How Regulatory Changes in the US & UK Are Affecting Payment Gateways

The regulatory landscape governing payment gateways has shifted significantly in 2025–2026. New rules from the CFPB in the US and the FCA in the UK are forcing payment providers, merchant services firms, and high-risk merchants alike to rethink their compliance strategies, or face mounting penalties.
The digital payments sector sits at the intersection of financial innovation and regulatory scrutiny. Whether you operate a standard merchant account or run a high-risk payment operation in sectors like forex, travel, or subscription billing, the rules have changed in 2026, and the consequences of non-compliance have grown steeper.
Compliance Cost Growth by Business Type (2022–2026)

The US Regulatory Shift: CFPB, FedNow, and Open Banking

In the United States, payment processing regulation is being shaped by three concurrent forces: the Consumer Financial Protection Bureau's expanded oversight authority, the scaling of the FedNow instant payment network, and the early but consequential rollout of open banking rules under Section 1033 of the Dodd-Frank Act.
CFPB's expanded supervision of nonbank payment companies
The CFPB's 2024 final rule, now in full effect, places large nonbank payment providers under the same supervisory framework as banks. Companies processing over five million transactions annually must comply with federal data safeguards, error resolution timelines, and fee disclosure requirements that previously applied only to depository institutions.
For payment gateways and merchant services companies, this means tighter scrutiny on how they handle consumer data, how quickly disputes are resolved, and how clearly fees are disclosed to merchants. Payment providers serving high-risk merchants face particular scrutiny given the elevated chargeback exposure in these verticals.
- Payment providers processing 5M+ annual transactions now classified as "larger participants"
- Mandatory error resolution within 10 business days (down from 20 for many providers)
- Real-time balance and transaction data access required for consumers on request
- Enhanced anti-money laundering (AML) checks required at onboarding for merchant accounts
FedNow and the instant payment imperative
FedNow, launched in 2023 and now covering over 900 financial institutions, is pushing payment gateways to offer near-instant settlement as a standard feature. For merchants, particularly high-risk merchants who have historically operated with longer rolling reserves, the pressure to access funds faster is intensifying commercial demand for FedNow-compatible payment processing infrastructure.
The challenge is that real-time payment processing reduces fraud detection windows. Fraud rates on instant payment rails are 2.3× higher than on deferred rails, according to the Federal Reserve's 2025 Payments Study. Gateways are responding with AI-driven risk scoring, but compliance overhead is rising sharply.

Business impact score (1–10)

The UK Regulatory Picture: FCA, PSR, and PSD3 Alignment

Across the Atlantic, the UK's Payment Systems Regulator and the Financial Conduct Authority have introduced a framework that is, in several respects, stricter than the EU's revised PSD3, even though the UK is no longer bound by EU directives post-Brexit.
Mandatory reimbursement for APP fraud
From October 2024, UK payment providers became legally obligated to reimburse victims of Authorised Push Payment (APP) fraud, scams where customers are tricked into transferring money. The PSR cap was initially set at £415,000 per claim, covering both the sending and receiving payment service provider.
For payment gateways and merchant services operating in the UK, this liability-sharing model has transformed risk management. Offshore merchants and high-risk payment processors with UK-based operations must now maintain dedicated fraud reserves, and many are renegotiating merchant account contracts to clarify liability terms.
FCA payment account access rules
The FCA's Consumer Duty, in force since July 2023, now fully embedded in 2026, requires all payment providers to demonstrate that their products deliver "fair value" to merchants and consumers alike. Vague or excessive fee structures are now grounds for FCA enforcement action, and several mid-tier payment providers have faced formal investigations in the first half of 2026.
- APP fraud reimbursement liability now shared 50/50 between sending and receiving PSPs
- Consumer Duty requires annual fair value assessments for all payment products
- FCA supervision extended to e-money institutions handling merchant accounts
- Stricter KYC and source-of-funds checks for offshore merchants transacting in GBP
- Open banking payment initiation services (PISP) now subject to the same conduct rules as card-based gateways
Key insight: The UK's APP reimbursement mandate is the single biggest cost driver for payment providers in 2026. PwC estimates the industry-wide annual liability at £350–500 million, with high-risk and offshore merchant portfolios accounting for a disproportionate share of claims.

US vs UK Regulatory Comparison for Payment Gateways (2026)

Regulatory Area
United States (CFPB / FinCEN)
United Kingdom (FCA / PSR)
Impact on High-Risk Merchants
Nonbank oversight
CFPB "larger participant" rule
FCA e-money authorisation
High - stricter onboarding
Fraud liability
No mandatory reimbursement rule
Mandatory APP reimbursement (£415k cap)
Very High (UK)
Open banking
Section 1033 (phased 2026–2030)
OBIE / CMA9 mandated since 2018
Moderate
Beneficial ownership
FinCEN BOI rule (effective Jan 2024)
PSC register (Companies House)
High - offshore merchants particularly
Real-time payments
FedNow (opt-in, 900+ FIs)
Faster Payments (near-universal)
Moderate
Data portability
Section 1033 (phased)
Consumer Duty + open banking
Low direct impact
Fee transparency
CFPB junk fee rule (proposed)
Consumer Duty fair value requirement
Moderate

Pros and Cons of the New Regulatory Environment

Pros for the industry
- Greater consumer trust in payment processing
- Levelled playing field between banks and nonbank gateways
- APP fraud reimbursement reduces merchant chargeback abuse (UK)
- Open banking creates new revenue streams for payment providers
- Clearer rules reduce long-term legal uncertainty
- Stronger AML frameworks protect high-risk payment ecosystems
Cons and challenges
- Compliance costs up 34% for mid-market merchant services firms
- Smaller payment gateways struggle with capital requirements
- Offshore merchants face account terminations mid-compliance
- High-risk payment portfolios attract premium pricing and scrutiny
- Fraud reserve requirements reduce liquidity for merchants
- Regulatory divergence between US and UK increases cross-border complexity

What This Means for High-Risk and Offshore Merchants

The merchants feeling the sharpest edge of these regulatory changes are those already operating in elevated-scrutiny verticals. High-risk merchants, those in adult content, forex, nutraceuticals, CBD, gambling, or travel, are facing dual pressure: stricter onboarding requirements from regulated payment gateways and higher processing fees to offset new compliance liabilities.
Offshore merchants, businesses incorporated in low-regulation jurisdictions but processing payments from US or UK customers, face the most complex environment. Both the CFPB's expanded reach and the FCA's Consumer Duty have extraterritorial dimensions: if the end customer is American or British, the regulatory framework can apply regardless of where the merchant is registered.
- Offshore merchant accounts in the UK now require source-of-funds declarations for transactions over £10,000
- US-facing offshore merchants must comply with FinCEN's beneficial ownership registry regardless of incorporation jurisdiction
- Rolling reserves have increased from an average of 5–8% to 8–12% for high-risk payment processing in 2025–2026
- Several major payment gateways have exited the offshore merchant vertical entirely due to compliance overhead
Data point: According to Nilson Report data for 2025, the number of payment providers actively serving high-risk merchant verticals in the US dropped by 18% year-over-year, as mid-tier processors exited the market rather than invest in compliance infrastructure.

How Payment Providers Are Responding

Established payment gateways with compliance infrastructure are, paradoxically, benefiting from the new regulatory environment. They can absorb costs that smaller entrants cannot, and their regulatory standing becomes a competitive differentiator.
Specialist high-risk payment processing providers are also adapting, investing in RegTech platforms, building dedicated compliance teams, and partnering with acquiring banks that have experience in regulated industries. The result is a market that is consolidating around providers with genuine compliance expertise.
Technology solutions gaining traction
- AI-powered real-time fraud scoring (reducing fraud losses on FedNow rails by up to 41% in pilots)
- Automated KYC/AML platforms cutting onboarding time for merchant accounts from weeks to hours
- Chargeback management APIs integrated directly into payment processing dashboards
- Regulatory reporting automation tools for both CFPB and FCA compliance obligations

FAQs

Does the CFPB's nonbank rule affect all payment gateways?
It applies to providers processing over five million consumer payment transactions annually. Smaller gateways are currently exempt, but the CFPB has signalled a lower threshold may follow in future rulemaking.
Are offshore merchants subject to UK FCA rules?
If the merchant is serving UK-based consumers or using a UK-regulated payment provider, FCA conduct rules can apply. The FCA has pursued enforcement actions against offshore entities with UK-facing operations since 2023.
How should high-risk merchants prepare for 2026 compliance requirements?
Work with a specialist merchant services provider experienced in your vertical, ensure your beneficial ownership information is current with FinCEN and Companies House, and build a chargeback mitigation programme before your processor flags your account.
Will UK APP reimbursement rules increase merchant account fees?
Yes, PSR modelling suggests an increase of 3–7 basis points in effective processing fees as providers price in reimbursement liability. High-risk payment verticals will see higher increases.
What is the difference between a payment gateway and a payment processor under the new rules?
Regulators are increasingly treating the distinction as less relevant. Both entities in a payment processing chain can now hold regulatory obligations in the US and UK frameworks, particularly regarding fraud, data handling, and fee disclosure. https://thefinrate.com/how-regulatory-changes-in-the-us-uk-are-affecting-payment-gateways/