Ahead of 7 May 2026, payments firms face a shift from deadline compliance to sustained FCA scrutiny, with data-driven supervision set to reshape outcomes.
Most compliance activity in the payments sector over the past twelve months has been calibrated to a single date: 7 May 2026. Gap analyses, reconciliation tooling, resolution packs, and auditor appointments—all framed as a deadline to be met rather than a starting point to be understood.
That framing is understandable. The obligations are real, and the enforcement exposure for non-compliance is immediate. But there is a gap between firms that are technically compliant today and firms that are likely to withstand FCA data scrutiny over the next eighteen months—and that gap is not visible in any rulebook. It becomes visible in the FCA’s dataset, beginning in May.
The measurement instrument
PS25/12 is structured in two stages. The Supplementary Regime—in force from 7 May—overlays existing obligations with codified reconciliation, reporting, and audit requirements. The Post-Repeal Regime, deferred until at least Q4 2027, will replace these with a statutory trust framework modelled on CASS.
The deferral is conditional. The FCA has stated it will review implementation after a full audit cycle and consult on further proposals if the regime is not achieving intended outcomes. This means the firms that perform well in 2026 and 2027 can expect a lighter future framework than those that do not.
The monthly return is the primary data mechanism. From 7 May, every in-scope firm submits a structured return within 15 business days of each month-end. By the time the FCA begins its Post-Repeal consultation, it will have approximately 18 months of structured, firm-by-firm compliance data across the full sector—the first time it has had this level of granularity at a population scale.
Three specific patterns will emerge in that dataset for the first time: reconciliation completion rates across the full population, shortfall frequency and remediation quality, and method and provider concentration risk. Firms with persistent gaps will increasingly become supervisory prioritisation signals.
The supervision model has already changed
Before examining what the FCA intends to build next, it is worth understanding how it is currently using its supervisory toolkit—because that model has already changed materially.
The FCA has moved away from enforcement-led outcomes. Open enforcement operations fell from approximately 220 in 2023 to 124 by October 2025, according to FCA data. In their place: earlier intervention, faster outcomes, and requirements imposed through supervisory tools rather than formal investigations.
Voluntary requirements—effective business restrictions—are the FCA’s primary instrument for firms with identified safeguarding weaknesses. The trajectory from supervisory concern to business restriction can move faster than most firms anticipate. Guavapay, a small EMI, entered compulsory liquidation in January 2026 following a VREQ that prohibited new customer onboarding. The restriction preceded the insolvency by four months—a sequence that illustrates how quickly a safeguarding deficiency can translate into an existential business event rather than a remediation exercise.
The FCA confirmed publicly in its 2025-26 business plan that it expects supervisory cases related to deficient safeguarding to increase in the short term. A safeguarding audit that returns an adverse opinion is not merely a compliance document—it is a supervisory signal that the FCA’s payments team is likely to act on. Firms that treat an adverse finding as an internal remediation matter, without proactive regulatory engagement, are misreading how the system now operates.
Where firms will diverge
The Supplementary Regime is expected to produce visible differentiation across the sector within twelve months. Three groups are likely to emerge.
Group 1 builds real-time data infrastructure: daily reconciliation outputs feed directly into structured monthly returns with no manual assembly. Audit trail is continuous. The three datasets the FCA will compare — reconciliation, return, and audit — are generated from a single source of record. Likely outcome: lower supervisory intensity and a more favourable position in the Post-Repeal consultation.
Group 2 performs reconciliation correctly but documents manually. Returns are assembled close to the deadline, often from spreadsheets that require consolidation across multiple accounts or currencies. These firms are technically compliant at a point in time—but the data patterns they generate accumulate over time. A shortfall identified in month three that was remediated within 24 hours appears materially different in an audit trail than one that required 5 days and 2 escalations. Likely outcome: increasing supervisory friction through 2027.
Group 3 has incomplete or undocumented reconciliation. Returns contain inaccuracies or omissions likely to diverge from audit findings. The FCA’s ability to cross-reference the two data sources—returns and audits—means discrepancies become independent supervisory flags without requiring a formal investigation. Likely outcome: supervisory intervention.
Five board assumptions for 2026-2027
The monthly return is a permanent regulatory record. The FCA is expected to cross-reference returns against audit reports. Inconsistencies are likely to be treated as independent supervisory flags.
An adverse audit finding is a supervisory trigger, not an internal remediation document. Proactive FCA engagement after an adverse finding is the minimum expected response—not optional.
The Post-Repeal Regime will be shaped by what the FCA observes in 2026-2027 data. Firms that perform well can expect a lighter future framework. The FCA has precedent for this: the trajectory of CASS 7 following its initial implementation demonstrated how supervisory intensity modulates based on sector-wide compliance quality.
VREQs can precede insolvency. The Guavapay sequence—supervisory concern, VREQ, liquidation within four months—is not an outlier. It is a template for how the FCA’s current supervisory model operates when safeguarding deficiencies are identified at smaller regulated firms.
The architectural decisions made in 2026 compound. How you build the reconciliation-to-return pipeline, structure board MI, and document shortfall remediation will either reduce or multiply the cost of the Post-Repeal transition.
What this means now
The distinction between Group 1 and Group 2 is not visible today. It will become visible in the FCA’s dataset by early 2027, when patterns across the first six to nine months of submissions begin to compound. The cost of moving from Group 2 to Group 1 is significantly lower now—before the FCA has established its sector baseline—than it will be under active supervisory scrutiny.
The firms that treat 7 May as a deadline will build for one audit cycle. The firms that treat it as the start of an eighteen-month FCA observation window will build for what comes next.
