Embedded payments in 2026: what the evidence actually says

Embedded payments have moved from an add-on to the main way vertical software companies make money. The software business gains because payments improve retention and revenue quality. The merchant gains because one provider means one onboarding, one place to reconcile and one number to call. Both of those benefits only hold if the software business also takes on what comes with moving up the value chain: liability, underwriting, KYB, scheme compliance and safeguarding.

What is new for 2025 and 2026 is regulatory and infrastructural rather than commercial. FCA safeguarding reform (PS25/12) comes into force on 7 May 2026. The Payment Systems Regulator is being abolished and its functions transferred to the FCA. The National Payments Vision now has a delivery roadmap in the Payments Forward Plan. The £100 contactless limit was removed on 19 March 2026. Account-to-account payments have crossed into everyday use. In the EU, the PSD3 and PSR package has final texts and the Instant Payments Regulation has made Verification of Payee mandatory.

The strongest arguments avoid pricing entirely. They rest on operational substance: single onboarding and KYB, settlement and reconciliation inside the software, disputes, authorisation reliability, and resilience. All of these have primary UK and EU data behind them, and all of them allow an honest account of the downsides.

The structural shift is real

The progression runs referral, then ISO or reseller, then payment facilitator, then managed PayFac. What changed is that payments and financial services now make up the majority of revenue at the most mature software platforms, and that managed PayFac has lowered the barrier for mid-market vertical software to own the merchant experience without full scheme registration.

Flagship Advisory Partners notes the ISV and software channel is less mature in the UK than in North America, and less mature again in the EU, but accelerating rapidly in both markets. It also notes that at scale it is not unusual for a software company to generate more than half its revenue from payments.

Open Banking Limited gives the clearest UK signal. Open banking payments reached 351 million in 2025, up 57% on 2024, with 24 billion API calls and 16.5 million user connections by December 2025. In Impact Report 7 (May 2025), 31 million open banking payments were made in March 2025, roughly 7.9% of all Faster Payments, growing 70% year on year, with variable recurring payments at 13% of the total, across 145 live third party providers. The UK passed 1 billion cumulative open banking payments and 100 billion API calls in July 2026.

OBL and EY analysis (December 2025) estimated open banking has delivered around £8.3bn of cumulative benefit, rising to a potential £43bn a year at full maturity. That is commissioned modelling, not a measured figure, and should be read as such. Bain and Bain Capital put embedded finance at $2.6 trillion, nearly 5% of total US financial transactions in 2021, rising above $7 trillion by 2026; that is a US forecast.

What it means for the software business

The upside is straightforward. Payments add revenue beyond subscription. They cross-sell at almost no extra acquisition cost. They raise switching costs, because payments sit inside the merchant's daily cash flow rather than alongside it. They give the software business ownership of onboarding, branding, support and data. And they ease the narrow-addressable-market problem, because payments revenue grows with the merchant's turnover rather than with seat count.

The counterweight is the part most content leaves out. Moving toward PayFac brings liability, merchant underwriting, KYB, scheme compliance, fraud monitoring and dispute exposure. For a UK authorised payment institution, safeguarding reform is the largest new burden.

In CP24/20 (25 September 2024) the FCA reported that for firms that became insolvent between Q1 2018 and Q2 2023, the average shortfall in customer funds owed was 65%. PS25/12 (7 August 2025) introduces a Supplementary Regime.

• Daily safeguarding reconciliations, excluding weekends and bank holidays
• A resolution pack
• A new monthly regulatory return
• Annual safeguarding audits, above a £100,000 relevant funds threshold
• In force 7 May 2026; a deferred Post-Repeal Regime would impose a statutory trust over relevant funds, and the FCA has not committed to implementing it

Scheme pressure is rising too. Visa's consolidated Acquirer Monitoring Program took effect in June 2025 and tightens the excessive dispute threshold to 1.5% from April 2026. A software business inherits that threshold when it owns the merchant relationship.

What it means for the merchant

The strongest primary evidence here belongs to the regulator. The Payment Systems Regulator's Card-Acquiring Market Review (final report, MR18/1.8, 3 November 2021) found that the supply of card-acquiring services does not work well for small and medium-sized merchants, or for large merchants with annual card turnover up to £50 million.

• Many small and medium-sized merchants rarely search for providers and rarely consider switching
• A merchant typically cannot use its existing POS terminal with a new acquirer
• Cancelling a terminal contract can trigger a significant early termination fee
• Acquiring contracts run indefinitely, so nothing prompts a review
• Where merchants did negotiate, nearly 90% got a better deal

The supply of card-acquiring services does not work well for small and medium-sized merchants.

Remedies followed in the final decision of October 2022: POS terminal contract terms capped at an 18 month initial term for merchants with turnover up to £10m from January 2023, with trigger messages and summary boxes from July 2023.

The read-across is direct. Merchants do not shop for acquiring separately. Embedding payments in software they already use removes the search and switching friction the regulator identified. In plain merchant language: one login, one bill, one place to reconcile, one number to call, and no rekeying the same figures twice.

It is worth naming the uncomfortable part. Embedded payments work partly because of the inertia the regulator called a market failure. One demand signal, directional only because it is North American: the J.D. Power 2026 US Merchant Services Satisfaction Study, fielded August to October 2025, found only 51% of customers never encounter a system problem, down from 55%, making reliability a leading satisfaction driver, and that 92% of US merchants now accept digital wallets.

The 2026 regulatory radar

United Kingdom, with dates and status:

• Safeguarding reform: PS25/12 published 7 August 2025, Supplementary Regime in force 7 May 2026. Final rules. Post-Repeal Regime deferred. The FCA's payments Market Focus report for the non-bank sector is expected in March 2026.
• PSR abolition and transfer to the FCA: announced 11 March 2025; HM Treasury consultation 8 September 2025, confirmed in the response of 21 April 2026; Financial Services and Markets Bill 2026 first reading in the Lords on 19 May 2026. Legislated for but not commenced, so the PSR keeps its statutory powers until transfer. The substance of regulation does not change, only the supervisor.
• National Payments Vision (14 November 2024) and the Payments Forward Plan (26 February 2026): a three year roadmap sequencing retail payments infrastructure, open banking rules (FCA consultation Q3 2026, policy statement Q1 2027), PSR consolidation, the PSRs and EMRs review, stablecoins and the digital pound.
• Contactless limit removal: confirmed 19 December 2025, in force 19 March 2026. The £100 single and £300 cumulative limits are replaced by a risk based SCA exemption. Most banks are expected to keep £100 in the short term; the FCA modelled a worst case increase of up to 131% in contactless fraud at £150 per transaction and £450 cumulative.
• APP fraud reimbursement: live since 7 October 2024 under Specific Direction 20, with an £85,000 cap and a 50/50 split between sending and receiving firms. A year on, 88% of claimed losses were reimbursed, up from 66%, with 84% of claims resolved within five business days and around £215m reimbursed during 2025.
• Open banking and VRP: the UK Payments Initiative, made up of 31 firms, was formed to run a commercial VRP scheme, with first live commercial VRP payments expected in Q1 2026. HM Treasury is expected to legislate during 2026 under the Data (Use and Access) Act 2025.
• Infrastructure: the Bank of England's renewed RTGS core, RT2, went live on 28 April 2025. CHAPS cleared a record £93.9 trillion in 2025. Faster Payments processed 5.55 billion transactions worth £4.84 trillion in 2025 (Pay.UK).

The independent Frontier Economics evaluation published by the PSR on 1 July 2026 found in-scope APP losses over Faster Payments fell by around 21%, roughly £73m a year, but with displacement to channels outside scope. International losses rose from £21m to £60m, and crypto from around £59m to around £153m. The PSR will consult on changes in December 2026. Reimbursement did not solve fraud; it moved some of it.

European Union, carrying the EU scope caveat. The PSD3 and PSR package reached provisional political agreement on 27 November 2025, with final compromise texts published 23 April 2026 and Official Journal publication expected in the first half of 2026. The PSR applies directly around 20 days after publication; PSD3 is a directive needing roughly 18 months of national transposition, so it applies in 2027 or 2028. It folds e-money into a single payment institution regime, extends fraud liability including to online platforms that fail to remove notified fraudulent content, strengthens open banking data access, and mandates Verification of Payee for credit transfers.

Under the Instant Payments Regulation (EU) 2024/886, euro area PSPs have had to receive instant euro payments since 9 January 2025 and send them since 9 October 2025. Verification of Payee became mandatory on 9 October 2025 for euro area PSPs, including EMIs and PIs, and applies from 9 July 2027 for non-euro area EEA PSPs. The figure of around €2.4bn of annual authorised push payment fraud losses in Europe is an industry estimate, not a European Commission number.

The operational reality

This is where the real argument sits: running payments badly is expensive, and running them well is defensible ground.

Disputes, global scope. Mastercard's 2025 State of Chargebacks Report with Datos Insights projects global chargeback volumes rising from 261 million in 2025 to 324 million in 2028, a 24% increase, with value rising from $33.79bn to $41.69bn. Around 45% of merchant chargebacks are identified as first party or friendly fraud, and card-not-present transactions account for 63% of merchant transactions.

UK fraud context. UK Finance's Annual Fraud Report 2026 puts total payment fraud at £1.28bn in 2025, up 4%. Unauthorised fraud losses on UK-issued cards were £594.9m, with remote purchase fraud the main driver at £423.5m, up 13%. Contactless fraud stays low at roughly 1.3p per £100 spent, and banks reimburse more than 98% of unauthorised fraud cases.

Authorisation rates are where an honest writer admits a gap. There is no single UK or EU card-not-present approval rate published with full methodology. Visa Consulting and Analytics notes US approval rates have fallen below 87% (US scope), and Visa reports a 4.6% authorisation lift globally for tokenised card-not-present transactions compared with PAN. The cleanest EU primary risk data remains the ECB's report on card fraud in 2020 and 2021 (26 May 2023): card fraud was 0.028% of SEPA card payment value in 2021, €1.53bn of €5.40tn, with card-not-present fraud around 84% of total card fraud value, down 12% after PSD2 strong customer authentication.

Account-to-account reliability matters directly to any argument about settlement and reconciliation. OBL reports weighted availability above 99.50% across 2025 and average API response times improving to 324ms. A2A is not purely good news for software businesses either: it is the clearest UK growth signal and a possible substitute for the card rails they might otherwise monetise.

Where the vertical evidence is strongest

Education is the strongest UK case, though the numbers are vendor research and should illustrate rather than prove. ParentPay states it is trusted by more than 11,000 schools across the UK, providing payment services to over 4 million parents, with customer satisfaction above 95%. ParentPay and LACA research found 60% of UK schools already have cashless facilities and 23% plan to within two years. A Gloucestershire deployment across 175 primary schools contributed to a 26% increase in meal uptake.

Retail, hospitality and catering rest on UK Finance primary data. UK Payment Markets 2025: total UK payments reached 49.7 billion in 2025, up 2%, with cards at 64% of all payments. Contactless accounted for 19.2 billion payments, 39% of the total, up from around 3% a decade earlier. 65% of adults were registered for a mobile wallet, up from 57% in 2024, and cash fell to 8% of payments. In November 2025 card spending data, contactless was 76% of debit and 66% of credit card transactions. Mobile wallet adoption skews young, 89% of 25 to 34 year olds against 29% of over 65s.

Sport and leisure has little direct UK primary data. It is better covered through the general contactless, mobile wallet and A2A evidence above, with the thinner sourcing acknowledged rather than papered over.

What would change this view

• If the Post-Repeal safeguarding regime is confirmed, safeguarding moves from tightening to a structural change in how client funds are held.
• If commercial VRP volumes scale after the Q1 2026 launch, account-to-account moves from emerging to established.
• If the FCA transfer commences, every PSR reference needs updating.
• If the FCA moves on wider SCA reform, authentication friction becomes a first-order operational topic.

The same regulatory wave cuts both ways. Consolidating the PSR into the FCA reduces friction across the market; safeguarding reform raises the compliance burden at the same time. An honest read holds both at once, and that is the position VestaOne works from.