REP018 reviews and SCA RTS assurance for payment firms

A useful REP018 review should tell management whether payment-service risks are understood, whether controls work and what needs fixing. It should also provide reliable evidence for the FCA submission. For compliance leaders, security teams and boards, the starting point is to define the assessment and any independent audit as distinct pieces of work with clear, connected outputs.

18 October 2026

Understand the reporting and audit requirements

REP018 is the FCA’s operational and security risk reporting form. The supporting assessments address risks in the payment services provided and the adequacy of the measures used to manage them. The form asks about assessment dates, deficiencies, security-audit findings, remediation, security-related customer complaints to senior management and use of the corporate payment exemption. [1]

Separately, Article 3 of the UK strong customer authentication and secure communication technical standards (SCA RTS) requires relevant security measures to be documented, periodically tested, evaluated and audited. Auditors need IT-security and payments expertise and operational independence within or from the provider. General audit timing takes account of the applicable accounting and statutory audit framework. It is therefore misleading to describe REP018 itself as a universal annual external-audit requirement. [2]

For firms using the Article 18 transaction risk analysis exemption, Article 3 adds at least annual auditing of the methodology, model and reported fraud rates. An independent, qualified external auditor is required in the first year of use and at least every three years afterwards, or more frequently if the FCA requests it. The full Article 3 report must be available to the FCA on request. [2]

Confirm scope and timing before commissioning work

REP018 reporting applies to payment service providers within SUP 16.13.13D, subject to its exclusions. This includes relevant payment institutions, registered account information service providers and electronic money issuers; credit institutions need Part 4A permission to accept deposits. Check the legal entity and permissions rather than assuming every group company has the same obligations. [3] [4]

In-scope assessments must be submitted at least once each calendar year. FCA guidance calls for submission as soon as practicable after completion and a nil return for quarters without an assessment submission. Confirm the firm’s actual reporting schedule; the annual minimum does not create one universal quarter-end deadline. [3]

Build the review around evidence

The following workflow is a practical recommendation. The FCA’s completion guidance expects coverage of critical functions, processes and information assets, relevant threats and vulnerabilities, mitigation measures, the assessment methodology, findings and corrective actions. Use that structure to make conclusions traceable. [5]

Begin with a scope statement covering legal entities, payment products, channels, systems, outsourced services and the assessment period. Map critical dependencies, including authentication suppliers and payment processors. Record exclusions and explain why they are reasonable. Assign an evidence owner to each significant risk so that missing information is visible early.

Next, compare the risk register with what actually happened: incidents, fraud trends, security complaints, outages, significant changes and overdue actions. A newly introduced payment journey or supplier should appear in the assessment even if last year’s template has no convenient section for it.

Test control design and operation separately. A policy can describe an adequate control without proving that staff or systems consistently perform it. Sample access reviews, privileged-account changes, vulnerability remediation, incident escalation and recovery exercises. Record the population, selection rationale, test period, evidence, exceptions and limitations. Use technical testing where appropriate, with safe test conditions and agreed scope.

For outsourced controls, inspect the assurance report’s coverage, dates, exceptions and responsibilities retained by the firm. Ask whether it covers the actual service and configuration in use. A supplier certificate alone may leave important questions unanswered. Any untested dependency should remain visible in the conclusion.

Test SCA controls where they affect the services

Map each relevant customer journey to the applicable SCA requirements and any exemption used. For remote electronic payments requiring dynamic linking, Article 5 links authentication to the agreed amount and payee; changing either must invalidate the generated code. Test those changes, alongside factor independence, recovery flows and protection of authentication information. [6]

For Article 18, examine the real-time risk analysis, applicable thresholds and fraud-rate calculations. Reconcile transaction and fraud data, test completeness and challenge exemption decisions using representative cases. Check escalation when fraud limits are breached. Article 20 has separate notification and cessation requirements, so an annual review must not become a reason to delay action. [7]

Article 17 corporate payment arrangements need their own evidence: describe the services relying on the exemption and explain equivalent security. SUP 16.13.20D specifies submission at least three months before use and inclusion in subsequent relevant assessments. Treat this as a planned dependency when introducing a corporate payment channel. [3]

Turn findings into decisions and a clear submission

Give each finding a risk-based priority, accountable owner, target date and closure test. Explain the exposure in business terms: unauthorised payments, unavailable services or compromised customer information. Separate completed fixes from planned work. Re-test before closing significant findings and record management’s rationale for accepting any remaining risk.

Bring the results to the appropriate management forum. A useful review pack shows material weaknesses, changes since the previous assessment, evidence gaps and overdue actions. Ask reviewers to challenge optimistic conclusions, particularly where recent incidents contradict a satisfactory control rating. Keep a record of decisions and escalation.

Finally, reconcile the form with the underlying report. The currently linked REP018 form requires both assessments in one PDF and limits several summaries to 400 characters. Use those fields to convey the material issue and status, with detail in the attachment. Check dates, audit references and complaint counts against source records, then retain the submitted version and acknowledgement. [1]

Frequently asked questions

Is completing REP018 enough to demonstrate SCA compliance?

No. Plan reporting, control implementation and Article 3 assurance as connected activities with separately defined deliverables. [2]

Can an internal team perform the SCA audit?

Potentially, subject to expertise, operational independence and the external-audit requirements described above. [2]

Can we reuse the September 2019 form?

Check the current FCA link first. The 14 September version differs from the 27 September 2019 version currently linked in Annex 27G: the nil-return instruction now skips questions 2–10. Historical wording is not a substitute for checking current UK requirements. [1] [8]