Which FCA Permissions Does Your Wallet, Card or BNPL Product Need? A Guide for UK Brands and Founders
Short answer: most UK brands and early-stage founders do not need their own FCA authorisation to launch a wallet, card or BNPL product. They work through an authorised firm, as its agent, as a distributor of its e-money, through a card programme, or by offering an authorised lender's credit, and that firm stays responsible for the regulated activity. Own authorisation makes sense only when financial services become the core of the business.
"Do we need to be regulated?" is usually the first question a brand or founder asks about a financial product, and it is often asked too late, after the product has been designed. The answer shapes the architecture, the partner choice, the timeline and the compliance work an MVP has to carry. This guide maps the main routes to market, what each one asks of you, and what any UK fintech MVP should design in from the first sprint, whichever route you take.
This is general guidance, not legal advice. Innovify builds for regulated clients but is not itself an FCA-authorised firm, so confirm your obligations with a regulatory adviser.
Five routes to market for a regulated financial product
- Agent of an authorised firm: licence held by the principal (payment or e-money institution); the brand owns product, customer journeys, payment services on the principal's behalf. Typical use: payments or wallet features inside a brand's app.
- Distributor of e-money: licence held by the e-money institution; the brand owns marketing, loading and redeeming value. Typical use: stored-value and loyalty wallets.
- Card programme: licence held by the issuer (bank or e-money institution); the brand owns proposition, rewards, controls and experience. Typical use: branded prepaid or debit cards.
- Offering an authorised lender's credit: licence held by the FCA-authorised lender; the brand owns checkout experience and presentation. Typical use: BNPL or instalments at checkout.
- Own authorisation: licence held by the brand itself; the brand owns everything, including the regulatory obligations. Typical use: financial services as the core business.
Agents and distributors: renting the regulated core
The FCA's perimeter guidance sets out the distinction between agents and distributors, and most brand wallets and payment features sit on one side of it.
Agents
An authorised payment institution or e-money institution can appoint agents to provide payment services on its behalf. The principal registers each agent with the FCA, and the agent does not need its own authorisation. The principal remains responsible for the agent's compliance, including conduct of business requirements and anti-money laundering controls, and must keep reviewing them throughout the appointment.
Distributors
A distributor markets, loads or redeems e-money on behalf of an e-money institution. Only the institution can issue e-money, and a distributor cannot provide payment services. The line between the two roles is not always obvious, so the arrangement and the activities actually carried out have to be looked at case by case.
What the principal will ask of you
Because the principal carries the responsibility, it will scrutinise how you onboard customers, present the product, handle complaints and treat vulnerable customers. The Consumer Duty applies to how the product reaches customers, and principals are expected to be able to change how their agents and distributors present services. A brand that can show this evidence early moves through partner onboarding faster.
Cards and BNPL: two more partner-led routes
A branded card is issued by a regulated bank or e-money institution, often with a card-issuing platform or programme manager running the technology. The brand designs the proposition; the issuer holds the scheme relationship and the regulatory accountability.
For credit, the picture changed on 15 July 2026, when the FCA's regime for deferred payment credit, which covers most interest-free BNPL, took effect. Third-party BNPL lenders must be FCA-authorised, or operating under a temporary permissions regime while seeking authorisation, and must carry out proportionate affordability assessments. HM Treasury's final position was that most credit broking activities relating to BNPL agreements would be excluded from regulation, so most merchants offering a regulated lender's BNPL at checkout do not need credit broking authorisation. A brand building its own credit product needs an authorised lender behind it, or its own authorisation.
When your own authorisation makes sense
Applying to become an electronic money institution or payment institution gives you full control of the product and the customer relationship, and removes dependence on a principal. It also brings capital requirements, safeguarding arrangements, governance, a compliance function and a lengthy application. For most brands and early-stage founders it is a later-stage decision, taken once the product has traction and financial services are becoming the core business. Landbay, the UK buy-to-let lender, is an example of the sequence: Innovify built its investor-ready MVP to FCA requirements from the start, when it had no in-house engineering team, and the platform later supported one of the UK's first Innovative Finance ISAs, delivered in one month.
What compliance every UK fintech MVP should design in
Whichever route you take, some obligations apply to the product from day one, directly or through your partner. Designing for them early is far cheaper than retrofitting them under investor or partner pressure.
Data protection
Under UK GDPR you need a lawful basis for each piece of personal data, data minimisation, retention rules and access controls. Decide in writing which data fields you collect and why; it becomes the foundation of a defensible position.
Payments and e-money rules
Strong customer authentication under the Payment Services Regulations, the UK's implementation of PSD2, shapes login and payment flows. Safeguarding of customer funds, usually handled by your licensed partner, shapes how money moves through your ledger.
Anti-money laundering and know your customer
Onboarding checks, sanctions screening and transaction monitoring are often supplied by your banking-as-a-service partner, but you design the journey around them and need audit trails that show they ran.
The Consumer Duty
The FCA expects firms to deliver good outcomes for retail customers. For a partner-led product, your principal or lender will hold you to that standard in how the product is designed and presented.
AI features
If your MVP uses AI for decisions, recommendations or customer communication, plan for explainability, human review and clear disclosure. The FCA has said it is applying existing frameworks, including the Consumer Duty and senior-manager accountability, to AI rather than creating new rules for agents, and in October 2026 it published examples of good and poor AI practice and asked AI providers to add disclaimers to AI financial advice. For EU-facing products, the EU AI Act applies, and its first harmonised standard, EN 18286:2026 on AI quality management, has now been published.
A practical sequence for founders and product teams
- Name the regulated activity. Write down, in one sentence each, every place your product holds money, moves money, issues a card or provides credit.
- Choose the route. Agent, distributor, card programme, authorised lender or own authorisation, based on scope now and in eighteen months.
- Choose the partner on compliance fit. Its controls become part of your story to investors, banks and regulators.
- Design the evidence in. Structured logs, data ownership, role-based access and a short written governance position from the first sprint.
- Test the position early. Share your compliance approach with the partner before the build is complete, not after.
- Revisit the route as you grow. New products, markets or volumes can change which route fits, so review the decision at each funding round or major launch.
Our AI & ML Development team applies this sequence to AI-native MVPs, and our Embedded Finance & Digital Wallets practice applies it to wallet, card and payments products.
Common misconceptions about FCA permissions
"We are not a financial company, so the rules do not apply to us"
The rules follow the activity, not the industry. A retailer that holds customer balances, moves money or offers credit is touching regulated activity, even if it does so through a partner. The partner-led routes exist so that the brand does not need its own permissions, not so that the activity stops being regulated.
"Our partner handles compliance, so we do not have to think about it"
Your principal, issuer or lender carries the regulatory responsibility, but it will hold you to its standards through contracts, onboarding reviews and ongoing oversight. Poor customer journeys, unclear presentation or missing audit trails on your side become the partner's risk, and partners act on that risk.
"We will sort compliance out after the MVP"
Retrofitting compliance usually means rebuilding data flows, reconstructing audit trails and re-explaining product decisions to partners and investors under time pressure. Designing it in from discovery is faster overall, because it changes what gets built first rather than adding work at the end.
"Getting our own licence will make us more credible"
It can, at the right stage. Before product-market fit, a well-chosen authorised partner and a clean compliance position usually give investors and customers more confidence than a long licence application running in parallel with the build.
Where Innovify fits
Innovify is a London-based fintech specialist that helps brands, platforms and funded founders launch financial products with compliance designed in from day one. We are not a regulated firm and do not give legal advice; we help you choose the right route and partner, and we build the product so that it fits that partner's compliance model and stands up to due diligence.
That approach has carried products from first build to regulated scale. Zilch's regulated BNPL wallet and checkout was delivered in four months to PCI DSS and FCA requirements, and Landbay went from no in-house engineering team to a lending platform built to FCA requirements. If you are planning a wallet, card or credit product, start with our Embedded Finance & Digital Wallets practice.
FAQ
Do I need FCA authorisation to launch a wallet in the UK?
Usually not. Most brands and founders launch a wallet as the agent or distributor of an FCA-authorised e-money institution, which issues the e-money, safeguards funds and stays responsible for the regulated activity. Your own authorisation is only needed if you want to issue e-money yourself.
What is the difference between an agent and a distributor?
An agent provides payment services on behalf of an authorised firm, which registers it with the FCA and remains responsible for its compliance. A distributor markets, loads or redeems e-money for an e-money institution but cannot provide payment services, and only the institution can issue e-money.
Does BNPL need FCA authorisation?
The lender does. Since 15 July 2026, third-party BNPL lenders must be FCA-authorised, or operating under a temporary permissions regime while seeking authorisation. Most merchants offering a regulated lender's BNPL at checkout are excluded from credit broking regulation.
What compliance should a fintech MVP cover?
Most UK fintech MVPs need to cover UK GDPR, strong customer authentication and safeguarding under the Payment Services Regulations, anti-money laundering checks and the Consumer Duty, usually with a regulated partner carrying part of the load. Credit products add affordability checks, and AI features add explainability and human review.
When should a startup apply for its own EMI or payment institution licence?
Usually once the product has traction and financial services are becoming the core business. Own authorisation brings full control but also capital, safeguarding, governance and a lengthy application, so most founders start through a partner and revisit the decision later.
Does the EU AI Act affect a UK fintech MVP?
It can, if the product serves EU customers and uses AI for decisioning, scoring or recommendations. The first harmonised standard under the Act, EN 18286:2026 on AI quality management, has been published, so EU-facing founders should map their AI features against it early.
Conclusion
Regulation decides the shape of a financial product before a line of code is written. For most brands and founders the answer is a partner-led route, with the authorised firm carrying the licence and the brand owning the product and the evidence that it is run well. Name the regulated activity, choose the route and the partner deliberately, and design the compliance evidence in from the first sprint.
