UK FCA safeguarding changes: new rules for e-money institutions and payment firms

The FCA has introduced a strengthened safeguarding regime for e‑money institutions and payment firms, raising expectations around how customer funds are protected.

Effective from 7 May 2026, these new rules, introduced by the FCA in PS25/12, were in response to persistent safeguarding failures and regulatory structural issues, leading to systemic weaknesses and consumer harm. Firms will need to update processes, systems and oversight urgently to meet the Supplementary Regime requirements ahead of the potential transition to the proposed Post‑Repeal framework.

Why the FCA is strengthening safeguarding rules

The FCA’s updated framework is designed to tighten those controls and ensure that customer money can be returned quickly, accurately and with full legal clarity. Prior to the introduction of these rules, the FCA found that some payments and e-money firms did not have sufficiently robust safeguarding procedures, creating a risk of harm to consumers and market integrity. The FCA identified persistent weaknesses in safeguarding arrangements, including poor record keeping, inadequate reconciliations and delays in returning customer funds on insolvency, prompting the need for a more robust and enforceable framework. This risk is especially concerning in the wider context of the increasing use of payment and e-money accounts by UK consumers.

What is changing under the new FCA safeguarding rules?

The FCA’s proposed framework will bring client money safeguarding standards for e-money institutions and payment services firms closer to parity with investment firms, introducing a significantly higher level of scrutiny than many of these firms have previously faced.

The changes will be made in two stages. Firstly, in the form of the interim rules, called the ‘Supplementary Regime’, which were published alongside the Policy Statement. Stage two will establish the end state rules, known as the ‘Post-Repeal Regime’.

The Supplementary Regime (effective May 2026)

The transitional provisions outline how and when the new rules apply, including the grandfathering of certain existing arrangements and deadlines for compliance. The first set of rules arrives in May 2026 and introduces requirements for firms, including: improved books and records, enhanced monitoring and reporting and strengthening elements of safeguarding practices.

The proposed Post-Repeal Safeguarding Regime

The second stage of reform as proposed would replace the safeguarding requirements with a CASS style regime, where relevant funds and assets would be held in a statutory trust for consumers. It is currently unclear when or if these Post-Repeal changes will come into effect after the consultation process raised some concerns as well as the government’s aim to reduce the regulatory burden for firms.

The requirements are outlined in the following chapters in the FCA handbook: CASS 10A, CASS 15, SUP 3A and SUP 16.14A. This follows a similar structure to the existing reasonable assurance CASS with a resolution pack section (10A), the relevant rules (15), the audit requirements (SUP 3A) and the reporting requirements (SUP16.4A).

Who the new FCA safeguarding rules apply to

Per the FCA Policy Statement PS25-12, these new rules apply to:

• Authorised payment institutions (except payment institutions which solely provide payment initiation services or account information services),
• Authorised e-money institutions,
• Small e-money institutions, and
• Credit unions which issue e-money in the U K.

Small payment institutions will continue to be able to opt-in to comply with safeguarding requirements if they choose to do so.

Payments firms that receive funds to make a payment for a customer, or in exchange for e-money issued, will need to familiarise themselves with our new rules and guidance in CASS 10A, CASS 15, SUP 3A, SUP 16.14A and the updated Approach Document. They will also need to establish systems and controls to comply with the Supplementary Regime rules in CASS 10A, CASS 15, SUP 3A and SUP 16.14A.

The FCA has added the following new chapters:

• CASS 10A: Payment services and electronic money: resolution pack – outlines the requirements for maintaining resolution pack to assist in insolvency scenarios,
• CASS 15: Payment services and electronic money: relevant funds – sets out the safeguarding requirements, including segregation investment, insurance/ guarantee, third party due diligence, reconciliations, and record keeping,
• SUP 3A: Payment services and electronic money (audit requirements) – outlines the audit requirements, auditor appointment, qualifications, independence, cooperation and reporting format, and
• SUP 16.14A: Safeguarding return: safeguarding institutions – introduces the monthly safeguarding return.

What are the key FCA safeguarding changes firms must prepare for?

• Annual audit: All payment and e-money institutions will be subject to an annual audit by a ‘qualified auditor’, except for those who hold less than £100,000 in relevant funds over a period of at least 53 weeks,
• Reconciliation: daily reconciliations of relevant funds,
• Monthly FCA returns: mandatory monthly reporting of safeguarded funds to the FCA for all firms,
• Trust letters: segregated funds must be held under a statutory trust, and all relevant funds should be received in safeguarded accounts,
• Resolution packs: requirement for each firm to maintain a detailed resolution pack, demonstrating a clear wind-down plan to ensure smooth distribution of relevant funds and contingency planning documentation should be in place for the processes to be followed in the event of an insolvency,
• Internal policies: policy and procedure updates to ensure internal policies and procedures comply with the new requirements, and
• Due diligence: firms must carry out annual due diligence to assess third parties that hold relevant funds, such as other payment or e-money institutions.

What firms should do now to prepare for the 2026 FCA rules

These rules represent a significant increase in requirements for these types of firms and therefore preparation is key. Firms should be preparing by:

• Reviewing and updating safeguarding policies and procedures,
• Checking system capability for enhanced reconciliations and monthly reporting,
• Refreshing governance documentation and board oversight,
• Strengthening due‑diligence processes and banking arrangements,
• Ensuring the resolution pack is complete, accurate and easy to retrieve, and
• Reviewing the relevant CASS rulebook against existing process to ensure compliance prior to any assurance being required.

New FCA safeguarding audit requirements explained

Payment and e-money firms, other than a small section of firms which are exempt (holding below £100,000 of relevant funds over a period of at least 53 weeks), will be required to arrange an annual safeguarding audit – separate to their statutory audit – carried out by a qualified independent auditor.

Payment firms will have six months (rather than the originally proposed four months) after the end of that firm’s audit period to submit their first safeguarding audit. The safeguarding report must cover a period that ends no more than 53 weeks after the period covered by the previous report or after the firm becomes subject to the rules. Subsequent audits must be submitted within four months of the end of the relevant audit period.

The FCA has not made rules regarding aligning such periods to a firm’s financial year end, materiality of breaches or using the same auditors for statutory audits and safeguarding audits.

How Saffery can help

If you’re looking for a new safeguarding and/or statutory auditor and you’re an FCA regulated firm, then please reach out to Tom Alun-Jones.