Regulatory Influencer: UK’s Updated Safeguarding Regime Will Demand More From Payment Firms

The Financial Conduct Authority (FCA) has issued a policy statement (PS25/12) outlining new safeguarding rules and signalling a significant compliance overhaul.

Under the new framework, known as the Supplementary Regime, which is to come into force in May 2026, payment and e-money institutions authorised by the FCA will be required to: 

• Conduct daily reconciliations, excluding weekends and public holidays, to ensure the correct amount of customer funds is being safeguarded.
• Arrange annual safeguarding audits carried out by qualified auditors, unless the firm holds less than £100,000 in customer funds.
• Submit monthly safeguarding reports to the FCA.
• Develop and maintain resolution packs to facilitate a faster return of customer funds in insolvency events.
• Undertake due diligence on third parties managing or holding customer funds.
• Ensure safeguarding insurance or guarantees are free from payout restrictions.
• Implement contingency plans at least three months before any insurance policy expiry date, defaulting to segregation of funds if needed.

Although this will be a step change for firms, the fact that the FCA has opted not to implement the so-called “end-state rules” that were included in the original consultation offers some relief. These rules would have included significant changes in some key areas. 

“We received a lot of feedback on the Post-Repeal Regime. Much of it raised concerns about the impact of imposing a statutory trust and receiving relevant funds directly into a designated safeguarding bank account,” the regulator said.

It added that it has “listened closely to the concerns” and does not plan to implement the proposals “without further consideration and consultation”. 

However, once a full audit period has been completed, after the Supplementary Regime has come into force, the FCA has confirmed that it plans to “review its implementation and consult on further proposals if changes are necessary”. 

The bigger picture 

The new rules are designed to ensure that customer funds are properly safeguarded and can be swiftly returned if a firm fails, addressing persistent weaknesses identified by the regulator in past insolvencies. 

The FCA notes in its policy statement that between Q1 2018 and Q2 2023, failed payment firms had average shortfalls of 65 percent of their customers’ funds, highlighting systemic flaws in safeguarding practices.

This comes as more UK consumers use payment accounts with payment firms: the proportion rose from 1 percent in 2017 to 12 percent in 2024, according to the FCA’s Financial Lives Survey. 

In 2024, e-money institutions safeguarded around £26bn, up from £11bn in 2021, and payment institutions held £6bn daily.

Such growth increases the risk of widespread harm if a firm fails, especially if poor records delay the identification and return of funds, or if large firms hold money for other regulated entities, potentially triggering wider disruption. 

Vulnerable consumers, who the FCA says make up 40 percent of e-money account holders, are particularly at risk, as many rely on such accounts for everyday transactions.

In its policy statement, the regulator said it had found persistent weaknesses in safeguarding practices, despite existing rules and guidance.

It identified common failings in its 2025 portfolio letter and a recent multi-firm review. These include poor risk management and inadequate understanding of liquidity risks.

In its most recent portfolio letter, the regulator warned that firms need to ensure that their safeguarding policies are in line with the payment services regime in the UK. 

Legal uncertainty has also plagued the UK following the insolvency of Ipagoo LLP, an e-money institution, which further complicated the treatment of shortfalls in insolvency.

In its 2022 judgment, the Court of Appeal dismissed the FCA’s bid to establish that the UK’s Electronic Money Regulations impose a statutory trust over funds from e-money holders. It also rejected administrators’ arguments to limit the asset pool, and ruled that no statutory trust exists and that such a trust is not required under EU directives. 

However, the court held that the insolvency asset pool should include funds that were not properly safeguarded, giving e-money holders priority rights over these assets ahead of other creditors. 

This combination has no doubt prompted the FCA to tighten the safeguarding regime, especially as the sector grows. 

Why should you care?

The new regime shifts safeguarding from a largely principles-based framework to a more prescriptive, monitored regime.

Like asset managers, payment and e-money firms will be held to rigorous standards for segregation, recordkeeping and reconciliation, with fiduciary-like responsibilities over client money.

Firms will face increased compliance costs, tighter supervisory scrutiny and less flexibility in safeguarding methods. 

The monthly reporting requirement will also give the FCA a near-continuous window into firms’ safeguarding health, making any persistent deficiencies harder to hide.

It would be a risk to treat the updated rules as simply an administrative burden, as they represent a significant overhaul of a relatively flexible regime that has been in existence since the implementation of the payment services legal framework in 2017. 

Firms should consider the following steps as they plan to comply with the updated regime:

• Implement accurate and well-documented daily reconciliations, excluding weekends and public holidays, and ensure that systems allow reconciliation data to be easily extracted for the monthly return. 
• Identify any non-standard reconciliation methods and flag them to the FCA.
• Create a reporting workflow to capture all relevant data points in the FCA’s new format, including the D+1 segregation comparison and a breakdown of relevant assets by custodian. 
• Test internal reporting against the FCA’s updated guidance, particularly its currency conversion rules, with clear ownership assigned for preparing, reviewing and submitting the monthly return.
• Map all third parties holding or managing customer funds, and ensure appropriate due diligence has been conducted. This includes any sort of safeguarding insurance or guarantees, which must be checked for payout restrictions while any potential issues are addressed early. 
• Plan at least three months ahead of insurance renewals – the FCA has said that if firms do not have a replacement or renewal in place, they need to be ready to safeguard relevant funds through the segregation method.

Firms holding more than £100,000 in customer funds should also consider appointing a qualified auditor and ensuring their safeguarding records are ready for inspection. 

Even smaller payment firms that are exempt from the obligations around audits should maintain evidence demonstrating compliance with safeguarding rules.

It is also important that firms assemble resolution packs containing all documents the FCA would require to return customer funds quickly in the event of an insolvency, with records kept complete, up-to-date and easily retrievable.

Institutions should take advantage of the FCA’s guidance and support during the implementation period to address uncertainties, and apply lessons from the pilot to make the monthly return process as efficient as possible.

As with compliance preparations for any rule or legal changes, firms need to make sure that they avoid bottlenecks. 

Delays at a single point will cause disruption and increase compliance risks through missed deadlines for reporting, reconciliations or approvals. 

To ensure customer trust, and a good relationship with the FCA, firms must prepare for this change and ensure they are in full compliance by the deadline of May 7, 2026.