How a FinTech group used Process Street to build the control framework behind a new Payment Institution licence and to prove it was being followed
The journey toward securing a Payment Institution licence is often characterized by the tension between theoretical compliance and operational reality. For Magnus 1265 Ltd, a fintech enterprise specializing in card-present payment gateways and back-office facilitation, the challenge was not merely writing down its internal controls, but proving to regulators that these controls were the heartbeat of the organization’s daily operations. By shifting from static documentation to dynamic, automated workflows via Process Street, Magnus—and its regulated arm, Elgar Payments Ltd—successfully navigated the rigorous regulatory landscape of Gibraltar, securing their licence in April 2026.
The Regulatory Landscape and the Compliance Trap
In the highly scrutinized world of financial services, regulatory bodies such as the Gibraltar Financial Services Commission (GFSC) demand more than a collection of policy manuals. The threshold for obtaining a Payment Institution licence requires demonstrable proof of robust internal governance. Regulators are increasingly moving away from "tick-box" exercises, instead prioritizing evidence of operational integrity, including consistent customer onboarding, rigorous Know Your Customer (KYC) procedures, granular risk assessments, and continuous transaction monitoring.
Many firms fall into what industry experts call the "Documentation Trap." This occurs when companies produce extensive Word documents and SOPs (Standard Operating Procedures) that are filed away, while employees continue to perform tasks based on tribal knowledge or memory. This disconnect creates a significant audit risk. When an auditor asks, "Who performed this check, when was it done, and where is the proof?" a document that describes how a process should work is insufficient. The regulator demands the artifact of the work itself.
The Magnus Group Strategy
Magnus Group, already holding the demanding PCI DSS and PCI PIN certifications, understood that the architecture of compliance for a Payment Institution licence was structurally identical to the security standards they already maintained. Certification, whether in data security or financial regulation, relies on the same core principle: evidence must be a byproduct of the process, not a retrospective reconstruction.
To avoid the pitfalls of static documentation, Magnus CTO Chris Jamieson led a strategic shift. Rather than drafting static procedures, the group utilized Process Street to digitize their operational framework. This approach transformed their compliance manual from a dormant reference guide into a living, breathing operational system.
The implementation was not a casual side project. Recognizing that technology is only as effective as its adoption, the group engaged third-party consultants to audit their informal, undocumented practices. These consultants worked to translate legacy habits into structured, repeatable workflows. This project-based implementation ensured that every employee—from front-end onboarding staff to back-office risk analysts—operated within the same standardized, auditable framework.
Chronology of the Licensing Process
The path to the April 2026 authorization was marked by several critical milestones:
- Phase 1: Diagnostic Assessment (Early 2025): Magnus identifies the gap between its existing operational practices and the stringent requirements of the Gibraltar regulator. The decision is made to move away from static documentation.
- Phase 2: Workflow Architecture (Mid-2025): Engagement of external consultants to map out "ground-truth" processes. The team begins digitizing KYC, vendor management, and transaction monitoring into the Process Street platform.
- Phase 3: Operational Integration (Late 2025): The platform becomes mandatory for all core operational tasks. Employees are trained to use the software as their primary interface for completing daily duties, effectively forcing adherence to the control framework.
- Phase 4: Regulatory Review (Q1 2026): The regulator conducts an on-site assessment. Instead of presenting policy documents, Elgar Payments provides real-time access to the audit trail generated by their automated workflows.
- Phase 5: Authorization (April 2026): Elgar Payments Ltd is officially granted its Payment Institution licence.
The Impact of Automated Evidence
The primary advantage of the Process Street integration was the automation of audit trails. Because the work occurred entirely within the platform, the evidence was captured as an inherent part of the task completion. Each workflow run automatically recorded who performed a specific step, the timestamp of that action, and any attached documentation (such as identity verification documents for KYC).
This granular visibility provided a "single source of truth." When the regulator requested proof of a specific transaction monitoring event, the firm could produce a complete, time-stamped history. This shifted the nature of the regulatory conversation from defensive explanation to proactive demonstration.
Yael Massias, Head of Compliance at Elgar Payments Ltd, noted that the ability to present a concrete record during the assessment significantly altered the firm’s interaction with the regulator. "An application of this kind is really a sustained test of whether your controls are genuine," Massias explained. "Having onboarding, risk assessment, KYC review, and transaction monitoring running as live workflows meant that when we were asked a question, we could answer it with the actual record rather than a description of what should have happened."
Operational Benefits Beyond Compliance
While the regulatory success was the primary catalyst for this shift, the internal operational benefits have been equally significant. By enforcing a standardized workflow, the firm has effectively eliminated the "human factor" of memory-based work.
According to Chris Jamieson, the transition has fundamentally changed the internal culture. "You’ve got to work through the checklist. You’ve got no option," he observed. "You’ve got to tick the boxes, you’ve got to follow the steps. We definitely find that it reduces error and makes the team a lot more focused on the task at hand."
This systematic approach provides several quantifiable advantages for a fintech firm:
- Reduced Operational Risk: By eliminating manual steps and ensuring that no phase of a process is skipped, the firm lowers the risk of human error in high-stakes areas like KYC and AML (Anti-Money Laundering) checks.
- Scalability: As the business grows, the standardized workflow ensures that new employees are trained to the same level of compliance and efficiency as veterans.
- Audit Readiness: The firm is in a state of "perpetual audit readiness." Because the evidence is generated in real-time, the need for frantic preparation before an inspection is eliminated.
Broader Industry Implications
The Magnus Group case study serves as a bellwether for the fintech sector. As regulatory scrutiny increases across the European and global financial markets, the traditional reliance on paper-based or static document-based compliance is becoming a competitive disadvantage.
Financial institutions are increasingly expected to demonstrate "compliance by design." This involves integrating risk management and regulatory controls directly into the technical stack of the organization. The success of Magnus Group suggests that firms that prioritize the integration of operational workflows with their digital infrastructure are better positioned to meet the demands of modern regulators.
Furthermore, this model challenges the notion that compliance is merely a cost center. When implemented effectively, the process-oriented approach provides insights into operational bottlenecks and productivity metrics, turning a regulatory requirement into a tool for business optimization.
As the fintech industry continues to mature, the gap between "documented processes" and "followed processes" will likely remain the primary metric by which regulators assess institutional safety. For firms like Magnus and Elgar, the path forward is clear: the future of compliance is not found in the files we keep, but in the precision with which we conduct our daily work. By ensuring that every action is verified, recorded, and optimized, the firm has not only secured its license but also reinforced the foundation upon which its future growth will be built.
