Payments Perimeter

The payments perimeter is an informal, practitioner term for the boundary of payments regulation: the line between activities that need a payment licence, such as collecting, holding, transferring or paying out other people's money, and activities that do not. A business inside the perimeter must be authorised itself or work through an authorised firm; a business outside it can operate without a payments licence.

The phrase is a narrower use of the regulatory perimeter, the general edge of what financial regulators supervise. It comes up most often when a company holds a licence for something else, such as a gambling license, a marketplace or a software platform, and assumes that licence also covers the money it moves. Usually it does not.

Think of a festival with a fence round it. Inside the fence, everyone needs a wristband, and security checks bags. Outside, people can wander freely. Some activities are clearly inside, some clearly outside, and a few stalls sit right on the fence line, where organisers argue about whether a wristband is needed.

The payments perimeter is that fence for handling other people's money. If a business takes money from one person and passes it to another, it is usually inside and needs the wristband: a payment licence, or a licensed partner. Selling your own goods and taking payment for them is usually outside. The arguments happen at the edges.

Laws describe the perimeter as a list of activities. In the European Union, the second Payment Services Directive (PSD2) lists the payment services that require authorisation, including executing payment transactions, issuing payment instruments, acquiring transactions, money remittance and account-information and payment-initiation services. Firms that provide them need a payment institution license or, if they issue e-money, authorisation as an electronic money institution (EMI).

In the United States the line is drawn mainly by state law. Most states require a money transmitter license (MTL) for anyone who receives money for transmission, and the federal rules require FinCEN registration for a money services business (MSB). The Conference of State Bank Supervisors' Money Transmission Modernization Act, a model law adopted in a growing number of states, aims to make these definitions more uniform.

In each system, the core test is similar: does the business at any point hold or control funds that belong to someone else, or give instructions that move them? If so, it is probably carrying out a licensable activity.

Every regime carves out activities that look like payments but are left outside. Common examples include:

• Commercial agents. PSD2 excludes payments through an agent authorised to negotiate or conclude sales on behalf of only the payer or only the payee.
• Limited networks. Store cards and other closed-loop instruments usable only at a limited set of merchants fall outside PSD2, subject to European Banking Authority guidelines issued in 2022.
• Agent of the payee. Many US states recognise that a company collecting on behalf of a merchant, as agent of the payee (ATOP), is not transmitting money once the customer's debt is discharged on payment.
• Payment processors. US federal rules exclude certain processors that move funds only through clearing and settlement systems under agreements with the creditor.
• Technical service providers. Firms that supply software or messaging without ever holding funds are usually outside.

Exclusions are narrow, and regulators read them strictly. Business models such as marketplaces, platforms and the payment facilitator (PayFac) often sit at the edge, which is why firms seek legal opinions or regulator guidance, such as the UK Financial Conduct Authority (FCA) perimeter guidance in its Handbook, before launching.

A licence for an underlying activity does not authorise moving money. A gambling operator that accepts player deposits, holds balances and pays winnings is collecting and paying out funds; in many countries this requires either its own payment authorisation or the use of licensed partners such as a payment service provider (PSP) and a high-risk acquirer. Specialist gaming payment licenses exist precisely because the two permissions are separate. Brazil's betting rules, for instance, require player funds to move only through accounts at institutions authorised by the central bank and linked to the player's CPF (Cadastro de Pessoas Físicas).

Operators relying on paper from a license mill are especially exposed, because that licence rarely says anything about payments and banks know it. Other ways to stay compliant include license sponsorship, acting as a payment services agent of a licensed firm, or using banking-as-a-service (BaaS) providers.

Unlicensed payment activity can be a criminal offence. In the United States, unlicensed money transmission is a federal crime, and state regulators can issue cease-and-desist orders. In Europe, national authorities can order a firm to stop, fine it and publish warnings. Banks and card schemes add their own response, typically offboarding the firm and its partners.

Licensed firms inside the perimeter take on duties that outsiders avoid: safeguarding customer funds, capital requirements, anti-money laundering controls and a wind-down plan. These costs explain why some firms try to stay just outside through regulatory arbitrage, and why activity pushed out of licensed channels often reappears in the grey economy.

• FCA Handbook: PERG 15, Guidance on the scope of the Payment Services Regulations 2017
• Directive (EU) 2015/2366 on payment services (PSD2)