Financial services rules after Brexit: what replaced EU law

When the UK left the EU at the end of 2020, the financial rules that governed your bank account, your cards, your mortgage and your investments did not disappear. Nearly all of them were copied into UK law and carried on applying, a body of law known as retained EU law. The caps on card fees, the checks a lender must make before giving you a mortgage, the requirement to confirm payments with your bank, and the safeguards over money held by payment apps all still exist, but they are now written, amended and enforced in the UK rather than in Brussels¹.

What has changed is who controls the rules. Parliament, HM Treasury and the Financial Conduct Authority (FCA) can now amend or repeal rules that originally came from the EU without any EU involvement³. Some rules have already been rewritten, some are being reviewed, and a few protections have narrowed at the edges, most visibly on card fees for payments between the UK and the EU, where caps that once applied no longer do⁴.

EU-derived rules still apply: they became UK law

The single most important thing to understand about Brexit and financial services is continuity. On IP completion day, 31 December 2020, EU legislation that already applied in the UK was turned into retained UK law. The Interchange Fee Regulation, which caps the fees behind card payments, is a clear example: the Payment Systems Regulator states that "Following EU Withdrawal, the onshored IFR is now retained UK law, which applies in the UK as amended by the Interchange Fee (Amendment) (EU Exit) Regulations 2019"¹. The same pattern applies across payments, credit and consumer protection.

Several major consumer frameworks trace back to EU directives and remain in force today:

• The Consumer Protection from Unfair Trading Regulations 2008 implemented EU Directive 2005/29/EC and continue in force as a result of the European Union (Withdrawal) Act 2018³.
• The Consumer Credit (Agreements) Regulations 2010 transpose an EU directive into UK law⁹.
• The Alternative Dispute Resolution for Consumer Disputes (Competent Authorities and Information) Regulations 2015 implemented the EU's ADR Directive and continued in force after EU exit, subject to amendment³.
• The Payment Services Regulations 2017 were amended by EU exit regulations with effect from 31 December 2020 and remain the core payment rules².
• The UK kept the EU's PRIIPs regulation, which governs the key information documents packaged investment products must give you, and now has powers to amend it without EU involvement¹⁰.

Older rules were carried forward in the same way. The Consumer Credit (Agreements) Regulations 2004 provided that the 1983 Regulations would continue to apply to transitional agreements, showing how successive layers of credit law have been preserved rather than scrapped¹¹. Even EU directives themselves, such as Directive 2014/17/EU on credit agreements relating to residential property, remain published for cross-referencing from UK legislation, kept up to date with UK amendments since IP completion day¹².

The practical effect for you is that the protections you had before 2021 are, in the main, still there. What differs is the detail at the edges, and the pace at which the UK now revises those details on its own.

Who now writes the rules: Parliament, HM Treasury and the FCA

Since Brexit, rule-making power sits with UK institutions. The Financial Conduct Authority regulates financial services firms and financial markets in the UK¹³. The Bank of England's Prudential Regulation Authority (PRA) is responsible for deposits and insurance rules, while the FCA is responsible for rules relating to other activities, such as pension advice and investments¹⁴. The Financial Services Compensation Scheme follows rules set by these two regulators¹⁵, and the Financial Ombudsman Service follows rules set by the FCA¹⁶, including its Dispute Resolution Rules¹⁷.

Parliament and HM Treasury set the underlying law. Treasury regulations are made under powers conferred by Acts of Parliament, for example section 15 of the Finance Act 2024¹⁸. Regulation of financial services is a power reserved to the UK Government rather than the devolved administrations, so the same UK-wide framework applies in Scotland, Wales and Northern Ireland¹⁹. Mutual organisations carrying out financial services activities, such as deposit-taking and making investments, are regulated by the FCA and the PRA under the Financial Services and Markets Act 2000²⁰.

There is also a deliberate shift in how detailed rules are made. A House of Commons Library briefing on buy now pay later notes the principle that "the FCA, not Parliament, should be responsible for setting rules governing the sector, as far as is practical"⁸. This is the approach behind what the government calls the smarter regulatory framework: moving retained EU law out of statute and into regulator rulebooks, where it can be updated more quickly.

The FCA's powers have grown in specific areas too. The Financial Services and Markets Act 2023 gave the FCA broader powers on access to cash²¹. The FCA can also use its powers under section 404 of the Act to make rules requiring authorised persons, electronic money issuers and payment service providers to establish and operate consumer redress schemes²². You can read more about the division of responsibilities in who regulates what, and about the FCA itself in The Financial Conduct Authority.

Payment services rules: what your bank and payment firms must do

The Payment Services Regulations 2017 are the backbone of everyday banking rules, and they came from the EU's second Payment Services Directive. They came into force in stages: specified provisions including regulation 2 (interpretation) and regulation 106 (functions of the FCA) on 13th August 2017, Part 2 for authorisation and registration applications and other specified provisions on 13th October 2017, regulations 27 (notice of intention) and 28 (decision following notice of intention) on 13th December 2017, and the rest of the Regulations on 13th January 2018, with some provisions on secure communication and authentication following on 14th September 2019²³. They remain up to date with all changes known to be in force as of late September 2026².

The rules impose duties on the firms you use every day. Banks are expected to process payments a customer authorises, in line with the Payment Services Regulations²⁴. A payment institution applying for authorisation must show it carries on, or will carry on, at least part of its payment service business in the United Kingdom²⁵.

The Payment Accounts Regulations 2015, which also came from the EU, add duties around account switching and moving your account:

• A payment service provider must offer a switching service between payment accounts that are denominated in the same currency and opened or held with a payment service provider located in the United Kingdom²⁶.
• If you want to open a payment account with a provider outside the UK but within the EU, your UK provider must, by a date you specify and free of charge, give you a list of active standing orders and direct debit mandates, information about recurring incoming credit transfers and direct debits from the previous 13 months, transfer any positive balance to the EU provider, and close the UK account²⁷.
• Providers must make available to consumers a glossary of the terms and definitions used in their services, and use that terminology in contractual, commercial and marketing information²⁸.

One EU exit change affected basic bank accounts. An amendment removed the requirement on the nine designated providers of basic bank accounts to offer these products to customers resident in the EU, or to offer EU currency services on any basic bank account as standard, because the UK was no longer an EU member²⁹.

Not every financial body is covered. The Payment Services Regulations 2017 state that they do not apply to credit unions, municipal banks or the National Savings Bank²³. If you use a credit union, it is supervised under a different framework, covered in how credit unions are supervised.

Strong customer authentication: why you are asked to confirm payments

If you have wondered why your bank asks you to approve a payment with your phone, a card reader or a fingerprint, that is strong customer authentication, and it is an EU-derived rule that still applies. The Payment Services Regulations require a payment service provider to apply strong customer authentication where a payment service user accesses their payment account online, initiates an electronic payment transaction, or carries out any action through a remote channel which may imply a risk of payment fraud or other abuses³⁰. These provisions came into force on 14 September 2019²³.

The rule matters to you in another way if a payment goes wrong. Under the regulations on evidence of authentication and execution, where a user denies authorising a payment or claims it was incorrectly executed, "it is for the payment service provider to prove that the payment transaction was authenticated, accurately recorded, entered in the payment service provider's accounts and not affected by a technical breakdown or some other deficiency in the service provided by the payment service provider"³¹. In plain terms, the burden of proof sits with the firm, not with you.

The UK has also added its own interventions on top of the inherited rules. The Payment Systems Regulator has driven additional interventions to improve data sharing to spot and prevent scams, and the roll-out of the name-checking service, Confirmation of Payee, which checks that the name on a transfer matches the account³². More on how payments are policed is in The Payment Systems Regulator.

Card fees: interchange capped at 0.2% for debit and 0.3% for credit cards

Every time you pay by card, the shop's bank pays a fee to your card issuer, called an interchange fee. The EU's Interchange Fee Regulation, which took effect on 8 June 2015, capped these fees, and that regulation is now retained UK law, amended by the Interchange Fee (Amendment) (EU Exit) Regulations 2019¹.

The caps as they apply in the UK today:

The UK version of the regulation caps interchange fees on consumer debit and credit card transactions, with some American Express cards excepted, where the point of sale (the merchant), the acquirer and the card issuer are all within the UK¹. The regulation mainly imposes requirements on payment card schemes and issuing and acquiring payment service providers⁴.

The Payment Systems Regulator is the lead authority for monitoring and enforcing the UK's post-Brexit interchange fee regulation, including monitoring compliance with all provisions of the UK IFR, the caps and the business rules³⁴. Its final guidance covers who the IFR applies to, the caps and exemptions, the separation of payment card scheme and processing entities, co-badging and choice of payment brand, honouring of all cards, monitoring compliance, investigating complaints, and its powers and penalties³³.

The key dates as EU rules took effect and then became UK law.

The card fee provisions arrived in two phases: the Phase 1 provisions were in force by 9 December 2015, and the Phase 2 provisions came into force on 9 June 2016³³. For more on how these fees reach the prices you pay, see card interchange and scheme fees.

Where UK card fee caps stop: payments between the UK and EU

This is the area where Brexit changed something real for consumers. The UK's caps only cover transactions where the merchant, acquirer and issuer are all in the UK. Consumer cross-border card payments between the UK and the EU, or any other third country, where either the acquirer or issuer is based outside the UK's jurisdiction, are no longer subject to the interchange fee caps established under either the UK IFR or the EU IFR⁴. The EU IFR itself no longer applies to UK domestic and cross-border transactions between the UK and EEA following the UK's withdrawal at the end of 2020⁵.

The consequences were immediate. Shortly after EU withdrawal, Mastercard and Visa increased interchange fees for card-not-present transactions, meaning online and other remote payments, using consumer debit and credit cards between the UK and the EEA⁵. Mastercard raised its fee to 1.15% and Visa to 1.5%, up from the previous 0.2% and 0.3% for consumer debit and credit cards respectively³⁶.

The Payment Systems Regulator opened a cross-border interchange fee market review to understand the rationale behind the increases and the impact they may have on UK services users⁵. It has also explained that when the holder of a UK-issued card buys goods or services from a merchant in the EEA, the cap on the interchange fee is now higher than before Brexit, and that when the holder of a non-UK-issued card buys from a UK merchant, the interchange fee paid by the merchant is no longer capped³⁴. These higher costs can feed into what merchants charge or surcharge for cross-border sales, which is why buying from an EU website can sometimes cost more.

Mortgage rules: affordability checks and changes to your mortgage

The rules on how a lender must assess you for a mortgage came from the EU's mortgage credit directive, implemented in the UK through FCA rules. Today they live in the FCA Handbook, in MCOB 11 on responsible lending, and they continue to shape what happens when you apply for a mortgage and when you ask to change one.

When assessing affordability, a mortgage lender must consider likely future interest rates over a minimum period of five years from the expected start of the term, unless the interest rate is fixed for five years or more, or for the duration of the contract if the contract is for less than five years³⁷. This is why lenders stress-test your finances against possible rate rises rather than only today's rate.

The rules also bite when you want to change an existing mortgage. MCOB 11 lists changes that may not be treated as immaterial to affordability, including an extension of the term of the regulated mortgage contract into the customer's retirement, changing between repayment and interest-only, and the addition or removal of a customer³⁷. There is a narrow exception: the affordability rule does not apply to a variation which reduces, including to zero, the capital repayments required under a repayment mortgage for a period of no longer than six months, provided it is a repayment mortgage rather than a bridging loan or second charge, and it has not previously been varied under this provision³⁷.

On early repayment, the position depends on your particular mortgage. Most fixed rate deals carry an early repayment charge if you repay or switch during the fixed period, and the exact charge is set out in your mortgage illustration and offer. Under the Welsh Government's shared equity scheme Homebuy Wales, "you can repay the loan before you sell you home in which case you will repay based on the value of your home at that time"³⁸. The background to today's affordability rules is covered in the Mortgage Market Review.

If a payment firm fails: how your money is safeguarded

Money you hold with an e-money firm or payment app, rather than in a bank account, is protected by a different mechanism from FSCS deposit protection: safeguarding. Payments firms must continue to hold relevant funds they receive in exchange for issued e-money in a separate safeguarding account from relevant funds received for unrelated payment services⁷. Electronic money institutions participating in a designated system may hold funds in an account at the Bank of England pending settlement in accordance with the rules of that system³⁹. Firms authorised under the Electronic Money Regulations must carry on at least part of their electronic money and payment service business in the United Kingdom³⁹.

The limits of this protection matter. FSCS may look through the payments firm to compensate its customers if the firm's UK safeguarding bank fails, but FSCS does not cover cases where the payments firm itself fails⁷. In other words, if the bank holding the safeguarded money collapses, FSCS protection can reach you; if the app or e-money firm itself goes bust, the safeguarded funds must be returned through the firm's own wind-down, not through FSCS compensation.

If you are unsure which protection applies to a product, FSCS or Financial Ombudsman: who to go to explains the split, and regulated or unregulated investments covers the investment side.

Complaints about payments: 15 days for a reply

If you complain to a payment firm, for example about an unauthorised transaction or a scam, the firm is on the clock. The Financial Ombudsman Service states that "They must get back to you within 15 days", either with a response to your complaint, or to explain why they cannot yet give one⁶. This deadline comes from the payment rules the UK inherited from the EU and still applies today.

If the firm's answer is not satisfactory, you can take the complaint to the Financial Ombudsman Service, which follows rules set by the FCA¹⁶. The Ombudsman can look at complaints involving unauthorised payments and identity theft, and its service is free to consumers⁶. For how the two routes differ, see Financial Ombudsman or court.

Rules still changing: complaint time limits, buy now pay later and consumer credit

Brexit did not freeze the rulebook; it set it moving in new directions. Three areas show the direction of travel.

Buy now pay later. Rules regulating the sector came into force in July 2026⁸. Before then, buy now pay later operated largely outside consumer credit regulation. The new rules bring the sector under FCA oversight, and the principle behind the design is that the FCA, rather than Parliament, should set the detailed rules where practical⁸. What the new regime means for you is set out in the new buy now pay later rules.

Car finance and complaint time limits. The FCA introduced temporary complaint handling rules for motor finance commission complaints, which extended the time financial businesses have to respond until after 4 December 2025⁴⁰. Those arrangements for more common finance agreements, such as hire purchase, personal contract purchase or conditional sale, were extended from 4 December 2025 until 31 May 2026⁴⁰. Deadlines for car finance commission claims are covered in detail in car finance claim deadlines.

Mortgage endowment complaints. Older time limit rules still shape what the Ombudsman can consider. For mortgage endowment complaints, the three-year time limit and the rules requiring the business to tell the customer about the final date for complaining still apply where the policy matured or was surrendered after a high risk warning letter was received, and complaints made after the three-year time limit can only be investigated if the business agrees⁴¹.

Consumer credit reform. The Consumer Credit (Agreements) Regulations 2010, which transpose an EU directive⁹, and the older layers beneath them¹¹, remain part of a framework the government has been consulting on reforming, moving more of it from statute into FCA rules. How that could change things for borrowers is covered in reforming the Consumer Credit Act, and how new rules are made in consultations and discussion papers.

The pattern across all of these is the same: EU-derived rules were kept at Brexit to preserve your protections, and are now being reviewed, amended or replaced one by one through UK institutions. The caps, checks, safeguards and complaint deadlines described on this page are the rules as they stand today, and each can change again as the smarter regulatory framework programme continues.