UK Changes to safeguarding regime for payments and e-money firms

Why should I read this?

Authorised payment institutions, e-money institutions and credit unions that issue e-money (Payment Firms) are all required to safeguard funds received from customers in connection with the provision of payment services, or the issuance of e-money, to those customers (Relevant Funds).  In September 2024 the FCA consulted on proposals to reform the rules on safeguarding Relevant Funds to reduce the harm from firm failure in CP24/20 (see our briefing “UK: FCA consults on changes to safeguarding regime”).

The FCA has now issued a policy statement PS25/12, setting out final rules, handbook guidance and its feedback on the responses to the consultation paper. 

The policy statement reiterates that the FCA is seeking to strengthen the safeguarding regime to address weaknesses in relevant firms’ current safeguarding practices, and better protect customers of such firms. The changes are intended to:

• reduce shortfalls in client funds;
• ensure client funds are returned to customers as quickly as possible if a firm fails; and
• make it easier for the FCA to identify and intervene in payment firms that do not meet their safeguarding expectations.

Alongside the policy statement the FCA has published an amended version of its approach document to payment services and electronic money, which provides useful guidance to the industry on applying the relevant rules, marked up to show the proposed changes.

In the original consultation paper the FCA had proposed to make changes in two stages:

• an interim stage (the Supplementary Regime) to encourage greater compliance with existing safeguarding requirements, support more consistent record keeping, and strengthen reporting and monitoring requirements; and
• an end-state (the Post-Repeal Regime), under which the safeguarding requirements of the EMRs and PSRs would be replaced with a ‘CASS’ style regime, in conjunction with the repeal of legislation and moving of the two regimes into FCA rules.

Significantly, the FCA has put the brakes on implementation of the Post-Repeal Regime and will consult further on that implementing regime, once a full audit period/cycle under the Supplementary Regime has been completed.

What do I need to know about the policy statement?

To which firms will the changes apply?

• Authorised payment institutions (except payment institutions which solely provide payment initiation services or account information services)
• Authorised e-money institutions
• Small e-money institutions
• Credit unions which issue e-money in the United Kingdom

(together “payments firms”).

Improved books and records

Payments firms will now be required to:

perform internal and external safeguarding reconciliations at least once per day on usual business days; and

notify the FCA if:

• their internal records are materially out of date;
• they will be unable to perform a reconciliation or remedy a discrepancy in a reconciliation; or
• at any time in the previous year there was a material difference or discrepancy between the amount of Relevant Funds safeguarded and the amount that should have been safeguarded; and

In finalising its position, the FCA has moved away from requiring reconciliations every day or business day, recognising that it may not be appropriate or proportionate to do so on weekends, bank holidays or days on which relevant foreign markets are closed.

The FCA has also simplified the proposed internal safeguarding reconciliation rules replacing them with a higher-level comparison between the Relevant Funds that should be held in accounts with the balances of those accounts. Any shortfall will need to be met by the firm if it cannot be met with Relevant Funds. Relevant Funds relating to e-money will need to be safeguarded separately from those relating to payment services.

The FCA will expect payments firms to use a standard model for internal reconciliation, but non-standard methods will be permitted where those have been reviewed and reported on by an independent auditor.

Resolution packs

Payments firms will also be required to maintain a resolution pack, including documents and records that can be easily retrieved and will help achieve a timely return of relevant funds to customers in the event a payments firm enters formal insolvency.

Audits

Under the Supplementary Regime payments firms which safeguard Relevant Funds will need to undergo an safeguarding annual audit, conducted by a qualified auditor, on the firm’s compliance with the safeguarding regime. Firms which consider they do not hold Relevant Funds will no longer need to conduct limited assurance audits, but their auditors will need to report if they identify Relevant Funds not being safeguarded appropriately.

As an exception to this new requirement, payments firms safeguarding less than £100,000 of Relevant Funds at any stage during a period of at least 53 weeks will not need to arrange a safeguarding audit.

Payments firms will have six, rather than the originally proposed four, months after the end of that firm’s audit period to submit their first safeguarding audit and the period covered by the safeguarding report must not end more than 53 weeks after the period covered by the previous report, or after the firm becomes subject to the rules. The FCA has not made rules regarding aligning such periods to a firm’s financial year end, materiality of breach or using the same auditors for statutory audits and safeguarding audits.

Reporting

Payments firms will not need to submit monthly returns to the FCA on safeguarding. This will be the case for all payments firms. The form of the return has been developed using industry testing and feedback and the FCA will provide support to firms in the nine month implementation period (and beyond) on how to complete the return.

Segregating Relevant Funds

The FCA are introducing a number of rules relevant to the appointment of third parties in connection with the safeguarding of Relevant Funds. In some ways similar to the requirements that apply to firms subject to the FCA’s client money rules, payments firms will need to:

• carry out due diligence on third parties that manage or hold Relevant Funds or hold or manage assets (or provide insurance or comparable guarantees), on their appointment and on then subsequently on a periodic basis;
• consider whether to diversify such third parties;
• consider how to ensure Relevant Funds not in designated safeguarding accounts are clearly identifiable as such; and
• request acknowledgement letters from third parties holding Relevant Funds.

Investing Relevant Funds

Payments firms will continue to be able to invest Relevant Funds in secure, liquid (and so easily realisable) assets. The range of assets in which payments firms can invest will remain the same and not be expanded to, for example, tokenised assets. The rules around the use of third parties as set out above will apply equally to third parties which hold or manage assets of this type.

The FCA may consider expanding the range following the implementation of the Supplementary Regime (for example as part of the implementation of the Post-Repeal Regime).

Insurance and comparable guarantees

Payments firms are also able to safeguard Relevant Funds by ensuring that they are covered by insurance or a comparable guarantee. The FCA is moving existing guidance in its approach document to rules and guidance in its Handbook.

Of particular importance is that a payments firm must decide whether to extend an insurance policy/comparable guarantee at least three months before that expires and, if it does not have arrangements to extend the cover, and the cover has less than three months remaining, the firm must prepare to safeguard all Relevant Funds using the safeguarding method. If it cannot do so, it will need to consider its financial position, including whether it needs to make a claim under the policy or guarantee before it expires.

Payments firms must notify the FCA at least two months before it proposes to use the insurance or guarantee method for the first time, if there are changes to the cover or if there is a change in provider.

What do I need to know about the changes to the FCA’s approach document?

The changes made to the approach document principally constitute a tidying up exercise to ensure that the Supplementary Regime and the approach document do not conflict.

The changes will additionally add further clarity, particularly around when safeguarding obligations are triggered, such that it will:

• explain that the obligation to safeguard Relevant Funds will start as soon as funds are received by the institution (e.g. as soon as they are credited to the account of a payments firm);
• provide guidance on situations where payments are made before the funds received to make the payment have been safeguarded; and
• provide guidance on funds received for foreign exchange transactions, which will provide that if a foreign exchange transaction is carried out independently of any payment services, those funds do not have to be safeguarded.

Next steps

The Supplementary Regime, and related amendments to the Our Approach Document, will come into force on 7 May 2026.

As referred to above, it is not clear from the policy statement when or how the FCA will proceed with implementation of the Post-Repeal Regime.

How Eversheds Sutherland can help

Our cross-border practice has extensive experience of advising financial services clients on the impact of regulatory change, product development, assurance work, participation in financial markets infrastructure, and agency and correspondent banking arrangements concerning payment and settlement systems, payment products and services, digital and mobile commerce, and other fintech solutions. We advise a diverse client base comprising of banks, retail finance providers, card issuers and acquirers, private equity investors, merchants, fintech start-ups and payment system operators through the complex interplay of business trends, technological developments, and a rapidly changing legal and regulatory landscape.