First determine which step in the process the AI performs
The first type of product only consolidates bills and recommends payments, with the user separately entering a bank or payment institution to operate independently; the second type accepts user requests and initiates payments through an interface; the third type manages balances or keys and automatically completes exchanges and payments. The three cannot share a single conclusion of a "purely technical assistant." Whether a license is required should also be analyzed in light of the operator, the location of customers, and the manner in which the service is provided.
Not holding funds may still mean providing payment services
The UK FCA's payment regulatory guidance makes clear that payment initiation services do not fall within the general exclusion for technical services; its consumer guidance also emphasizes that the relevant services require the user's explicit consent. Therefore, the fact that "the money always stays in the bank" or that "the bank ultimately executes the payment" cannot be treated as a sufficient reason for an AI application to be outside payment regulation. On the other hand, where the AI merely generates recommendations without actually providing the relevant services, it also cannot be presumed to require a license merely because a model is used.
The FCA's current AI guidance emphasizes the use of the existing financial regulatory framework rather than establishing a separate set of dedicated AI rules. Accordingly, this article does not assume the existence of a general "AI payment license." If the AI further exchanges or transfers crypto assets on the customer's behalf, this must also be assessed according to the corresponding service; the EU MiCA classification of transfers on behalf of clients is one example.
A user saying "buy it for me" does not equal unlimited payment authorization
Assume a user requests monthly procurement of office supplies not exceeding an agreed amount, and the AI selects a more expensive product because the merchant's page was misleading, or makes a duplicate payment due to a timeout and retry. It is necessary to distinguish the user's original authorization, the model's selection, the platform's failure of risk management, and payment execution errors, and it cannot simply be written into the terms that "all AI decisions are borne by the user." Specific refunds and compensation are still determined under applicable law and contract.
The product should convert the payee, amount, time, frequency, and purchasable scope into machine-verifiable limits, and require reconfirmation when limits are exceeded. Web pages, emails, and order content that the model can read should not have the authority to expand payment permissions on their own. After authorization is withdrawn, it must also be verified that subsequent tasks have actually stopped, rather than merely deleting a single instruction from the chat interface.
Audit records must be able to reconstruct a real decision
It is recommended to retain the necessary versions of user authorization, order elements, model outputs, rule validations, payment requests, and final results, and to control the scope of retention in accordance with data protection requirements. Establish duplicate-charge protection, limits on retries after failure, emergency stop, and a human complaint channel. The FCA's latest guidance on AI practices emphasizes governance, monitoring, and effective human oversight; these management approaches cannot replace payment licensing, but they can help projects avoid a state in which "payments can be made automatically but no one can explain or stop them."
Recommended actions
- Separately identify the functions of advice, payment initiation, asset control, and exchange and transfer.
- Verify licensing and cooperation models under the target jurisdiction, and do not treat the absence of a capital-holding requirement as a general exemption.
- Make budgets, payees, transaction frequency and revocation of authority into testable hard limits.
- Test prompt injection, repeated requests, timeout retries and emergency payment suspension, and retain necessary logs.
This content is for general information only and does not constitute legal advice. Please consult a qualified lawyer about specific matters.
References
- PERG 15: Guidance on the scope of payment regulation — UK Financial Conduct Authority (FCA)
- Account information and payment initiation services — UK Financial Conduct Authority (FCA)
- AI and the FCA: our approach, updated 2 October 2026 — UK Financial Conduct Authority (FCA)
- MiCA Article 3: Definitions — EU regulations / ESMA official rulebook
- AI in financial services: good practice and areas for improvement, updated 20 October 2026 — UK Financial Conduct Authority (FCA)
