Somebody has just told you that the firm holding your company's money is an authorised payment institution and not a bank. The reasonable next question is whether that is a problem.
Short answer: no, but it is a difference, and the difference is worth understanding properly rather than being reassured about. An authorised payment institution is a regulated firm with a specific permission, a specific obligation about how it holds your money, and a specific gap where deposit protection would be. Everything useful follows from those three facts.
Most of what ranks for this phrase is written for firms applying for the licence. This is the version for the business on the other side of it.
What an authorised payment institution is
In the UK a firm can provide payment services without being a bank, but it cannot do so unregulated. The FCA recognises three non-bank provider types: electronic money institutions, authorised payment institutions, and small payment institutions, and all of them must be authorised or registered before they can operate.
An authorised payment institution, usually shortened to API, is the middle one. It is permitted to provide payment services at scale. It is not a bank, it does not hold deposits, and it does not come with the compensation scheme that deposits get.
Start there, because most of the confusion in this area comes from the word account. A payment account at an API and a deposit account at a bank both look like an account in an app. They are different legal things.
What the status permits, and what it does not
The Payment Services Regulations catch a wide set of firms: banks and building societies, e-money issuers, money remitters, non-bank card issuers and merchant acquirers, and providers of account information and payment initiation services. If you provide payment services as a regular business in the UK, you must apply to become an authorised payment institution, a small payment institution, or a registered account information service provider, unless you are already another kind of payment service provider or are exempt.
So the status is a permission to move money for other people. It is not a permission to take deposits, and that is the part worth sitting with.
A bank takes your deposit and lends it out. That is the business model, and deposit protection exists because the money is genuinely at risk in it. An API does not do that. Your balance is not funding anyone's mortgage book. The trade is straightforward once you see both halves: no lending risk on your money, and no statutory compensation scheme either.
API, EMI, SPI or bank: the differences that matter
Four labels, and the practical differences come down to three questions.
Does the FSCS cover it? Only the bank. For firms failing from 1 December 2025, the FSCS limit is 120,000 GBP per eligible person per authorised firm. EMIs, APIs and SPIs are all outside it.
Must it safeguard your money? EMIs and APIs must. Small payment institutions are not required to, though they may choose to. That is the single most under-appreciated line in this whole area: two firms can both be FCA-registered and only one of them has to ring-fence your balance.
Can you complain to the Ombudsman? Yes, for all four.
The difference between an EMI and an API is narrower than it sounds. An EMI issues electronic money and may also provide payment services; an API provides payment services without issuing e-money. From a customer's point of view the protections are the same. The difference that changes your risk is API or EMI versus SPI, and bank versus everything else.
How an authorised payment institution must hold your money
This obligation is called safeguarding, and it is not vague. Regulation 23 of the Payment Services Regulations 2017 requires an authorised payment institution to keep relevant funds segregated from any other money it holds. If it still has them by the end of the business day after receipt, it must place them in a separate designated account with an authorised credit institution or the Bank of England, or invest them in secure liquid assets approved by the FCA and held with an authorised custodian. The account must be designated so it is visibly a safeguarding account, and no one other than the institution may have an interest in it.
There is a second permitted method, an insurance policy or comparable guarantee, but in practice segregation is used by more than 95 percent of firms, and the firm must obtain an acknowledgement letter from the account bank confirming it cannot offset the institution's debts against that account.
That is a real protection, and it has a real limit. Safeguarding preserves a pool; it does not guarantee an amount. When a firm fails, an insolvency practitioner must identify and reconcile the pool before distributing it, and the cost of that work comes out of the pool. FCA data on EMI insolvencies between 2018 and 2023 shows customers recovering an average of 35p in the pound.
Read that number carefully. It is not evidence that the rule fails. It is evidence that firms which collapse tend to be the same firms whose records were not good enough to reconcile quickly, which is why the rules changed.
What changed on 7 May 2026
The FCA's Supplementary Regime, introduced by policy statement PS25/12, is in force from 7 May 2026. It adds four obligations, and each one attacks the reconciliation problem directly.
Firms must now reconcile safeguarded funds against customer balances daily, topping up any shortfall from their own capital the same day. They must file a monthly safeguarding return to the FCA, which gives the regulator near real-time visibility rather than an annual snapshot. They must arrange an annual audit by a qualified auditor, unless they have never been required to safeguard more than 100,000 GBP over a 53-week period. And they must keep a resolution pack covering every location of funds, deliverable to an insolvency practitioner within 48 hours.
Daily reconciliation shrinks the shortfall. The resolution pack shrinks the delay. Together they are aimed squarely at the months-long administrations that produced the 35p figure.
None of this converts safeguarding into FSCS cover. It does mean that a firm authorised today operates under materially tighter rules than the firms in that dataset did.
How to check one in two minutes
- •Search the FCA register by firm name or firm reference number and read the permissions. Every authorised firm has an FRN.
- •Confirm which category it holds. API, EMI and SPI are not interchangeable, and only the first two must safeguard.
- •Work out whether the firm you are contracting with is the authorised one or a distributor acting on its behalf. If it is a distributor, the FRN that matters belongs to the principal.
- •Ask which credit institution holds the safeguarding account.
- •Ask when the last safeguarding audit was completed, and whether the firm is above or below the audit threshold.
Point three is where most people stop too early, so here is a worked example using our own structure. EXFI is a trading name of EX Financial Solutions Ltd, company number 17105188, which is not itself authorised or regulated by the FCA and acts as a distributor of payment services provided by Gemba Finance Ltd, authorised and regulated by the FCA as a payment institution under FRN 804853. EXFI accounts are payment accounts, not bank accounts. They are not FSCS covered. Funds are safeguarded in segregated accounts under the Payment Services Regulations 2017.
That paragraph is the answer to questions one through three for us. Ask any provider for their version of it. A firm that can produce it in one sentence has thought about your due diligence; a firm that answers with a badge on a homepage has not.
Once you know what kind of firm holds the money, the next decisions are practical: choosing a multi currency business account on rails and real cost, and, for groups running several entities, treasury tooling for groups with several entities.
FAQ
Is an authorised payment institution safe? It is regulated and legally required to ring-fence client funds, but it is not a bank and carries no FSCS cover. How safe it is in practice depends on the quality of its safeguarding compliance, which is exactly what the May 2026 rules tightened.
What is the difference between an authorised payment institution and an EMI? An EMI issues electronic money and may also provide payment services. An API provides payment services without issuing e-money. For a customer the protections are the same: both must safeguard, and neither is covered by the FSCS.
Does a small payment institution have to safeguard my money? No. SPIs are not required to safeguard, although they can choose to and must then meet the same standard as an API. If a provider is an SPI, ask directly what protection is in place before you fund the account.
Can I complain to the Financial Ombudsman about a payment institution? Yes. Access to the Financial Ombudsman Service applies to EMIs, APIs and SPIs as well as to banks. It is the one protection that does not change with the licence type.
Which firm is authorised behind EX FI? Gemba Finance Limited, FCA FRN 804853, provides the regulated payment services for UK customers. EX Financial Solutions Ltd, trading as EXFI, is the distributor and is not itself FCA authorised.