfalls or lapsed safeguarding insurance.[1]
Step 8: Quantify the material risks
For the risks that could genuinely damage the firm, go beyond the heat map. Estimate losses under severe but plausible scenarios, and use stress testing and reverse stress testing to check whether financial resources are adequate. FG20/1 sets out the FCA’s expectations,[10] and the multi-firm review found firms relying on judgement rather than quantitative methods.[1] Treat liquidity separately from capital: the FCA identified firms that did not distinguish between them.
The minimum fields
| Field | Why it matters |
|---|---|
| Risk ID and category | Traceability and reporting by category |
| Risk statement (cause, event, consequence) | Understood by someone who does not own the risk |
| Risk owner (a role, not a name) | Ownership survives staff changes |
| Inherent likelihood, impact and rating | Prioritisation before controls |
| Controls, with type, operator, frequency and evidence | Shows how the risk is actually mitigated |
| Date of last test, tester and result | Justifies any reduction in the residual score |
| Residual likelihood, impact and rating | Current exposure |
| Appetite and status (within or outside) | Drives escalation |
| KRIs and thresholds | Shows movement between reviews |
| Treatment decision and actions, with owners and dates | Accountability for remediation |
| Links to the business-wide risk assessment, important business services, wind-down triggers and policies | One version of the truth |
| Date last reviewed and next review date | Evidence of ongoing monitoring |
A worked example
The entry below is illustrative, not drawn from any firm.
| Field | Example entry |
|---|---|
| Risk ID and category | SAF-03, Safeguarding |
| Risk statement | Because reconciliations rely on manual extraction from two banking portals, a shortfall in safeguarded funds may go undetected, causing customer detriment on insolvency and a breach of CASS 15. |
| Owner | Head of Finance |
| Inherent rating | Likelihood 3 × Impact 5 = 15 (Very high) |
| Controls | Reconciliation each reconciliation day with documented sign-off (detective); four-eyes review of breaks above a set threshold (detective); automated statement feed (preventive, planned) |
| Testing | Second-line sample test last quarter found missing sign-offs |
| Residual rating | Likelihood 3 × Impact 5 = 15 (Very high): not reduced, because testing found gaps |
| Appetite and status | No appetite for safeguarding shortfalls: outside appetite |
| KRIs | Unresolved breaks older than one reconciliation day; missed sign-offs each month |
| Actions | Implement the automated feed (Head of Finance, end of Q4); retest one month later (Compliance) |
| Links | Resolution pack; wind-down trigger for safeguarding shortfall; important business service: customer payments |
The point of the example is the residual rating. The controls exist, but testing found gaps, so the rating does not move until the gaps are closed and retested.
Governance, the three lines and reporting
A common misconception places the board in the ‘third line of defence’. In the standard model, now published by the Institute of Internal Auditors as the Three Lines Model, the board is the governing body. It sits above the lines and is accountable for oversight. The first line is operational management, the second line is risk and compliance, and the third line is independent assurance from internal audit.[19] The distinction matters: a board that sees itself as a ‘line’ tends to wait for assurance rather than set appetite and challenge.
For a PI or EMI, this usually means the following. The first line owns and operates controls and reports incidents and emerging risks. The Compliance Manager, and the MLRO for financial crime, maintain the register, set the methodology, challenge scores and test controls. Internal audit, often outsourced in smaller firms, gives independent assurance on the framework. The board approves appetite, reviews the register and decides where resources go.
Board reporting should show movement, not just position: the top risks and their trend, risks outside appetite, KRI breaches, overdue actions, new and emerging risks, and the results of control testing. We recommend reviewing the full register at least annually and material risks at least quarterly, with an out-of-cycle review after any significant incident, new product or corridor, change of key partner or relevant regulatory change.
Where firms disagree
Spreadsheet or GRC software?
A well-controlled spreadsheet is adequate for many smaller firms, and it is transparent. Governance, risk and compliance (GRC) software adds workflow, audit trails and KRI feeds, but it can also create a false sense of maturity. Choose according to how many risks, owners and data sources you have, not how the tool looks in a demonstration.
One register or two?
Some MLROs prefer the business-wide risk assessment under MLRs reg 18 to stand alone, because it has its own statutory content and audience. Others fold it into the enterprise register. Either can work. What cannot work is two assessments that score the same financial crime risk differently. If you keep them separate, cross-reference them and reconcile the scores at each review.
Is inherent risk worth scoring?
Critics argue that inherent risk is hypothetical, because no firm operates without controls, and that it invites inflated scores to flatter control effectiveness. The counter-argument is that it shows the board what depends on controls continuing to work. On balance we keep it, because it shows where control failure would hurt most, and therefore where testing effort belongs.
Does a 5 × 5 matrix mislead?
Likelihood and impact scores are ordinal labels, not measurements, so multiplying them has limits. Two risks rated 12 may be very different. That is why Step 8 matters: for material risks, the rating directs attention, and quantification then informs decisions.
Proportionality for smaller firms
Small payment institutions, small EMIs and registered account information service providers are subject to different registration conditions from their authorised counterparts, so check the provisions that apply to your permission. However, the MLRs 2017 risk assessment requirements apply in full to firms within their scope, the Consumer Duty applies to payments firms dealing with retail customers, and a firm without a working view of its risks will struggle to grow into authorisation. A proportionate register for a small firm can be short and held in a simple spreadsheet. It still needs an appetite, tested controls and board review.
Action plan
Apply these steps in order. The timings are our suggested targets; adjust them to your risk profile and board calendar.
| # | Action | Owner | Target |
|---|---|---|---|
| 1 | Obtain board approval of risk appetite statements for each category, with measurable limits | Board, on a Compliance draft | Next board meeting |
| 2 | Rebuild the taxonomy and rewrite risk statements as cause, event and consequence | Compliance, with first-line owners | 1 month |
| 3 | Replace named owners with roles and obtain each owner’s acceptance | Compliance; CEO to confirm | 1 month |
| 4 | Reinstate outsourced, agent, distributor and insured risks, with oversight controls | Compliance, with outsourcing owners | 1 month |
| 5 | Adopt written likelihood and impact scales calibrated to own funds and liquid resources | Compliance and Finance; board approval | 1 month |
| 6 | Reconcile the MLRs reg 18 business-wide risk assessment with the register | MLRO | 2 months |
| 7 | Record every control with its evidence, schedule second-line testing and reset residual scores for untested controls | Compliance; MLRO for financial crime | 3 months |
| 8 | Define KRIs and align their thresholds with wind-down triggers and the liquidity framework | Compliance and Finance | 3 months |
| 9 | Quantify material risks through stress and reverse stress testing | Finance, with Compliance challenge | 6 months |
| 10 | Redesign board risk reporting to show trends, breaches, overdue actions and test results | Compliance | Next reporting cycle |
| 11 | Commission independent assurance on the risk management framework | Board or audit committee | 12 months |
Frequently asked questions
Do the PSRs or EMRs require a risk register by name?
No. They require effective procedures to identify, manage, monitor and report risks (PSRs 2017, reg 6(6); EMRs 2011, reg 6(5)). A register is the conventional and most practical way to evidence that, and a supervisor will expect to see one or an equivalent.Who should own the risk register?
Day-to-day maintenance usually sits with the Compliance Manager or a second-line risk function, with the MLRO owning financial crime risks. Each individual risk is owned by the first-line role that manages it. The board owns the risk appetite and the overall framework.How often should the register be reviewed?
We recommend a full review at least annually, material risks at least quarterly, and an out-of-cycle review after any significant incident, launch or regulatory change. Your risk profile may justify more frequent review.Can we remove a risk once we have outsourced the activity?
No. PSRs 2017 reg 25 prevents outsourcing from delegating senior management’s responsibility, and reg 36 of the PSRs 2017 and of the EMRs 2011 makes the firm responsible for its outsourcers, agents and distributors. Keep the risk and add oversight controls.Can our MLRs business-wide risk assessment double as the register?
Only for financial crime. The register must be enterprise-wide, covering prudential, safeguarding, operational, conduct and strategic risks as well.
How Compliance Consultant can help
Compliance Consultant reviews and rebuilds risk management frameworks for payment and e-money firms as part of our regulatory risk management and compliance monitoring work. We can review your register against the FCA’s published expectations, test your key controls and help you give your board a framework it can use. Book a discovery call to talk it through.Book a discovery call
Or call us: UK 0800 689 0190 | International 020 8243 8620
Making Compliance Work
References
- FCA, Risk management and wind-down planning at e-money and payments firms – multi-firm review (published 26 June 2025). https://www.fca.org.uk/publications/multi-firm-reviews/risk-management-wind-down-planning-emoney-payments-firms
- FCA, Regulatory Priorities: Payments (25 March 2026). https://www.fca.org.uk/publication/regulatory-priorities/payments-report.pdf
- FCA, PS25/12: Changes to the safeguarding regime for payments and e-money firms (August 2025). https://www.fca.org.uk/publications/policy-statements/ps25-12-changes-safeguarding-regime-payments-and-e-money-firms
- The Payment Services Regulations 2017 (SI 2017/752), regulation 6. https://www.legislation.gov.uk/uksi/2017/752/regulation/6
- The Electronic Money Regulations 2011 (SI 2011/99), regulation 6. https://www.legislation.gov.uk/uksi/2011/99/regulation/6
- FCA, First Supervisory Notice (2026), citing EMRs 2011 reg 6(5) and PSRs 2017 reg 6(6). https://www.fca.org.uk/publication/supervisory-notices/first-supervisory-notice-paywiser-limited-2026.pdf
- EBA, Guidelines on authorisation and registration under PSD2 (EBA/GL/2017/09), Guideline 8. https://www.eba.europa.eu/documents/10180/2015792/bc615f5f-bd3a-4105-a81f-a4a3733af11a/Guidelines%20on%20Authorisations%20of%20Payment%20Institutions%20(EBA-GL-2017-09)_EN.pdf
- FCA, Payment Services Regulations 2017 and Electronic Money Regulations 2011 (application of EBA guidelines). https://www.fca.org.uk/firms/payment-services-regulations-e-money-regulations
- FCA Handbook, PRIN 2.1 The Principles (Principle 4). https://www.handbook.fca.org.uk/handbook/PRIN/2/1.html
- FCA, FG20/1: Our framework: assessing adequate financial resources (June 2020). https://www.fca.org.uk/publications/finalised-guidance/fg20-1-assessing-adequate-financial-resources
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 18. https://www.legislation.gov.uk/uksi/2017/692/regulation/18
- Joint Money Laundering Steering Group, Guidance, Part I, chapter 4 (risk-based approach). https://www.jmlsg.org.uk/
- FCA Handbook, PRIN 2A.2 Cross-cutting obligations. https://handbook.fca.org.uk/handbook/prin2a/prin2as2
- FCA Handbook, SYSC 15A Operational resilience. https://www.handbook.fca.org.uk/handbook/SYSC/15A/
- FCA, Payment Services and Electronic Money – Our Approach (May 2026 version). https://www.fca.org.uk/publication/finalised-guidance/payment-services-electronic-money-approach.pdf
- The Payment Services Regulations 2017, regulations 25 and 36. https://www.legislation.gov.uk/uksi/2017/752/regulation/25
- The Electronic Money Regulations 2011, regulation 36. https://www.legislation.gov.uk/uksi/2011/99/regulation/36
- FCA, PS26/2: Operational incident and third party reporting (18 March 2026). https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting
- The Institute of Internal Auditors, The IIA’s Three Lines Model. https://www.theiia.org/ThreeLines
Disclaimer: This report provides general information on UK regulatory requirements as at 21 September 2026. It is not legal or regulatory advice and should not be relied upon as such. Firms should take advice specific to their circumstances.
Compliance Consultant | https://complianceconsultant.org | UK 0800 689 0190 | Int’l 020 8243 8620 | Discovery call: https://bit.ly/CCDiscovr
Compliance Consultant and Compliance Doctor are trading styles of UK Compliance Consultant Limited, Companies House number 14805896.
