A resilience programme designed around how payments fail
Payment institutions and electronic money institutions face complex operational dependencies: payment gateways, settlement banks, safeguarding arrangements, fraud controls, identity services, customer support, cloud systems and reconciliation processes. A customer may experience serious harm even when the core platform is technically available if funds cannot move, instructions cannot be reconciled or appropriate communications cannot be issued.
The FCA’s SYSC 15A explicitly includes payment institutions and electronic money institutions, subject to the Handbook’s application provisions. Exact legal status matters. For example, the 2027 material third-party register rules refer to authorised payment and electronic-money institutions, a narrower distinction than the general wording sometimes used for the underlying resilience regime.
Important business service candidates
Depending on the business model, candidate services may include receiving and executing payment instructions, enabling access to e-money, making transfers available to beneficiaries or customers, and supporting necessary customer transactions. These are prompts for analysis, not a definitive list: the firm should identify its services according to consumer harm and regulatory criteria rather than copying a third party’s taxonomy.
Dependencies worth challenging
A card payment flow might share fraud screening, card processor, card network, cloud hosting, identity infrastructure and banking dependencies with other offerings. A service map should show where these overlap and what fallback capacity actually exists. Supplier assurances and service-level targets are inputs, but evidence from real tests and incidents is needed to support confidence.
Scenario examples for payment firms
- A processor failure during peak transaction volume, with merchant and consumer complaints rising.
- A prolonged authentication outage preventing legitimate users from accessing stored value.
- A settlement disruption that creates reconciliation breaks despite an available front end.
- Loss of the usual customer communications channels while high volumes of funds are delayed.
- Simultaneous loss of a supplier and a manual workaround because both use the same staff or identity system.
Each test should define harm metrics, time elapsed, decisions made, actual capacity and the remediation required if the service cannot remain within its tolerance.
How an ongoing programme helps
A managed cadence keeps the IBS inventory, tolerance rationale, supplier maps, testing programme and board evidence aligned with new payment products and operational change. It can also coordinate preparedness for March 2027 incident reporting and, where the firm’s status makes it applicable, material third-party notifications and registers. The legal perimeter is checked separately for each obligation.
Payment-service evidence: translate disruption into customer outcomes
Consider a fictional e-money issuer where customers cannot redeem funds or see balances during a cloud dependency failure. It is tempting to measure only system uptime. An important-service assessment may also need to examine delayed redemptions, affected customer cohorts, complaint volumes, unsuccessful payment attempts, safeguarded-funds operations, reconciliation backlog and the point at which customer harm becomes intolerable. The right metrics must be selected and approved against the firm’s own services and actual data.
The regulatory perimeter must be checked precisely. ‘Payment company’ is a commercial label, not a complete permissions analysis. Payment institutions, electronic-money institutions and registered account information service providers feature within SYSC 15A, subject to its actual application provisions; the March 2027 incident and material-third-party regimes have different population tests.
A useful first exercise may combine a processor outage with a customer-support channel loss so teams cannot solve the exercise simply by restarting a technical platform. The output is a joined-up action log for operations, technology, outsourcing, compliance and senior management—not a statement that a vendor’s SLA guarantees consumer protection.
Frequently asked questions
Are authorised e-money institutions in SYSC 15A?
Yes, electronic money institutions are expressly included, subject to the Handbook’s specific application provisions.
Is safeguarding the same as operational resilience?
No. Safeguarding and resilience can share operational dependencies, but involve different legal requirements and evidence.
Do the 2027 incident rules apply only to large payment firms?
No. The FCA lists payment service providers among the operational incident reporting population; individual requirements need assessment.
A worked processor outage: from events to decisions
The worked fictional payments-provider exercise combines an outsourced gateway outage, a constrained substitute, authentication degradation, transaction backlog and a decision about what information the board actually needs. It includes a downloadable observation log, clear arithmetic and named role ownership rather than made-up client claims.
For reporting obligations, the 2026–2027 source-led tracker separates existing SYSC 15A resilience scope from the broader operational-incident-reporting population and the narrower material third-party reporting population.