The playbook library
One rule. A workable next step.
Ten source-led operating files. Each connects the regulatory question to owners, evidence and a practical checklist.
Safeguarding: build the evidence, not just the policy.
Safeguarding · A practical operating file for relevant funds, reconciliations, third-party records and the reporting trail behind PS25/12.
Map the service before you choose the permission.
Authorisation · An activity-by-activity working map for the UK Payment Services Regulations, the e-money boundary and institutional status.
An API application should describe a business that can operate.
Authorisation · Organise the programme of operations, capital analysis, governance and control evidence into a coherent application file.
Consumer Duty: put the customer outcome in the board pack.
Consumer Duty · From a product promise to a testable outcome: an operating sequence for payment firms, with evidence owners and escalation points.
Choose the payment rail. Then check the actual limit.
Payment rails · A comparison of Faster Payments, CHAPS and Bacs for an operations team that needs to know what happens before release.
Crypto regulation: keep today’s perimeter separate from tomorrow’s.
Regulatory change · A change-control file for current obligations, published future requirements and business decisions that depend on them.
A supervisory visit starts with a file someone else can follow.
Supervision · Organise the request, the evidence and the interview sequence without creating a second version of the business for the regulator.
Test the service, not the disaster-recovery slide.
Operational resilience · An operating file for important business services, impact tolerances, dependencies and severe-but-plausible scenarios.
Oversee the representative you actually have.
Governance · A principal-firm work programme for scope, oversight, annual review and evidence of challenge.
A financial crime control needs an owner and a working test.
Financial crime · Build a traceable operating file for risk assessment, control design, alert handling, quality assurance and remediation.
How to use a file
Read the operating answer, check scope against the primary source, then adapt the suggested process. Export the checklist as a working record. Never treat a completed list as certification.
Method, assumptions and limits
We use official sources for regulatory facts and label our suggested workflows as editorial methods. Illustrative examples are hypothetical. The content does not establish the position of any individual firm and is not a prescribed regulator template.
Source review date: 12 November 2026. No automatic monitoring is running. Check the underlying document, applicable entity, activity and jurisdiction before using this material.
Read the full methodology