FCA Capital Adequacy Requirements & Prudential Risk Management: 101 Guide for PSPs
There is no explicit requirement for the authorised payment institutions (PIs) to calculate their capital adequacy on a monthly basis. Moreover there is no explicit requirement for the authorised e-money institutions (EMIs) that are providing unrelated payment services to calculate their capital adequacy under method A, B, or C on a monthly basis. But that fact is frequently, and dangerously, misread. The FCA capital adequacy requirements impose a continuous legal obligation: firms must meet their regulatory capital requirement at all times. Not at year-end. Not on filing day. At all times. What that obligation looks like in practice, and why most firms are not meeting it, is the subject of this analysis.
The answer to what “at all times” actually requires in practice can be found in three FCA portfolio letters sent over the past six years, in finalised guidance FG20/1, and in the statutory language of the PSRs 2017 themselves. Taken together, they form an unambiguous picture: annual regulatory reporting is not a substitute for continuous capital adequacy management, and the firms that treat it as such are flying blind for eleven months of every year.
The Silent Breach: Why Annual Filing Is Not Enough
Consider a scenario that is not hypothetical. A growing payment institution files its FSA056 in January. The capital requirement is fixed, calculated on the preceding year’s financial data. Throughout the year, the firm operates at a modest loss- typical for a scaling business investing in headcount and technology. Own funds erode month by month through accumulated losses. Capitalised expenses related to technology development are not eligible for inclusion in capital resources when calculating capital adequacy, compounding the erosion.
By mid-year, own funds have drifted below the regulatory minimum. The firm will not discover this until it prepares the next annual return, because nobody has prepared management accounts or run the capital calculation since January. By July, the firm is in technical breach of Regulation 22 of the PSRs 2017, which requires own funds to be maintained at all times. Nobody inside the firm knows, because nobody has been assigned responsibility for prudential risk management. The next FSA056 is still six months away, and the position is likely to deteriorate further.
This is precisely the pattern the FCA has described in its supervisory work. It is why the regulator has consistently stressed that FCA capital adequacy requirements must be treated as a live, ongoing obligation, not a once-a-year filing exercise.
Six Years of Escalating Regulatory Signals: The FCA’s Three Portfolio Letters
In the past six years, the FCA has sent three major portfolio letters directly relevant to prudential risk in payment and e-money firms. Each tightened the message of the last. Together, they constitute a clear and escalating regulatory signal that the FCA expects firms to manage capital adequacy as a continuous governance obligation, not as an administrative task triggered by an annual reporting cycle.
Letter 1 – July 2020: Capital Adequacy Named as a Standalone Concern
The July 2020 letter was the first to identify capital adequacy as a standalone supervisory concern, prompted by the collapse of Wirecard and the financial pressures of the COVID period. The FCA stated that firms should continue to meet their own funds requirements at all times and have sufficient regulatory capital to be able to incur losses whilst remaining solvent. It expected payment firms to review and remediate their prudential risk management where appropriate.
The 2020 letter also flagged a structural vulnerability that remains relevant today: some rapidly growing payment firms were unprofitable while pursuing market share, making them inherently fragile from a capital perspective. Growth that is not accompanied by adequate capital planning is not growth; it is accumulating risk.
Letter 2 – 16 March 2023: Prudential Risk as a Formal Governance Outcome
The March 2023 letter was the most detailed to date and the most direct in establishing prudential risk management as a formal supervisory outcome. The FCA set out a comprehensive list of what it expected firms to do regularly: ensure they meet regulatory capital requirements, consider the particular financial risks they face, set or review their risk appetite, forecast financial performance under various scenarios, consider holding additional capital above the minimum, and plan financial resources well ahead of time on an ongoing basis.
Critically, the 2023 letter moved prudential risk management from a compliance checkbox into an active, ongoing governance responsibility. The FCA was explicit: firms need to meet regulatory capital requirements at all times and plan well ahead to ensure they have adequate financial resources on an ongoing basis. This may include holding additional capital above the minimum requirement under the PSRs or EMRs. The letter also identified a direct link between poor capital management and disorderly failure, noting that many firms lacked adequate or actionable wind-down plans; a problem that compounds when capital adequacy is already deteriorating.
Letter 3 – 3 February 2025: The Tightening Continues
The most recent letter, signed by Matthew Long (Director of Payments and Digital Assets) under Outcome 3 (Keeping Customers’ Money Safe), continued and tightened the 2023 themes. Its language was precise: firms must ensure effective prudential risk management, meet their regulatory capital requirements at all times, consider and manage the financial risks they face, and plan well ahead to ensure adequate financial resources on an ongoing basis.
The 2025 letter also introduced a notable new nuance: where firms use safeguarding insurance as an alternative to cash segregation, they must factor in the availability and cost of that insurance when assessing their financial resilience. The interaction between safeguarding compliance and capital adequacy (two obligations that many firms manage in separate silos) was made explicit for the first time.
The Escalating Message Across All Three Letters
- 2020: Capital adequacy is a standalone concern; growth without capital discipline creates structural vulnerability.
- 2023: Prudential risk management is a formal governance outcome; wind-down planning is part of capital adequacy.
- 2025: The obligation continues; safeguarding and capital adequacy are interconnected, not separate disciplines.
The Underpinning Framework: FG20/1
All three portfolio letters reference FG20/1 (Our framework: assessing adequate financial resources), published by the FCA in 2020 and still current. FG20/1 is the interpretive foundation for understanding what FCA capital adequacy requirements actually demand at the operational level.
The guidance is unambiguous on one point: capital adequacy is not a fixed, point-in-time calculation. It is a dynamic assessment that must be continuously informed by current business activity, risk profile, and scenario analysis. The FCA expects firms to have appropriate systems, controls, and human resources to measure risks prudently at all times. That language — “at all times” — runs through FG20/1, through Regulation 22, and through all three portfolio letters. It is not rhetorical emphasis. It is a legal and supervisory standard.
Annual Regulatory Returns: The Floor, Not the Ceiling
The annual regulatory returns (FSA056 for authorised PIs, FIN060a for EMIs) are supervisory reporting obligations. They tell the FCA what capital position the firm was in at its year-end. They are not a management framework, and the FCA has been explicit that the regulatory minimum and the annual return represent the floor, not the ceiling.
A firm that only calculates its capital adequacy position once a year at its accounting reference date, and submits FSA056 or FIN060a, is almost certainly in breach of its prudential obligations under the PSRs throughout the rest of the year, even if it passes on filing day. The annual return is backward-looking. The regulatory obligation is continuous. That gap is where breaches occur.
The FCA’s expectation, consistent across all three letters and FG20/1, points toward a minimum monthly internal capital adequacy calculations, and for busier or higher-risk firms, more frequently. The frequency framework the FCA has signalled in its supervisory guidance operates across three distinct cadences:
- Monthly (at minimum): Running own-funds calculations against the applicable method (Method A, B, or C (and the fixed minimum) under the PSRs, or Method D (and the fixed minimum) under the EMRs), updated for actual payment volumes or average e-money issued where the calculation is volume-sensitive. The output should be presented to the board as a standing management information item, showing current headroom above the regulatory minimum and any trend movement.
- Ongoing / Quarterly: Reviewing risk appetite, updating financial forecasts under base and stress scenarios, and considering whether a buffer above the regulatory minimum remains appropriate given the firm’s actual risk profile and growth trajectory.
- Event-Driven: Recalculating upon material changes in business volumes, product launches, significant client losses, funding events, or any change that could affect own funds or the capital requirement calculation.
What Good Practice Looks Like: Three Non-Negotiables
The FCA’s escalating language across 2020, 2023, and 2025 points in one clear direction. Capital adequacy management must be a live governance process, not an annual compliance exercise. The regulator has signalled it will act earlier and more assertively against firms that cannot demonstrate proactive prudential management. Three practices define what good looks like.
1. Monthly Capital Adequacy Calculations as a Governance Item
Finance, risk, and compliance should run the full own-funds calculation against the applicable PSR or EMR method every month, using actual financial data and management accounts for the period. The output should be presented to the board as a standing MI item, showing current headroom above the regulatory minimum and any trend movement.
This should not be a finance-only exercise. The CFO and Head of Compliance should jointly own and sign off on the monthly position. The rationale is simple: capital adequacy under the PSRs and EMRs is both a financial calculation and a compliance obligation. Both functions need to be accountable for it.
2. A Documented Capital Buffer Policy
Well-run firms do not simply aim to meet the regulatory minimum. They maintain a documented buffer policy that sets out the rationale for holding capital in excess of the minimum; for example, to absorb a two-month revenue shock, to cover the cost of winding down, or to reflect the concentration risk in their client base.
The buffer should be reviewed at least annually against the firm’s actual risk profile and updated when the business model changes materially. A buffer policy that was calibrated for a firm processing £50 million per month may be entirely inadequate for the same firm processing £500 million. The FCA’s 2023 letter was explicit that firms should consider holding additional capital above the minimum requirement – that consideration must be documented, not assumed.
3. Forward-Looking Stress Testing Linked to Wind-Down Triggers
Good practice means running at least two forward-looking capital scenarios per year: a base case (projected volumes and revenues, expected costs) and a stress case (for example, a 30% revenue decline, the loss of a key client, a regulatory fine, or the loss of a key banking partner). Both scenarios should be linked directly to the firm’s wind-down triggers, so that capital thresholds automatically connect to the governance actions the board would take in a stress event.
The link between capital adequacy and wind-down planning is not optional. The FCA’s 2023 letter explicitly identified the absence of actionable wind-down plans as a problem that compounds capital adequacy risk. A firm can be technically solvent and still face a disorderly failure if it cannot demonstrate to the regulator, or to an insolvency practitioner, that it has a credible plan for returning customer funds.
What the FCA is Looking for
During supervisory reviews, the FCA will expect to see:
- evidence that capital adequacy calculations are performed at least monthly;
- board papers or MI packs showing capital headroom against the applicable method;
- a documented buffer policy with a clear rationale;
- stress scenarios linked to wind-down triggers; and
- clear ownership of the prudential risk management function at senior management level. Absence of any of these is likely to be treated as a material weakness.
Quick Reference: FCA Capital Adequacy Requirements for PIs and EMIs
Closing Assessment: What “At All Times” Actually Means
The annual FSA056 or FIN060a submission is a backward-looking report to the regulator. It is not a management tool, and it is not a substitute for continuous capital adequacy management. Firms that treat it as their primary (or sole) capital adequacy process are not merely misunderstanding a regulatory nuance. They are in breach of a continuous legal duty and flying blind for eleven months of every year.
The FCA is asking firms to build a forward-looking, ongoing capital adequacy discipline that is embedded in governance, evidenced in board papers, and responsive to real-time changes in the business. Three portfolio letters in six years have said the same thing with increasing specificity and decreasing patience. The supervisory signal is clear: firms that cannot demonstrate proactive prudential management will face intervention earlier and more decisively than they might expect.
For payment institutions and e-money institutions navigating the combined pressures of a tightening regulatory environment, the safeguarding reforms of PS25/12, and the elevated ML/TF risk ratings of the 2025 National Risk Assessment, capital adequacy management is not a separate workstream. It is the foundation on which every other compliance obligation rests. A firm that runs out of capital does not get to implement its safeguarding resolution pack or its AML remediation programme. It fails.
Need Help Navigating the Compliance Landscape?
PSP Lab is a specialist regulatory and compliance advisory firm focused on payment institutions, electronic money institutions, and the broader payments and fintech sector. Our practice covers FCA authorisation, prudential risk management, safeguarding compliance, AML/CTF frameworks, and regulatory change advisory. If you have questions about FCA capital adequacy requirements or building a continuous capital adequacy framework, contact us.
