Risk Management and Wind-Down Planning in E-Money and Payment Firms: FCA Multi-Firm Review

Posted on: 15 July 2025

Written by: Jonathan Aseervatham

In 2024–25, the Financial Conduct Authority (FCA) conducted a thematic review of 14 e-money and payment firms, assessing their frameworks for enterprise and liquidity risk, as well as their preparedness for an orderly wind-down.

Setting the Scene: Why the FCA Is watching closely

The FCA has been voicing their concerns about the ability of payment sector firms to manage risk and hold sufficient financial resources over the last few years. Following the COVID-19 pandemic and recent market downturns, there is significant concern of firm failure.

Their expectations in respect of prudential risk management and financial resilience have previously been made clear through their Dear CEO letters to the sector, and through overarching guidance in FG20/1 Assessing Adequate Financial Resources and TR22/1 - Wind-Down Planning observations, applicable to all FCA regulated businesses.

Cosegic has observed increasing regulatory scrutiny and higher expectations from the FCA, particularly when reviewing/establishing their financial resource requirements, during both the application for authorisation stage or routine interactions with firms. This has resulted in lower authorisation success rates and time-consuming queries from the FCA.

Balancing risk and growth: why this matters now

One of the FCA’s core objectives is to protect consumers from harm and maintain integrity and stability in regulated markets. While the FCA is also tasked with encouraging growth in UK financial markets, these other objectives may create some tension in these objectives, increasing the administrative burden on firms.

To operate in the UK payments sector, firms need to be able to demonstrate financial stability, have robust risk management frameworks in place and, should it be required, exit the market in an orderly manner without causing significant harm.

These unlegislated requirements are embedded in all firms’ threshold requirements, so the FCA could deem firms in breach of these if they aren’t able to demonstrate that they hold adequate financial resources.

The Payment Services Regulations (PSRs) and Electronic Money Regulations (EMRs) mandate minimum capital requirements, but simply meeting those requirements is not enough. Firms are expected to use documented risk management processes to assess risk scenarios that could lead to significant harm, periods of stress or, in the worst case, threaten their business viability and leading to wind-down.

On the horizon: ICARA expectations for payments firms?

With PSD3 looming, and strong signals from the FCA that payments firms must adopt a more mature approach to risk management, is a formal ICARA (Internal Capital Adequacy and Risk Assessment applicable to MIFID investment firms) coming for payments firms?

It would seem that the expectation is already here, with formal requirements soon to follow. We encourage payments firms to review their approach to risk management to ensure they are well placed to meet these expectations.

The FCA’s findings are consistent with Cosegic’s experience of supporting firms in reviewing/establishing their financial resource requirements, both during their application for authorisation or following scrutiny from the FCA.

🔍 What the FCA found: four critical gaps

1. Risk management frameworks not sufficiently developed

Firms have begun integrating stress tests, but oversight remains weak. Operational staff often manage risks without consistent senior level oversight challenge.
Risk appetites are unclear, poorly defined and rarely supported by data. Quantitative methods and stress testing are underutilised.
Several firms failed to identify all material risks or hold adequate resources.

2. Immature liquidity risk management

Firms typically relied on existing cash balances but lacked deeper stress analysis.
Most did not quantify liquid resources against risk appetite or establish clear liquidity triggers for wind-down scenarios.

3. Group level risks overlooked

Firms neglected dependencies on group resources, especially intra-group funding and services.
Legal enforceability of intra-group liquidity lines was often unsupported by documentation.

4. Wind-Down Plans persistently weak

Of the firms reviewed, few met the FCA's expectations for credible, operable wind-down plans.

Common shortcomings included:

Lack of clarity on repatriating customer funds for insolvency practitioners.
Failure to cover costs such as IT upkeep, redundancies, or professional fees.
Ignoring third-party dependencies in the wind-down process.
Few firms considered insolvent wind-down triggers or when to appoint an insolvency practitioner.
The FCA emphasised the necessity for time-bound cash-flow models, defined wind-down triggers, annual review of their plans, and mapping of group interdependencies.

📌 FCA highlights & expectations

Credible & operable plans: Plans must work under severe stress, backed by data and stress-testing, especially reverse stress tests. Test scenarios must be relevant to the firm’s business model and realistic, not generic or unrelated to probable trigger events.
Liquidity and cash-flow modelling: Detailed, granular analysis of wind-down inflows/outflows, triggering thresholds, and ring-fenced liquidity is essential.
Group interdependencies: Firms must assess and document reliance on group support and ensure UK subsidiaries maintain adequate independent governance. It is likely that a firm with significant dependency on group support will be challenged on its autonomy and ability to manage its regulatory obligations in the UK.

💡 Recommendations for firms

To meet FCA expectations and build resilience, firms should:

Enhance enterprise-wide frameworks: Define quantitative risk appetites, improve senior oversight, and align them with firm activities. Ensure risks are identified and that adequate controls are implemented. Alignment with your risk appetite is crucial and clear identification and assessment of material harms needs to be carried out.
Advance liquidity risk management: Implement stress-testing, set clear liquidity triggers, and quantify resources appropriately.
Map and document group dependencies: Analyse intra-group flows, secure enforceable agreements, and ensure UK governance structures are robust. Outsourcing is permitted but arrangements cannot compromise a regulated firm’s ability to manage its own affairs and meet its regulatory obligations in the UK.
Revise Wind-Down Plans:

Develop detailed cash-flow models covering solvent and insolvent exit scenarios.
Identify and plan for staff, IT, legal, and third-party dependencies.
Set clear triggers, governance arrangements, roles, and external advisor involvement.
Conduct annual reviews, testing, and updates.

✅ Final takeaway

The FCA has found that while some e-money and payment firms have made initial strides, many still lack mature risk frameworks, robust liquidity management, and credible wind-down planning.

Given the FCA’s findings, firms must review and enhance their governance, modelling, and procedural understanding as a priority, to ensure they hold adequate financial resources at all times, and if needed, exit the market in an orderly manner - with customer funds and market stability protected.

We expect further requirements to be confirmed when PSD3 arrives, with the feedback from the FCA pointing towards ICARA-like assessments being required for the payments sector in the near future. Given the focus from the FCA on financial resilience, we advise firms to act sooner rather than later.

How Cosegic can help you

At Cosegic, our experienced teams can help you understand the regulators expectations and build a financial resilience framework tailored to your business. Here’s how we can help your firm:

Policy and framework review Help you create and improve policies and procedures to meet regulatory standards and expectations of financial resilience.	Wind-Down Planning Work with you to develop credible scenarios and stress testing to support a proportionate response to wind-down planning
Risk Management Help you articulate your firm’s risk and controls framework, with practical and proportionate quality assurance and impact assessments.	Health checks and audits Helping you maintain integrity and remain compliant with your obligations and the regulator’s expectations. We ensure you can demonstrate continued high standards of financial probity.

Get in touch

Jonathan Aseervatham

Jonathan is a Director, Head of Financial Resilience, where he specialises in helping our clients to assess their regulatory capital and liquidity requirements; to implement IFPR including developing ICARAs and wind down plans; and to assist with their regulatory reporting obligations.

Contact Jonathan