Cross-border embedded finance through a sponsor or own authorisation

Map who accepts payment instructions, executes transfers, issues monetary value and receives customer funds. A displayed balance can represent payment-account funds or e-money; the balance alone does not determine the permission. Identify who owes the customer and the card issuer before describing the product or its protection. (Payment Services Regulations 2017, SI 2017/752, Schedule 1; Directive 2009/110/EC, art. 2(2); Directive (EU) 2015/2366, art. 18.)

A merchant of record that genuinely resells a product receives its own sale price. Collecting another seller’s receipts requires a separate payment-services assessment. The commercial-agent exclusion requires authority to negotiate or conclude the underlying sale for one side. It does not follow from a billing mandate. (FCA PERG 15.5, Q33A; UK PSRs 2017, Schedule 1, para. 2(b); Irish S.I. No. 6/2018, reg. 4(1)(b).)

In a bank-sponsor model, the bank provides the regulated account or payment service and the brand performs agreed functions. A UK bank’s payment agent does not require the PI/EMI agent registration described below. (FCA PERG 15.4, Q29.)

Follow this path for each function:

• Supply only technical support: use the technical-service route where its conditions hold. The supplier must never possess transferred funds; its own payment-initiation or account-information service falls outside this exclusion. (UK PSRs 2017, Schedule 1, para. 2(j); Irish S.I. No. 6/2018, reg. 4(1)(j).)
• Perform operational work for the institution: document outsourcing, including the principal’s control, audit access and responsibilities. Outsourcing can coexist with a technical role; it does not resolve a separate regulated activity. (UK PSRs 2017, regs. 25 and 36; Irish S.I. No. 6/2018, regs. 30–31.)
• Distribute or redeem the EMI’s e-money: assess the distributor route and its notifications. The EMI remains the issuer. Adding payment services requires an additional role assessment. (Electronic Money Regulations 2011, SI 2011/99, reg. 33; Irish S.I. No. 183/2011, regs. 20–21.)
• Provide payment services on a PI’s or EMI’s behalf: use a properly appointed payment agent. The principal must complete the required registration before those services begin. Bank-sponsored arrangements have a different registration analysis. (UK PSRs 2017, reg. 34; EMRs 2011, reg. 34; FCA PERG 15.4, Q28–Q30; Irish S.I. No. 6/2018, reg. 30.)
• Undertake the regulated service independently: assess the business’s own permission within the applicable territorial scope, including any available exclusion. Change the product or secure that permission before starting the activity. (UK PSRs 2017, reg. 138; EMRs 2011, reg. 63; Irish S.I. No. 6/2018, reg. 6; S.I. No. 183/2011, reg. 6.)

These roles follow the actual conduct. Match customer promises, instruction powers and product screens to the selected role before launch.

For the UK, check the principal’s exact entity, permissions and restrictions on the Financial Conduct Authority (FCA) register. A UK authorised PI must be a UK body corporate with its head office and any registered office in the UK. The EMI rules also permit an overseas company with a UK branch to apply, subject to the remaining conditions. Incorporation alone completes neither route. (UK PSRs 2017, reg. 6(4)–(5); EMRs 2011, reg. 6(4)–(4A).)

An overseas operating company needs a separate territorial assessment. The FCA generally treats payment services supplied entirely from abroad by an overseas-incorporated and located provider as outside the UK authorisation requirement. That guidance does not confer authorised-provider status or decide e-money and deposit-taking questions. Identify where staff and establishments actually perform the service. (FCA PERG 15.6, Q46.)

For an EU launch through Ireland, verify the Irish principal’s permission and complete the applicable passport and agent arrangements before expansion. A UK permission supplies no EU passport. A third-country EMI branch in Ireland has a narrower national route; it does not provide the group with an EU passport. Confirm the overseas agent’s location and supervision with the principal before choosing the entity. (Directive (EU) 2015/2366, arts. 11, 19 and 28; Directive 2009/110/EC, art. 8; Irish S.I. No. 183/2011, regs. 11 and 28(7).)

Check the overseas company’s actual work at home. Ghana’s perimeter can include payment technology and support services. A business in Singapore arranging transfers between foreign countries can fall within its payment-services regime, even without receiving the money there. In Brazil, assess payment functions and currency flows separately. The operating company should document the required permission, applicable exclusion or product change before performing those functions. (Ghana Act 987, s. 7(1)–(2); Singapore Payment Services Act 2019, s. 5 and First Schedule, paras. 2(h) and 3; Brazil Law No. 12,865/2013, arts. 6 and 9–10, and Law No. 14,286/2021, arts. 3 and 14.)

Ask the proposed principal six questions:

1. Which legal entity supplies each service, under which permission, restrictions and territorial coverage?
2. Will it accept the overseas company’s exact role, customers and operating locations, and complete the required registrations?
3. Which entity owes each customer balance, and where does every receipt enter the safeguarding or deposit arrangement?
4. Who decides onboarding, payment release, complaints and incident reporting, and which records prove those decisions?
5. Which bank, processor and card-scheme dependencies must approve the programme, and who can access them during an outage?
6. What happens to customers, funds and records if either party terminates or the principal fails?

Treat a material mismatch as a launch blocker: change the principal, entity, product or target market before enabling the affected activity.

For e-money, the issuer owes redemption. With a direct bank-deposit contract, the bank owes repayment under its terms. A PI remains responsible for its payment-account obligations. Identify that provider in customer terms and screens, including the agency relationship where required. Allocate separate app services and fees expressly. (UK EMRs 2011, reg. 39; Regulated Activities Order 2001, art. 5(2); PSRs 2017, reg. 34(16); Directive (EU) 2015/2366, art. 18; Irish S.I. No. 183/2011, reg. 52.)

The principal’s compliance lead should approve a responsibility schedule for onboarding, financial-crime checks, safeguarding, complaints, regulatory returns and operational incidents. The brand can perform assigned tasks; the institution retains its legal responsibilities for agents and outsourced work. The brand remains responsible for its own obligations and conduct. (UK PSRs 2017, regs. 25, 36 and 99; Irish S.I. No. 6/2018, regs. 30–31; Regulation (EU) 2022/2554, arts. 19 and 28.)

Require evidence of the applicable safeguarding method, customer entitlements, reconciliations and recovery arrangements. UK supplementary safeguarding rules have applied since 7 May 2026, with reporting and audit requirements subject to their scope and transitions. Irish safeguarding follows its national payment and e-money rules. Safeguarding an e-money claim does not turn it into a bank deposit or promise immediate repayment after failure. (FCA 2025/38, para. C; CASS 15.1.2R–15.1.8R and 15.8; CASS 10A.1.3R; SUP 3A.1.1R and 16.14A.3R; Irish S.I. No. 6/2018, reg. 17; S.I. No. 183/2011, regs. 28–29.)

Negotiate an exit schedule covering continuing service, usable ledger exports, lawful data transfer, transition costs and access to the processor chain. Require the parties to identify who handles pending payments, card disputes, complaints and unredeemed balances. Commercial notice and customer notice need separate treatment. Covered UK indefinite contracts entered into from 28 April 2026 generally receive at least 90 days’ provider notice. Ordinary provider termination of older UK and Irish indefinite contracts generally requires an agreed termination right and at least two months’ notice. Check statutory exceptions and permitted business-customer opt-outs. (UK PSRs 2017, regs. 40 and 51A–51D; Irish S.I. No. 6/2018, regs. 62 and 79.)

Before migration, the replacement must have the relevant permission, completed agent arrangements, customer documentation, required due diligence and operational readiness. Prepare the valid transfer or new-contract documents, notices, reconciled balance file, payment instructions and cutover acceptance record. Test card and account-identifier continuity; retaining the brand does not establish it.

The regulated providers must control lawful fund movement and retain responsibility for unresolved claims. An ordinary commercial migration and a statutory insolvency transfer follow different rules. A contract cannot give an unlicensed brand authority to operate the failed principal’s business. For an Irish institution’s relevant technology contracts, the Digital Operational Resilience Act (DORA) requires data-recovery and exit protections. Critical or important functions attract additional requirements. (UK EMRs 2011, reg. 39; Irish S.I. No. 183/2011, regs. 24 and 52; Regulation (EU) 2022/2554, arts. 28–30.)

Does the checkout require payment-initiation permission?

Open banking for a Ghanaian fintech’s UK checkout examines provider-controlled software, outsourcing and payment agency.

Does the contract establish a reseller or a payment collector?

UK and Irish merchants of record follows the customer sale, the supplier debt and the collection alternative.

What must an e-money provider prepare to protect customer funds?

EMI authorisation and safeguarding covers the issuer’s application, safeguarding arrangements and operational preparations.

How can customers leave when the sponsor exits?

Partner exit and EU customer funds addresses redemption, replacement-provider migration and unresolved customer claims.

Send the entity chart, operating countries, customer screens, funds flow and proposed programme terms. A review can identify the viable role, required permissions, contract changes and launch conditions. An institution’s own authorisation application needs separately agreed scope.

Compare viable operating models