FCA listens but pushes on with implementing changes to safeguarding requirements for UK payment institutions and e-money institutions

The FCA has published Policy Statement 25/12 which sets out respondent feedback to proposals outlined in consultation paper CP24/20 published on 25 September 2025, and the final rules on the Supplementary Regime (previously the ‘interim rules’) on safeguarding rules for e-money institutions and payment institutions (“Payment Firms”) . 

The policy statement is significant as it kicks off the implementation period for the revised safeguarding regime which will take effect on 7 May 2026, which Payment Firms will have just under 9 months to prepare for.

The Policy Statement also includes amendments to the FCA’s “Payment Services and Electronic Money - Our Approach document” (“Approach Document”).

These are important changes to the UK payment services industry and stem from the FCA becoming increasingly worried about the safeguarding practices over the years and the potential risk to customers of Payment Firms. The FCA estimates that in 2021 that payment institutions safeguarded £6bn relevant funds on any given day.

The UK Financial Services Compensation Scheme (“FSCS”) is designed to protect customer money in times of failure. If a Payment Firm’s UK safeguarding bank fails, the FSCS may be able to ‘look-through’ the Payment Firm to compensate its customers. However, the FSCS does not cover cases where the Payment Firm itself fails, meaning that consumers may lose money if their Payment Firm fails and/or face significant delays in receiving their funds if a Payments Firm’s safeguarding practices are inadequate.

The FCA has previously addressed concerns of safeguarding risk through the publication of additional guidance on safeguarding requirements and the organisational arrangements required to protect these safeguards in the Approach Document, as well as several letters to payments and e-money firms on adhering to safeguarding requirements. Some of this additional guidance was during Covid with a significant uptick in the number of Payment Firms failing and the FCA’s concern with firms not properly safeguarding funds, failing to properly perform reconciliations and not holding adequate records. Also, firms have not developed adequate wind-down plans. These developments have also been in parallel to the introduction of the Consumer Duty principles-based regime intended to more broadly ensure firms are delivering good outcomes for consumers.

Background

Payment firms are required to safeguard “relevant funds” (being monies received in connection with their payment services or in exchange for the issue of e-money) and to do so immediately upon their receipt. Payment Firms handle large amounts of customer monies and the intention of the safeguarding rules is to ensure that, if a Payment Firm fails, the customer monies it is holding can be: (1) identified separately from the Payment Firm’s own funds; and (2) rapidly applied to discharging its customer obligations rather than in payment of the costs of the insolvency of the Payment Firm and then by distribution to its creditors generally.

The FCA’s intention in introducing the Supplementary Regime is to address current weaknesses still seen by the FCA and lead to better customer outcomes in the event of a failure of a Payment Firm.

• Minimising shortfalls in safeguarded relevant funds. For firms that became insolvent between Q1 2018 and Q2 2023, there was an average shortfall of 65% in funds owed to clients (difference between funds owed and funds safeguarded)
• Ensuring these funds are returned to customers as cost-effectively and quickly as possible if a payments firm fails. It’s estimated that the average time to return funds to customers will reduce from 2.3 years to 1.3 years.
• Strengthening the FCA's ability to identify and intervene in Payment Firms that do not meet safeguarding expectations to ensure these outcomes are met.

The Policy Statement sets out final rules and guidance for the Supplementary regime. The ‘Supplementary Regime’ and ‘Post-Repeal Regime’ are used to describe the two stages. A decision on the Post-Repeal Regime and whether it will go ahead is to be determined by the FCA. 

For a more detailed analysis of what both the Supplementary and Post-Repeal Regimes may look like, we have written about it in our previous article on CP24/20 here.

Approach to the safeguarding regime changes

The intention behind the Supplementary Regime (previously the ‘interim rules’) is to support existing safeguarding requirements outlined in the Electronic Money Regulations 2011 (“EMRs”) and Payment Services Regulations 2017 (“PSRs”) with the objective of improving compliance with these regulations, supporting record-keeping and enhancing reporting and monitoring requirements with an aim of identifying any potential shortfalls of relevant funds and improving the FCA’s oversight so that it can monitor and intervene at an earlier stage if necessary. 

The Policy Statement sets out final rules and guidance for the Supplementary Regime. The Supplementary regime and related amendments to the Approach Document will come into force on 7 May 2026.

Before then, payment firms that receive funds to make a payment for a customer, or in exchange for e-money issued, will need to familiarise themselves with the new rules and guidance that will be introduced in CASS 10A, CASS 15, SUP 3A, SUP 16.14A and the updated Approach Document. They will also need to establish systems and controls to comply with the Supplementary Regime rules in CASS 10A, CASS 15, SUP 3A and SUP 16.14A.

The Post-Repeal Regime (previously the ‘End-state rules’) was initially touted as eventually replacing the safeguarding requirements of the EMRs and PSRs with a ‘CASS’ style regime, where relevant funds and assets would be held on trust for consumers. The FCA proposes that the Post-Repeal Regime will replace the existing regime if, and when, the existing safeguarding requirements of the EMRs and PSRs are repealed under the Financial Services and Markets Act 2023. The timeline for this would have been determined by HM Treasury. However, this Policy Statement emphasises that the Post-Repeal Regime is still up for consideration and, as such, the FCA have not provided their approach to the feedback from respondents on the Post-Repeal Regime.

Summary of changes under the Supplementary Regime

The view of the FCA is that this Policy Statement improves some implementation pressure points without compromising the overall effectiveness of the final version of the Supplementary Regime. For example, the FCA has:

• amended the rules so that reconciliations are not required on weekends and bank holidays.
• introduced a threshold of £100,000 relevant funds at any time over a period of at least 53 weeks, under which Payments Firms will not be required to arrange a safeguarding audit.
• removed the requirement for a limited assurance audit for Payment Firms holding no relevant funds.
• increased the implementation period before the rules come into force from six months to nine months.
  • There is an exemption that firms safeguarding less than £100,000 of relevant funds at any time over a period of 53 weeks will not be required to carry out safeguarding audit requirements under SUP 3A.

Changes to the Supplementary Regime include a wide range of topics which we have outlined in our previous insight on the consultation.

Below is a breakdown of how the FCA has addressed concerns from respondents to the Supplementary Regime.

Reconciliation: under the consultation, payment firms would have been required to perform internal and external safeguarding reconciliations at least once each business day. However, given the concerns about cost and challenges in performing reconciliations on weekends and bank holidays.  The FCA have amended the rules so that safeguarding reconciliations are required at least once each reconciliation day, rather than business day. 

• Reconciliation days exclude weekends, bank holidays, Christmas, Good Friday and days on which relevant foreign markets are closed. 

Further simplification for reconciliation has been provided:

•  The FCA has replaced the relevant funds deposit resource and requirement reconciliation with a higher-level comparison of the relevant funds that should be held in relevant funds bank accounts, or as relevant assets in relevant assets accounts (the ‘D+1 segregation requirement’) against the balances of those accounts (the ‘D+1 segregation resource’).
• Relevant funds received in respect of e-money must be safeguarded separately from those received for unrelated payment services. There must also be separate safeguarding reconciliations for each.
• A payment firm may use a non-standard method of internal safeguarding reconciliation where it follows certain steps set out in the rules, although an independent auditor must review the proposed method and confirm in a written report that the proposed method meets the payments firm’s obligations.
• External reconciliations are only carried out on reconciliation days.
• The FCA has not prescribed different types of data sources for reconciliations. It will be for Payment Firms to decide which data sources are appropriate for their circumstances on a case-by-case basis.

Safeguarding audits

Most Payment Firms will be required to arrange an annual safeguarding audit report performed by a qualified auditor. A Payment Firm should take reasonable steps to ensure that an auditor has the required skills, resources and experience to perform their functions. Respondents to the consultation were concerned with the costs associated with requiring a skilled person for audits. Currently, paragraph 10.71 of the Approach Document provides guidance to Payment Firms in relation to the appointment of qualified auditors and this change implements the requirement as a rule under SUP 3A.3R. 

The Policy statement outlines the following changes to assist with costs.

• The time for the first audit submission has been extended to six months from four months following the end of the payment firm’s audit period. Subsequent audit submissions will be required to be submitted within four months of the end of the period.
• The FCA will leave it up to firms to decide whether they wish to align its audit period to its financial year.
• Payments Firms can appoint the same auditor for their statutory audit if preferred. 

Safeguarding reporting

• The FCA believes that monthly reporting is necessary and proportionate and has retained the requirement in the final rules.
• The FCA will provide support to Payment Firms in a nine-month implementation period and beyond on completing the return.

When safeguarding starts and ends

• The FCA will consider additional guidance for when safeguarding starts and ends in the Approach Document alongside the Supplementary Regime.
• Inbound transactions: The obligation to safeguard relevant funds begins once the Payment Firm receives the funds, which is defined as when the institution becomes entitled to the funds (e.g. when credited to its account or when cash is handed over).
• Firms must have organisational arrangements to prevent using safeguarded funds to settle payments before receiving the related funds.
• E-money firms must safeguard unclaimed relevant funds for at least six years.

Implementation period

The Supplementary Regime was intended to come into force after a transitional period of six months from publication in final form. However, respondents to the consultation suggested extending the implementation period from nine to twelve months. The FCA is now providing a nine-month implementation period from the publication of the Supplementary Regime rules before they come into force.

The Post-Repeal Regime

The FCA intends to separately consider the consultation feedback on the Post-Repeal regime alongside the review of the effectiveness of the Supplementary Regime in the future as there was a large amount of feedback on this topic. The review will include whether the FCA should continue on with the Post-Repeal regime.

Proposed Post-Repeal rules from the consultation included using the segregation method to receive relevant funds directly into the designated safeguarding account. Many respondents raised concerns about the cost implications of replacing numerous non-bank accounts and standard bank accounts and further risks from payment firms decoupling from their UK operations. As a result, the FCA will not implement the proposal. 

As stated above, the FCA will address these concerns alongside the review of the Supplementary Regime if and when the Post-Repeal regime goes ahead.

Estimated costs too low

Respondents raised concerns that the estimated costs for the Supplementary Regime rules were too low.

In response, the FCA has made the following revisions: 

• The FCA revised its audit requirements so that firms safeguarding under £100,000 over the previous 53 weeks are exempt from arranging a safeguarding audit.
• Respondents to the consultation raised concerns about reconciling on weekends and bank holidays and the final rules will not require reconciliations on weekends, UK bank holidays and the days when relevant foreign markets are closed.

Respondents to the consultation had also raised concerns about the cost of Resolution Packs. However, in the FCAs' experience with CASS firms, these are not intended to be burdensome and can be mostly made up of links to existing documentation.

Conclusion

Firms have under nine months to embed the Supplementary Regime into their safeguarding practices, e.g. including robust record keeping including resolution packs, strengthening governance and due diligence on elements of safeguarding etc.

For some firms, the changes encourage an entire overhaul of existing processes with significant change required, including daily reconciliation, resolution packs, monthly returns and yearly audits and addressing insurance policies and external practices as well as third party risk. 

Firms safeguarding over £100k over a period of 53 weeks will be required to provide an annual audit by a skilled auditor. Firms who meet this threshold will also need to be aware of their requirement to prepare their first annual audit submission six months from the end of the audit period. 

It is very important that firms use this time to ensure they start to meet each requirement prior to 7 May 2026.

Our Payment Services Regulatory team will be monitoring next steps and will keep you up-to-speed with the latest developments. Please do get in touch with the team if you have any questions or would like any assistance with exploring a gap analysis on existing processes or training on how to prepare to ensure compliance with the new regime. 

If you would like to receive our regular payments alerts in your inbox, click here.

If you would like to read Bird & Bird’s previous alerts, please check out our payments insights webpage here.