On 7 August 2025, the FCA published Policy Statement PS25/12, confirming a strengthened safeguarding regime for payment and e-money institutions. The rules respond directly to concerns the regulator has raised repeatedly over the past two years: when payment firms fail, customer funds are too often short, delayed, or difficult to trace.

The new rules follow HM Treasury’s 2023 review of the Payment Services Regulations and a consultation the FCA opened in September 2024 (CP24/20). Rather than pushing straight to a full “CASS-style” statutory trust model, the FCA has opted for an interim Supplementary Regime, giving industry time to adapt before any move to end-state rules based on a statutory trust, which will need legislation.

WHAT’S CHANGING

Books and records: firms must keep more detailed records, run daily reconciliations, and maintain resolution packs that will allow an insolvency practitioner to return funds quickly if the firm fails.

Safeguarding audits: authorised payment institutions and e-money institutions must arrange annual independent audits of their safeguarding arrangements. Smaller firms that safeguard under £100,000 across the preceding 53 weeks are exempt.

Enhanced reporting: firms must submit a new monthly safeguarding return to the FCA, closing a visibility gap that has made it hard for the regulator to catch problems before they escalate.

Stronger segregation and insurance requirements: the rules tighten how relevant funds must be held and clarify the standards for insurance or comparable guarantees used as an alternative to segregation.

WHY IT MATTERS

The FCA has been explicit that these changes exist to reduce shortfalls and speed up the return of funds if a firm fails — not to add box-ticking for its own sake. Firms have nine months to prepare, with the rules coming into force on 7 May 2026. That sounds generous, but annual audits, new reconciliation processes and resolution pack documentation are not built overnight, particularly for firms that have historically treated safeguarding as an operational afterthought rather than a governance priority.

This sits alongside the findings from the FCA’s June 2025 multi-firm review of risk management and wind-down planning across payments and e-money firms, which we covered last month. Read together, the regulator’s message is consistent: safeguarding, risk management, and wind-down planning are not separate compliance exercises. They are one connected discipline, and firms that treat them as siloed workstreams will struggle to demonstrate the “joined-up” resilience the FCA now expects.

PREPARING WITH REGTECH

Meeting PS25/12 well ahead of the May 2026 deadline means firms need clear, auditable evidence of how they monitor, reconcile, and report safeguarded funds — not a scramble to produce it when the auditor arrives. On the Axiol platform, firms can:

• Build a structured control framework around safeguarding obligations, with clear ownership assigned to named individuals
• Track reconciliation and reporting evidence in one place, ready for the new annual audit requirement
• Link safeguarding risks to the wider enterprise risk register, enabling firms to assess and monitor them alongside other operational risks, with a consolidated view of the overall risk exposure.
• Maintain a continuous audit trail that demonstrates, in real time, how the firm is meeting its obligations — rather than reconstructing evidence retrospectively

Nine months is enough time to get this right, but only if firms start now. Get in touch to find out how Axiol can help your firm prepare for the May 2026 deadline.