UK Regulator Updates Guidance On The Approach To Payment Services And Electronic Money

On July 6, 2018, the U.K. FCA updated its Approach Document on payment services and electronic money, to reflect final guidelines issued in December 2017 by the EBA on security measures for mitigating operational and security risks under the revised Payment Services Directive. The changes will affect all payment service providers. The FCA has also updated its webpage on reporting requirements for payment services providers and e-money issuers to reflect these changes. The webpage includes a link to the revised version of the FCA's REP018 (operational and security risk) reporting form.

The FCA will expect payment services providers to comply with the EBA guidelines, which cover issues such as operational and security risk management framework governance, the use of models, outsourcing and how functions, processes and assets should be identified, classified and risk-assessed. The EBA guidelines also cover security of data integrity, systems and confidentiality as well as physical security and asset control and communication of the security measures to payment service users. PSPs will be expected to report at least annually to the FCA on their operational and security risk management frameworks

The updated Approach Document shows tracked changes from the previous version. The key changes in the...