Who the rules apply to
The rules were made in policy statement PS25/12 of 7 August 2025 and apply to authorised payment institutions, other than those that provide only payment initiation or account information services, to authorised and small electronic money institutions, and to credit unions that issue electronic money. A small payment institution is not required to safeguard, but it may opt in, and if it does the rules apply to it in full. The FCA described the rules as a supplementary regime: they support the existing legislative requirements rather than replace them. Its proposal for an end-state regime, under which relevant funds would be held on statutory trust and received directly into a designated safeguarding account, drew substantial objection and the FCA has said that it will not take it forward without further consideration and consultation, after it has reviewed how the supplementary regime has worked over a full audit period.
The rules are in chapter 15 of the FCA's Client Assets sourcebook, CASS 15, with the resolution pack in CASS 10A, the audit in SUP 3A and the return in SUP 16.14A, and the FCA has amended its Approach Document to match. The reason for them is set out in the policy statement: for payment firms that became insolvent between the first quarter of 2018 and the second quarter of 2023, the average shortfall in funds owed to customers was 65 per cent, and funds held by payment and e-money firms are not covered by the Financial Services Compensation Scheme if the firm itself fails.
Organisation and segregation
A firm must have adequate organisational arrangements to protect its clients' rights in relevant funds and to prevent their use for its own account. Responsibility for oversight of operational compliance with the safeguarding requirements must be allocated to a single director or senior manager, who reports to the governing body. Funds received must be allocated to the individual client no later than the end of the business day following receipt; until then they are recorded as unallocated relevant funds and safeguarded in the same way, and funds whose source cannot be identified are recorded as unidentified relevant funds while the firm takes steps to identify them.
Where the firm safeguards by segregation, the relevant funds are held in a safeguarding account with an authorised credit institution, or invested in secure, liquid, low-risk assets held with an authorised custodian. The permitted assets are unchanged by the new rules, and a firm that wants to use another class of asset must apply to the FCA in writing. Relevant funds received for electronic money must be kept separately from those received for unrelated payment services, with separate reconciliations for each. The firm must exercise due skill, care and diligence in selecting the banks, custodians, insurers and guarantors it uses, review them periodically and consider whether to diversify among them, and it must obtain a signed acknowledgement letter in the FCA's template for each safeguarding account, reviewed at least annually.
Reconciliations
The rules require two reconciliations. The internal safeguarding reconciliation compares the firm's own records of what it should be safeguarding, the safeguarding requirement, with what its records show is held, the safeguarding resource, and compares the amount that should be in safeguarding accounts on the day after receipt with the balances actually there. The external safeguarding reconciliation compares the firm's records with the statements of the banks, custodians and other third parties that hold the funds or assets. Each must be performed as often as necessary and at least once each reconciliation day, which excludes weekends, bank holidays and days on which relevant foreign markets are closed, at a reconciliation point that is the same each day and is recorded in the firm's policies. The FCA has simplified the method from the one it consulted on, and a firm may use a non-standard method if it documents why that method meets its obligations and an independent auditor confirms it in a written report.
A shortfall identified by the internal reconciliation must be paid into a safeguarding account or invested in relevant assets as soon as possible and in any case by the end of the day on which the reconciliation is performed, from the firm's own funds if relevant funds cannot be used; an excess must be withdrawn. A discrepancy identified by the external reconciliation must be investigated and resolved without undue delay, and while it is unresolved the firm must assume that the record showing the greater amount is accurate and top up accordingly. The firm must notify the FCA in writing without delay if its records are materially out of date or inaccurate, if it will be unable to perform a reconciliation, or if it will be unable to remedy a discrepancy. Records of each reconciliation, with the time, the actions taken and the outcome, are kept for five years.
The resolution pack
A firm must maintain a resolution pack, a set of documents and records that would enable an insolvency practitioner to return relevant funds to customers quickly if the firm failed. The FCA's experience from the equivalent packs kept by firms that hold client money under its client assets rules is that the most effective are living documents that link directly to the latest versions of the records they contain, such as where relevant funds are held, the firm's agents and distributors, and its procedures for the management, recording and transfer of relevant funds and assets. Firms with simpler systems need less time to assemble theirs, and the content is information the FCA expects a firm to maintain in the ordinary course of business.
The monthly return and the annual audit
Every firm within the rules submits a new monthly safeguarding return to the FCA, which replaces the safeguarding questions in its other regulatory returns. The return reports the comparison of the funds that should be in safeguarding accounts with the balances held, confirms that at least one internal and one external reconciliation was performed each reconciliation day, identifies firms using a non-standard reconciliation method or an unlimited insurance policy or guarantee, and gives detail on relevant assets and the custodians that hold them. An electronic money institution that also provides unrelated payment services answers for each pool of funds separately.
Most firms must also arrange an annual safeguarding audit by a qualified auditor, who need not be the firm's statutory auditor, and submit the report to the FCA. The first report under the rules is due within six months of the end of the period it covers and later reports within four months, and the period covered by a report may not end more than 53 weeks after the previous one. A firm that has not been required to safeguard more than £100,000 of relevant funds at any time over a period of at least 53 weeks is exempt, and its senior management must determine on a continuing basis whether the exemption still applies. The FCA expects an auditing standard from the Financial Reporting Council to accompany the audits.
Insurance and guarantees
A firm may still safeguard by means of an insurance policy or a comparable guarantee, but the rules now set conditions. The policy must pay out on an insolvency event with no condition or restriction other than certification of that event, the proceeds must be paid promptly into a safeguarding account, and the provider must give at least three months' notice of cancellation. The firm must notify the FCA at least two months before it uses the method for the first time, changes the cover or changes the provider, with an assessment of the operational and liquidity risk of holding funds outside a safeguarding account. No later than three months before the policy expires the firm must decide whether it will continue with the method and tell the FCA, and if it has no renewal or replacement in place it must submit a plan for moving all relevant funds to segregation. Respondents to the FCA's consultation reported that few providers offer this cover, and an applicant that intends to rely on it should have the policy agreed in principle before it applies.
What an applicant must show
The FCA's application pages now state that an application must include the firm's arrangements for safeguarding under these rules, and the safeguarding model is assessed together with the financial projections and the wind-down plan. In practice an applicant needs, before it submits: the safeguarding account and acknowledgement letter, or the insurance in principle; the written policies and procedures covering allocation, reconciliation points and frequency, discrepancies and third-party reviews; the design of the daily reconciliations and the ledgers they draw on; the resolution pack; the allocation of responsibility to a named director or senior manager; and the arrangements for the monthly return and the annual audit. A firm that cannot show these at application is unlikely to be authorised, and an authorised firm that cannot evidence them is exposed to the FCA's supervisory action.
How we can help
We prepare the safeguarding arrangements for applications and review them for authorised firms, including the policies, the reconciliation design, the resolution pack and the audit preparation. See compliance consulting and payment institution and EMI authorisation, or speak to us. Our note on EMI or payment institution explains which authorisation a firm needs, and firms that hold e-money tokens for clients should also read our note on e-money tokens and PSD2.
Sources
- Financial Conduct Authority, PS25/12: Changes to the safeguarding regime for payments and e-money firms, 7 August 2025
- Financial Conduct Authority, FCA sets out changes to payment safeguarding rules, 7 August 2025
- FCA Handbook, CASS 15: Payment services and electronic money: relevant funds
- Financial Conduct Authority, Apply to become an electronic money or a payment institution
Checked 13 October 2026.