Safeguarding Obligations for Payment Institutions: What Firms Need to Know in 2026

3 days ago

5 min read

Regal 38i83 Team | Regulatory Insight

The FCA's overhaul of safeguarding rules for payment institutions and e-money institutions came into force on 7 May 2026. For many firms, this is the most significant change to their operational compliance obligations in years. If your firm has not yet assessed its position against the new requirements, now is the time to act.

This article sets out what has changed, what firms are now expected to do, and where the most common gaps are likely to appear.

Background: Why the Rules Changed

Safeguarding, the obligation to protect customer funds held by a payment institution or e-money institution, has existed since the Payment Services Regulations 2017 (PSRs) and the Electronic Money Regulations 2011 (EMRs). The principle is straightforward: relevant funds must be ring-fenced so that, if a firm fails, customers can recover their money.

In practice, the FCA found persistent weaknesses in how firms implemented that principle. Reconciliations were infrequent or poorly documented. Firms held customer funds in accounts that were not adequately designated. Resolution packs were incomplete or out of date. Audit coverage was inconsistent.

The FCA consulted on reform through CP23/28 and published its response in Policy Statement PS25/12. The new rules, now housed primarily in CASS 15 of the FCA Handbook, took effect on 7 May 2026. The FCA has also confirmed that it will not implement the originally proposed post-repeal regime without further consultation, so firms are operating under a clarified and strengthened version of the existing framework rather than a wholesale replacement.

What the New Rules Require

1. Daily reconciliation

Safeguarded funds must be reconciled every business day. Where a firm uses a non-standard reconciliation method, it must obtain an independent auditor's report confirming the adequacy of that method, and disclose the position in its monthly FCA return.

This is a material change for firms that previously reconciled weekly or on an ad hoc basis. Daily reconciliation requires reliable data flows between treasury, operations and compliance, and it needs to be documented in a way that can be produced to the FCA on request.

2. Annual safeguarding audits

Most firms are now required to arrange an annual audit of their safeguarding arrangements. The audit must be conducted by an independent, appropriately qualified auditor.

A six-month grace period applies to the first submission following the rules coming into force. Firms that did not hold more than £100,000 in relevant funds at any point in the previous 53 weeks are not required to arrange a safeguarding audit, but should keep records that support that position.

The audit requirement raises practical questions about auditor eligibility and scope. Firms should confirm at the outset that their chosen auditor has the relevant expertise and that the engagement letter accurately reflects the CASS 15 requirements.

3. Due diligence on third-party custodians

Where a firm safeguards funds through a third-party bank, credit institution, or central bank, it must now perform documented due diligence both at appointment and on a periodic basis thereafter.

The due diligence should address the third party's financial soundness, the terms on which customer funds are held, and whether the account arrangements are clearly designated in a way that would protect customers in an insolvency. Firms should retain evidence of the assessment and build a review cycle into their compliance calendar.

4. Insurance and comparable guarantees

Where safeguarding is implemented through an insurance policy or comparable guarantee rather than segregation, the policy must not contain restrictions on payout other than confirmation of an insolvency event.

Firms relying on insurance should review their policy wording now. A policy that permits the insurer to delay or reduce payment on grounds beyond the insolvency trigger will not meet the new standard.

5. Contingency planning for insurance expiry

At least three months before an insurance policy or guarantee is due to expire, firms must have a contingency plan in place. If renewal or replacement cannot be secured, the firm must be ready to transition to safeguarding through segregation without delay.

This planning requirement means the compliance calendar needs to flag insurance renewal dates well in advance, with a defined escalation path if negotiations stall.

6. Resolution packs

Firms must maintain comprehensive, regularly updated resolution packs. The purpose of a resolution pack is to enable the rapid return of client funds in an insolvency scenario. It should contain, at a minimum, a complete record of all safeguarded accounts, the methodology used to calculate the safeguarding requirement, and the contact details for custodians and other relevant parties.

Resolution packs should be treated as live documents, updated whenever there is a material change to the firm's safeguarding arrangements.

7. Monthly FCA returns

New monthly reporting obligations require firms to confirm their safeguarding practices and reconciliation outcomes to the FCA. The format and submission requirements are set out in SUP 16 of the Handbook.

Firms should review their regulatory reporting infrastructure to confirm they can produce the required data accurately and on time.

8. Clarification on when the safeguarding obligation begins

The FCA has added clarification to its Approach Document confirming that the obligation to safeguard inbound transactions begins once the firm becomes entitled to the funds. For most firms, this will be when funds are credited to an account in the firm's name. The practical implication is that the window between receipt and segregation needs to be tightly controlled and documented.

What Firms Should Do Now

For firms that have not already undertaken a structured gap analysis, the following steps reflect good practice under the new regime.

Review CASS 15 and PS25/12 in full. The detailed rules and guidance are in the Handbook. Familiarity with the source material is the starting point for any compliance assessment.

Map the safeguarding footprint. Produce a clear picture of all accounts holding relevant funds, the third parties involved, the reconciliation methodology in use, and the insurance or segregation arrangements in place.

Assess the gap. Compare current arrangements against each CASS 15 requirement. Document findings, prioritise remediation and assign ownership.

Update policies and procedures. Existing safeguarding policies may need substantial revision to reflect the new daily reconciliation obligation, the due diligence requirements, and the contingency planning obligation for insurance.

Prepare for the annual audit. Identify a suitable auditor, agree the scope and timeline, and ensure internal records are in a state that will support the engagement.

Build the compliance calendar. Daily reconciliation, monthly returns, periodic due diligence reviews and insurance renewal monitoring all need to be scheduled, resourced and owned.

Train relevant staff. Reconciliation teams, treasury, and compliance personnel all need to understand what the new rules require of them.

The Broader Context

The FCA's focus on safeguarding sits within a wider supervisory agenda for payment institutions. The regulator's February 2025 Dear CEO letter to the payments portfolio set out three key outcomes for firms over the next two years: effective competition and innovation, preventing and reducing financial crime, and protecting consumers and market integrity.

Safeguarding is explicitly linked to consumer protection and market integrity. The FCA has made clear that firms with persistent weaknesses in this area can expect supervisory engagement, and that it will act decisively where expectations are not met.

For firms that get this right, robust safeguarding arrangements are also a commercial asset. Institutional clients, partners and distribution channels increasingly assess compliance infrastructure as part of their own due diligence. A well-documented safeguarding framework supports those conversations.

How Regal 38i83 Can Help

Regal 38i83 provides fixed-fee safeguarding reviews and compliance advisory to payment institutions and e-money institutions across the UK. Our work includes gap assessments against CASS 15, policy and procedure drafting, resolution pack reviews, and preparation support for safeguarding audits.

All enquiries are directed to info@regal38i83.com. We provide an initial scoping consultation at no charge, followed by a written scope and fee proposal.

This article is for information only and does not constitute legal or regulatory advice. Firms should take independent professional advice in relation to their specific circumstances. Regal 38i83 Ltd. Company number: 11449290.