FCA Safeguarding: Six Weeks to the Supplementary Regime

ByRob Bratby Posted on UK, Countries, Government policy, Payments Regulation, Regulatory action
FCA Safeguarding: Six Weeks to the Supplementary Regime - Bratby Law payments regulation

FCA safeguarding reform is now weeks away from taking effect. The FCA published its Payments Regulatory Priorities report on 25 March 2026, confirming that keeping customers’ money safe remains its primary concern for the payments sector. The message to payment institutions and electronic money institutions is direct: the Safeguarding Supplementary Regime takes effect on 7 May 2026, and the FCA expects firms to be ready. With six weeks to go, firms that have not started implementation face a compressed timeline and real enforcement risk.

Regulatory background to FCA safeguarding reform

Safeguarding has been a persistent source of regulatory concern. Under regulation 23 of the Payment Services Regulations 2017 and regulation 21 of the Electronic Money Regulations 2011, authorised payment institutions and electronic money institutions must protect customer funds, either by segregating them in designated accounts or by securing them with an insurance policy or guarantee. In practice, around 95% of firms use the segregation method.

The regime has not worked well enough. When firms have failed, customers have faced long delays recovering their money and, on average, received only 35 pence in the pound. The FCA consulted on reforms in CP24/20 in September 2024 and published final rules in PS25/12 in 2025. The scale of the problem is substantial: electronic money institutions safeguarded approximately £26 billion in 2024, up from £11 billion in 2021, while payment institutions safeguard an estimated £6 billion per day.

The FCA is implementing its safeguarding reforms in two stages. The first, the Supplementary Regime, takes effect on 7 May 2026 and introduces enhanced operational requirements within the existing legislative framework. The second stage, expected to follow HM Treasury’s consultation on payment services law later in 2026, will impose a full CASS-style regime with a statutory trust over safeguarded funds. That second stage requires legislative change to the PSRs and EMRs and will take longer to implement.

What the FCA safeguarding Supplementary Regime requires

The Supplementary Regime introduces three categories of change under CASS 15.

First, improved books and records. Firms must maintain accurate, up-to-date records of all relevant funds received and held on behalf of customers. This sounds elementary, but the FCA’s supervisory experience suggests that many firms’ record-keeping is inadequate, particularly where firms commingle different product revenues or fail to distinguish between customer funds and their own working capital.

Second, enhanced monitoring and reporting. Firms must perform reconciliations on every business day, not just periodically. They must submit monthly returns to the FCA reporting the total value of safeguarded funds. This gives the FCA near-real-time visibility of firms’ FCA safeguarding positions for the first time.

Third, strengthened safeguarding practices. Firms must hold segregated funds in accounts clearly designated as safeguarding accounts. They must maintain a detailed resolution pack, kept current, so that in the event of insolvency an administrator can identify and return customer funds without delay. Funds relating to e-money and payment services must be safeguarded separately where a firm holds both types of authorisation.

The annual safeguarding audit is a further requirement. All authorised firms must arrange an independent audit of their safeguarding arrangements, unless they have held less than £100,000 in relevant funds over a rolling 53-week period. The first audit report must be submitted to the FCA within six months of the firm’s first relevant period end, with subsequent reports due within four months.

On 18 March 2026, the Financial Reporting Council published interim guidance for safeguarding auditors, drawing on the structure and principles of the existing CASS Assurance Standard. The FRC’s guidance is explicitly transitional: a dedicated safeguarding assurance standard will follow public consultation, expected in 2027. The fact that the FRC has published guidance a month before the regime takes effect signals that the audit ecosystem is still gearing up. Firms should engage their auditors now if they have not already done so.

Commercial and operational implications

The compliance burden falls disproportionately on smaller payment institutions and e-money issuers. Larger firms with existing CASS infrastructure will find the transition manageable. Smaller firms, particularly those that have operated with manual reconciliation processes or basic spreadsheet record-keeping, face a step change in operational requirements.

The costs are real. Daily reconciliations require automated systems or, at minimum, dedicated operational resource. Monthly FCA returns require reporting infrastructure. Resolution packs require legal and operational documentation that many smaller firms have not previously maintained. Audit fees represent a new annual cost.

For PE investors and acquirers active in the fintech and payments sector, FCA safeguarding readiness is now a due diligence priority. A target company’s compliance posture under the Supplementary Regime will affect both valuation and the cost of post-acquisition remediation. The FCA’s Regulatory Priorities report makes clear that it will consider the outcomes of safeguarding audits and take action against firms with inadequate arrangements.

The FCA’s report also flags two forward-looking themes. On Consumer Duty, the FCA is scrutinising international payment pricing and outcomes for vulnerable customers. On agentic AI in payments, the FCA will assess whether existing rules are sufficient or whether rule changes are needed to address AI-driven payment initiation. Both themes signal the direction of regulatory travel for the sector, as we noted in our earlier analysis of the Payments Forward Plan.

Viewpoint

The Supplementary Regime is a necessary but intermediate step. The real transformation comes with the statutory trust, which will fundamentally change the legal character of safeguarded funds and, with it, the insolvency waterfall for payment institution and e-money failures. Firms should treat the FCA safeguarding Supplementary Regime not as the destination but as preparation for a more demanding regime to follow.

From an operator-side perspective, the firms most at risk are those that have grown rapidly without investing proportionately in compliance infrastructure. The £26 billion safeguarded by EMIs in 2024, more than double the 2021 figure, reflects a sector that has scaled faster than its operational controls. The FCA knows this, and the Supplementary Regime is its response.

The parallel development of PSD3 in the EU introduces a further dimension. Firms operating across both jurisdictions will need to track two evolving safeguarding regimes with different timelines and different legal structures. UK/EU divergence on safeguarding is now a live compliance consideration.

Key sources

If you are a payment institution or e-money issuer assessing your readiness for the Supplementary Regime, or a PE investor conducting due diligence on a payments target, Bratby Law advises on safeguarding, scheme governance and payments product structuring. Contact Rob Bratby at rob@bratby.law.

Similar Posts