PS 25/12: Policy Statement on Changes to the Safeguarding Regime for Payments and E-money firms

The FCA has issued their much-awaited Policy Statement 25/12 ‘Changes to the safeguarding regime for payments and e-money firms’. This policy statement was issued to improve the safeguarding practices within the market and ensure consistency and clarity in the requirements for firms to comply with. This is to ensure:

Minimisation of the shortfalls in safeguarding relevant funds
Cost effective return of funds quickly if payment firm fails
Strengthen FCA’s ability to intervene when necessary to meet its strategic objectives.

The proposals support each of the 4 priorities noted in the FCA’s Strategy 2025 to 2030 to support more effective and efficient regulating of payment firms by:

Increasing trust in payments and improving outcomes if firms do fail
Enhanced safeguarding practices (including regular reconciliations) to reduce the risk of misappropriation and fraud
Consumers having confidence in the payments they are making and knowing they are protected
Increased reporting (through both regulatory returns and audit reports) to allow the FCA to support the sector and identify and act on any issues more quickly.

The rules apply to:

Authorised Payment Institutions (except those who soley provide Payment Initiation or Account Information Services)
Authorised E-money Institutions
Small E-money institutions, and
Credit Unitions which issues e-money in the UK.

The Policy Statement includes two-fold changes:

‘Interim rules’ (the Supplementary Regime) to encourage greater compliance with existing safeguarding requirements, support more consistent record keeping, and strengthen reporting and monitoring requirements
‘End-state rules’ (the Post-Repeal Regime) to replace the safeguarding requirements of the EMRs and PSRs with a ‘CASS’ style regime.

The Supplementary Regime and related amendments to the Approach Document, will come into force on 7 May 2026, with further guidance and consultation required prior to the release of the Post-Repeal Regime.

What are the key changes?

Improvement Books and Records:

Perform safeguarding reconciliations at least once each ‘reconciliation day’, other than weekends, public holidays and days when foreign markets are closed to verify the accuracy of the firm’s books and records and not as means to maintain the books and records
The FCA has introduced rules allowing for a payment firm to use a non-standard method of internal safeguarding reconciliation. However, if a firm uses this method, they should document how the approach meets the obligations to its clients under the safeguarding rules
Maintain a resolution pack, including the requirements for the types of documents and records to be included that would help achieve the timely return of funds in the event of a payment firms insolvency.

Enhanced Monitoring and Reporting

The FCA has tightened their requirements for who can perform safeguarding audits. The requirements stipulate they must be performed by ‘qualified auditors’, to ensure consistency in audit quality. The term ‘qualified auditors’ are defined under the Companies Act 2006 requirements.

The FCA has amended the regulations to clarify that payment firms are not required to appoint the same auditor for their safeguarding audit as their statutory audit to ensure market competition and help to reduce cost
An exemption to undertake an audit if a payment firm has not safeguarded more than £100,000 at any time over a 53-week period has been introduced
As the FCA has removed the proposal for limited assurance engagements they have provided guidance that failure to safeguard relevant funds will usually be of material significance and require reporting to the FCA
Requirement to submit a new monthly return to the FCA relating to a firm’s safeguarding arrangements.

Strengthening Elements of Safeguarding

Carry out due diligence when appointing or periodically reviewing third parties that manage or hold relevant funds or assets
Continue to be able to invest relevant funds in the same range of secure, liquid assets
Ensuring there are no conditions or restrictions on the safeguarding insurance policy or comparable guarantee and ensuring there is a contingency plan of at least 3 months prior to expiry to mitigate the cliff edge risk
Further clarification was shared on existing guidance, including, to explain that the obligation to safeguard relevant funds begins as soon as funds are received by the institution and by received this means an entitlement to receive and treatment when funds are received for foreign exchange transactions.

Supplementary Regime’s Implementation and transitional arrangements

The Policy Statement describes the implementation and transitional arrangements, covering:

The initial proposed 6-month implementation period has now been extended to 9 months from the publication of the Policy Statement, meaning effective date is 7 May 2026. The extension of the implementation period will also enable coordination with the FRC on the introduction of a new audit standard that auditors will need to adhere to when conducting a safeguarding audit
Transitional arrangements proposed in CP24/20 will be maintained in the Supplementary Regime. The FCA will engage the industry throughout the implementation period to ensure a clear understanding of the new requirements and where possible provide clarity and understand any initial impacts.

Post-Repeal Regime

Various feedback was obtained on the Post-Repeal Regime including concerns about receipt of funds directly into a safeguarding account, additional permissions needed to invest in secure and liquid assets, holding of funds under a statutory trust and the 12 month proposed implementation timeline for the ‘end state’ rules, the FCA will consider the feedback alongside review of the effectiveness of the Supplementary Regime on any decisions made in respect of the Post-Repeal Regime. It was also noted that the timing, nature and feasibility of transitioning to the Post-Repeal Regime would depend on the Treasury’s approach to revoking the PSRs and the EMRs.

What you should be doing and how we can support you?

It is expected that following the publication of the initial consultation paper, firms had already begun undertaking a GAP analysis to assess and consider any structural changes needed for implementation. Following the release of this Policy Statement and the now 9-month implementation period for the Supplementary Regime, firms are expected to be in compliance with the new rules by 7 May 2026.

If not already started, Firms should:

Begin by undertaking a detailed rule by rule mapping and gap analysis, this will help identify any potential gaps within their current process. Appropriate remediation plans should be drawn up with the tracking of these actions being overseen by the firm’s Safeguarding Committee (if relevant) with appropriate Board oversight/escalation at regular intervals
Consider the changes required in the Safeguarding audit (taking account of the deminimus limits) and assess the appropriateness of their safeguarding audit provider. Although the rules do not come into force until 7 May 2026, the Year End 2025 audits can serve as a validation against the current requirements and lead to less “surprises” when the proposed audit rules come into effect and reports are shared directly with the FCA
Firms should also be utilising their 2nd and 3rd line functions through the undertaking of compliance and internal audit reviews over their safeguarding framework and if this is not possible, consider organisation of external advisory/assurance reviews to assist with compliance and remediation where necessary. Such firms and consultants have experienced the implementation of the investment firm PS14/9 rules and those associated (e.g. CASS 10 and CMAR) to help add value to organisations in a period of change and help set firms up for success from the outset.

Some ways we can support you with this are:

As a ‘qualified auditor’ (defined under the Companies Act) BDO is able to be appointed to undertake Safeguarding audits under the Supplementary Regime. We can perform independent, annual audits in line with the FCA’s expected scope
Perform health checks and GAP analysis against the new requirements to ensure firms can quickly and clearly identify enhancements in the current safeguarding controls and process to ensure compliance with the Supplementary Regime
Support in the performance and remediation of gaps identified from annual safeguarding audits
Provide board or staff training on new rules and how they relate and apply to you
Assist in the support with the preparation of the resolution pack and monthly regulatory returns.

Further publications will be issued with in-depth analysis on the Supplementary Regime in the coming weeks and how this may impact your firm. For more information contact Luke Patterson and Tiana Raviranjan.