UK and Europe

Cyber resilience in payments emerges as a political priority for financial services

The first full parliamentary week of 2026 signalled a clear shift in tone from capability building to accountability. Debate on the Cyber Security and Resilience Bill, alongside the refreshed Cyber Action Plan, shows ministers and MPs increasingly focused on systemic risk in banking and payments in the UK.

For payment firms and their suppliers, cyber resilience is now firmly a political issue, not just a technical one, with higher expectations for regulatory oversight and cross-government coordination. In this context, cyber resilience means a payment firm’s ability to keep payments safe, available and trustworthy during and after cyber incidents. This includes protecting consumers and the wider economy, not just our own systems.

January delivered a meaningful policy breakthrough for commercial VRPs. UK Finance’s cVRP proposal, combined with the FCA, PSR and CMA’s decision not to prioritise competition enforcement on Phase 1 pricing, reflects a rare moment of regulatory alignment.

Pay by Bank policy moves from principle to implementation

In practical terms, this signals that regulators are supportive of banks and the industry agreeing a reasonable, standardised way to price commercial VRPs, rather than allowing banks to individually set high or unpredictable fees for access to VRP-related payment and data services.
Politically, this amounts to clear government backing for Pay by Bank as a credible, competitive alternative to cards in the UK. While longer-term legislation and closer scrutiny of pricing are still likely, the current approach gives the market space to scale VRPs without merchants facing arbitrary or excessive charges in the early stages.

Growing scrutiny on innovation, consumer outcomes and market power

While policymakers continue to champion innovation, last month showed a tightening of the narrative around consumer protection and trust. Treasury Committee warnings on the use of AI in financial services, alongside renewed questions around purchase protection in open banking payments, underline a broader political expectation that innovation must deliver clear, demonstrable public benefit – not just efficiency gains.

This scrutiny is most pronounced in higher-risk sectors such as payments and iGaming, where trust, transparency and consumer outcomes sit at the centre of political debate. For merchants, this is not simply a regulatory risk, but a commercial signal: solutions that actively support safer play, identify vulnerability, and improve consumer protections are increasingly aligned with policymaker priorities.

In practice, this strengthens the case for payment models that embed responsible design. For example, using real-time payment data to support safer gambling interventions, clearer affordability signals, and reduced fraud and chargeback exposure. As expectations rise, providers and merchants that can evidence positive consumer outcomes are likely to be better positioned as regulation tightens.

Payments infrastructure decisions now carry long-term political weight

Developments across stablecoins, crypto regulation and the future governance of open banking point to a maturing policy environment in the UK. The upcoming decision on the Future Entity for UK open banking underlines a shift towards long-term market structure, regulatory control and national competitiveness.

These infrastructure choices will shape how payments and iGaming evolve in the UK well beyond 2026.

United States

Across the Atlantic, progress on crypto and digital asset regulation remains uncertain. Barclays’ move into stablecoin infrastructure in the US highlights growing institutional interest, even as federal policy momentum slows. With key US Senate priorities shifting elsewhere, comprehensive crypto and market structure legislation is now unlikely to advance before mid-2026.

As a result, fundamental questions around stablecoin yield, the regulatory treatment of DeFi, and which agencies ultimately hold jurisdiction remain unresolved. The contrast between private-sector experimentation and legislative inertia underscores a familiar theme in US digital asset policy: innovation is moving faster than the rules designed to govern it.

At the same time, crypto firms remain divided on regulatory strategy. Some continue to push for clarity even where this involves compromise, while others reject current legislative drafts as harmful. This fragmentation complicates unified industry advocacy at a moment when legislative compromise is already fragile.

Against this backdrop, Yaspa is taking a jurisdiction-led approach to its crypto payments offering, monitoring regulation and adoption closely as frameworks evolve.

Key takeaways

January’s developments point to a policy environment that is becoming more interventionist, more politically visible and more focused on long-term market structure. For payment providers and operators, regulatory expectations are rising not just around compliance, but around resilience, consumer outcomes and public trust.

As these debates continue to evolve, the direction of travel is clear – payments policy is no longer being shaped solely by regulators and industry, but increasingly by political priorities at the highest level.

Get in touch to speak to one of our experts about Yaspa’s latest payments innovations.

We’ll keep tracking what changes and what actually matters. Drop your details in the form below to get our latest thinking straight to your inbox.