17 October 2025
by Payments Intelligence
The Financial Conduct Authority’s overhaul of the safeguarding framework for payments and e-money firms marks one of the most significant regulatory shifts in the sector since the introduction of the Payment Services Regulations in 2017. Against a backdrop of rapid industry growth and recent firm failures, the regulator is seeking to strengthen consumer protection and restore confidence in how customer funds are managed and reconciled.
The new Supplementary Regime, set to take effect in May 2026, introduces tighter governance, reporting, and auditing requirements that bring the sector closer to the client asset standards applied to investment firms. While welcomed by many as a necessary evolution, the transition presents substantial operational and compliance challenges for firms, as well as practical questions regarding audit capacity and implementation timelines.
Payment institutions (PIs) and e-money institutions (EMIs) have become integral to the UK’s financial services sector. In 2017, just 1% of consumers used a PI or EMI, compared to 12% in 2024. The amount safeguarded by these firms has risen accordingly, standing at £26 billion last year for EMIs, according to the Financial Conduct Authority (FCA).
In light of the proliferation of these organisations, the FCA has announced changes to the safeguarding regime for PIs and EMIs. The FCA cites ‘weaknesses in the current safeguarding practices’ and an average shortfall of 65% in funds owed to clients following insolvency as justification for the revised regime.
The FCA is seeking the following outcomes from the changes:
In this context, the interim Supplementary Regime will be considered a success if there is a decline in the percentage of shortfalls of relevant funds held by failed payments firms, which are driven by non-compliance with safeguarding requirements. Additionally, the FCA aims for a decline in supervisory cases related to deficient safeguarding, with fewer formal interventions.
The current regime, governed by the Payment Services Regulations 2017 (PSRs) and Electronic Money Regulations 2011 (EMRs), requires firms to safeguard funds received for payments or e-money issuance. However, high-level requirements have led to inconsistencies, as highlighted in the FCA’s 2025 portfolio letter to payments firms and a multi-firm review on risk management. Legal uncertainties, such as those from the Ipagoo LLP insolvency, have further complicated matters, questioning the status of relevant funds in shortfalls.
HM Treasury’s Payment Services Regulations Review (2023) and the FCA’s Consultation Paper CP24/20 highlighted widespread weaknesses with the PSRs and EMRs, including poor reconciliation practices, incomplete records, and uncertainty in insolvency law.
The FCA has proposed a two-stage reform:
PS25/12 responds to feedback from Consultation Paper CP24/20 and the Treasury’s 2023 Payment Services Regulations Review. It focuses on three pillars: improved books and records; enhanced monitoring and reporting; and strengthened safeguarding elements.
Based on these principles, the FCA has made the following changes:
Firms must now perform internal and external safeguarding reconciliations at least once per “reconciliation day”, which is every day excluding weekends, bank holidays, and days when relevant foreign markets are closed. The daily frequency aims to detect discrepancies early, with shortfalls rectified by the end of the day using the firm’s own funds if necessary.
A safeguarding institution must maintain and be able to retrieve a CASS resolution pack, containing the necessary documents and records that would enable an insolvency practitioner to return relevant funds held by the safeguarding institution to its clients.
Annual audits must now be carried out by ‘qualified auditors’ (as defined under the Companies Act 2006 requirements); compliance consultants are no longer sufficient. Firms are no longer required to appoint the same auditor for their safeguarding audit as their statutory audit to ensure market competition and help to reduce costs. There is an exemption for firms that have not safeguarded more than £100,000 for more than 53 weeks.
The FCA has already piloted the monthly safeguarding return under SUP 16 Annex 29B. The returns cover a wide range of information, including:
The FCA estimates the return will take a compliance professional 5.25 hours to complete.
Firms using insurance or comparable guarantees must have contingency plans to switch to segregation at least three months prior to the policy’s expiration if renewal cannot be secured.
Firms must conduct due diligence on any third parties managing or holding safeguarded funds.
The rules target:
Small payment institutions can opt in voluntarily.
The FCA received 85 consultation responses from authorised e-money institutions, payment institutions, small e-money institutions, consumer groups, trade associations, professional bodies, auditors and advisors. In response to this feedback, the FCA made several amendments:
The FCA acknowledged calls for the monthly safeguarding return to be made quarterly but stood by monthly reporting being “necessary and proportionate”.
Prior to the supplementary regime expected to take effect on 7 May 2026, payments and e-money firms should address the following:
Study FCA Handbook updates and perform gap analyses, engaging legal counsel if needed to clarify requirements like daily reconciliations and resolution packs.
Implement automated systems for daily reconciliations on “reconciliation days” (excluding weekends/holidays) and maintain resolution packs detailing fund locations and procedures. Conduct due diligence on third-party providers, leveraging transitional provisions for pre-existing arrangements.
Firms holding over £100,000 in relevant funds must arrange annual audits by Companies Act-qualified auditors, due within six months for the first period. Start discussions now to establish who is responsible for overseeing the firm’s audit compliance, so these individuals can then secure auditors and prepare records. Exempt firms should consider voluntary audits.
The Payments Association is working with the FCA to ascertain what information is required under the new auditing standards.
Update IT systems for new SUP 16.14A monthly returns, covering safeguarding methods, balances, and breaches, due within 15 business days. Pilot submissions and train staff for compliance.
Ensure insurance or guarantees have no payout restrictions beyond insolvency, and prepare contingency plans three months before expiry to switch to segregation if needed.
Participate in FCA workshops and monitor updates via trade associations. There will likely be further consultation on the end-state, Post-Repeal regime, but the earliest this will happen is Q4 2027.
From 7 May 2026, authorised payment institutions, EMIs, and credit unions which issue e-money in the UK will have to comply with the strengthened safeguarding requirements set out in PS25/12.
Firms will have to:
With seven months until the changes come into force, firms should:
UK merchants expect agentic commerce to grow rapidly, but uncertainty around liability, fraud, and standards is slowing readiness.
Stablecoins are moving into mainstream finance, reshaping payments, trade, and regulation as institutions explore faster, programmable settlement.
A forward-looking overview of key regulatory developments across payments, crypto and financial services, with timelines and practical implications.
You need to be logged in to do this!
