Latest FCA and PRA fines against a retail bank show little tolerance for poor outsourcing systems and controls.

By Fiona M. Maclean, Christian F. McDermott, Laura Holden, and Charlotte Collins

On 29 May 2019, the FCA and PRA announced that they had fined an independent UK bank for failing to manage its outsourcing arrangements properly between April 2014 and December 2016. The bank received separate fines of £775,100 from the FCA and £1,112,152 from the PRA (resulting in a combined fine of £1,887,252) for breaches of the regulators’ high-level principles for authorised firms, as well as their more detailed rules on outsourcing. Each fine includes a 30% early settlement discount.

The bank was fined by both regulators as the failings resulted in breaches of both regulators’ rules, and went to both regulators’ statutory objectives (specifically, the FCA’s consumer protection objective and the PRA’s objective to promote firms’ safety and soundness). Although both regulators applied the same five-step penalty framework to calculate their penalties, the way in which they applied the framework led to different figures. In particular, because the PRA had previously fined the same bank for outsourcing failures in November 2015, the repeat failure was a significant aggravating factor that led to an uplift in the PRA’s penalty.

From August 2019, certain existing FCA rules and guidance will extend to payment service providers and e-money issuers in a signal that the FCA wants a consistent approach to consumer protection.

By Rob Moulton, Brett Carr, and Frida Montenius

The FCA has published a Policy Statement extending certain rules and guidance to the payment services and e-money sectors, following a Consultation Paper published in August 2018. The extensions concern the FCA’s Principles for Businesses (Principles) and the Banking Conduct of Business Sourcebook (BCOBS), along with new guidance concerning the communication and marketing of currency transfer services. The FCA has made these changes, aimed at payment institutions (PIs), electronic money institutions (EMIs), and registered account information service providers (RAISPs), with a hope to protect consumers by providing a clear and consistent set of rules that firms must abide by.

The PSR will not review the fees and rules set by Visa and Mastercard, but will look at the practice of bundling, and will examine effects on innovation in card-acquiring services.

By Brett Carr, Stuart Davis, and Christian McDermott

Following the publication of its Draft Terms of Reference in July 2018, the PSR has now listened to market feedback and has issued its Final Terms of Reference, marking the launch of its review into whether competition in the supply of card-acquiring services is working well for merchants and consumers.

Card-acquiring services allow merchants to accept payment for goods and services via debit, credit, charge, and prepaid cards. In order to benefit from card-acquiring services, merchants must enter contracts with so-called “merchant acquirers.”

By Andrew Moyle and Stuart Davis

Growth in applications for blockchain and tokenisation, combined with an increasing number of initial coin offerings (ICOs), mean that buyout firms should note developments in this sector.

Why Should PE Be Interested in Blockchain?

A shared blockchain ledger could drive a single interface between a PE fund and its investors, increasing transparency and efficiency, providing real-time updates for LPs on investments, and enhanced investment analytics.

The PSR is to consider whether there is effective competition in the market and makes clear that further reviews of the payments ecosystem could be triggered by its findings.

By Brett Carr, Stuart Davis, and Christian McDermott

The Payment Systems Regulator (PSR) has issued Draft Terms of Reference for a market review into the supply of card-acquiring services.

The PSR will use its powers under the Financial Services (Banking Reform) Act 2013 to carry out the market review in line with its statutory competition, innovation and service user objectives.

Effective competition in the payments market is a focus of the PSR, and this review follows shortly after dawn raids reported by the PSR in February 2018 as part of its first action under the Competition Act 1998.

The FCA has outlined its approach to implementing key standards under the revised Payment Services Directive.

By Christian McDermott, Stuart Davis, Brett Carr, and Charlotte Collins

The FCA has published a statement on its website relating to the European Banking Authority’s (EBA’s) Opinion and draft Guidelines of 13 June 2018 on the Regulatory Technical Standards on Strong Customer Authentication and Common and Secure Communication under PSD2 (the RTS).

Background

The drafting of the RTS, which will apply from 14 September 2019, proved to be one of the most controversial aspects of the revised Payment Services Directive (PSD2) (for background on the RTS, please see Latham’s related Client Alert).

The consolidation of UK payment system operators marks another big step in delivering on the New Payments Architecture.

By Stuart Davis and Brett Carr

What happened?

Operational responsibility for the Bacs and Faster Payments systems, which process a combined £6.3 trillion worth of payments annually, has transferred to the New Payment System Operator (NPSO).

The successful consolidation of the operators (and planned consolidation of the Cheque and Credit Clearing Company in late 2018) has been a key focus for both the Payment Systems Regulator (PSR) and the Bank of England.

New EU anti-money laundering measures have been approved by European legislators.

By Stuart Davis and Charlotte Collins

The European Parliament and Council have finally signed off on the text of the fifth Anti-Money Laundering Directive (known as MLD5).

Overview

The new directive is of particular interest to the FinTech sector as, amongst other things, MLD5 includes measures to increase transparency around more recently developed instruments of payment — namely cryptocurrencies and prepaid cards. Both these instruments lend themselves to anonymity and raise concerns that they could be used to help fund terrorist activities.

MLD5 will lower the threshold for identifying the holders of anonymous prepaid cards from €250 to €150. It will also require know-your-customer (KYC) checks to be performed for remote payment transactions exceeding €50, or if a withdrawal of more than €50 is made.

By Christian McDermott

In recent years, PE firms have been paying to play in the payment processing sector. From Worldpay and Nets, to Bambora and Paysafe, payment processing companies have proven to be attractive investments for European PE. In our view, a wave of regulation in the FinTech sector will unleash further growth potential, and PE firms may be well-positioned to take advantage of this.

Click for larger image.

The number of M&A transactions in the payment services industry has increased in Europe over the past five years, and we believe the sector will remain hot. A wave of regulation has been designed to stimulate competition and encourage new market entrants. Chief among this is EU Directive (EU) 2015/2366 on payment services in the internal market (known as “PSD2” since it replaces the existing EU payment services directive).

Bank of England announces that, for the first time, a non-bank payment services provider has accessed the UK payments system directly.

By Andrew Moyle, Stuart Davis, Charlotte Collins, and Brett Carr

The Bank of England has announced that a regulated payment services provider (PSP) has become the first non-bank direct participant in the UK’s Faster Payments system. This was facilitated by the Bank of England extending settlement account access in its Real-Time Gross Settlement (RTGS) system to non-bank PSPs, which was announced in July 2017 (see Latham’s related blog post). This change enabled non-bank PSPs to access the UK payment schemes that settle in central bank money directly for the first time, rather than needing to “plug in” to these systems indirectly via settlement agent banks.