On 7 August 2025, the FCA confirmed significant changes to the safeguarding regime for non-bank payment service providers (PSPs) in Policy Statement PS25/12. The reforms — which some have dubbed “CASS 15” — are designed to address long-standing regulatory concerns about how effectively e-money and payment firms protect customer funds.
Safeguarding failures can cause real, measurable harm. For EMIs and APIs that became insolvent between Q1 2018 and Q2 2023, the FCA found an average 65% shortfall between funds owed to customers and those actually safeguarded. As the sector has grown in scale and importance to UK consumers, the potential impact of such failures has become more significant.
The FCA’s new Supplementary Regime, effective 7 May 2026, introduces targeted changes intended to clarify the regulatory expectations, improve governance and assurance regarding safeguarding, improve the FCA’s visibility of firm’s arrangements, and enable Administrators to return customer funds more promptly and at lower cost to customers. This article sets out what’s changing, who is impacted, and the practical steps firms should take now to be “Supplementary Regime Ready” ahead of the implementation deadline.
1. Why is the FCA changing the rules?
2. Who is impacted?
3. ‘Supplementary Regime’ and ‘Post Repeal Regime’
4. What are the main changes in the Supplementary Regime?
5. What are the desired outcomes?
6. Implementation approach for the Supplementary Regime
7. Selected highlights of the FCA’s feedback
8. Steps for impacted firms to take
9. How FINTRAIL can help
Why is the FCA changing the rules?
The FCA has long raised concerns about the robustness of safeguarding practices within parts of the payments and e-money sector. Safeguarding is an area where customers face a tangible risk of financial harm if things go wrong.
Over time, the regulators’s concerns have included:
Insufficient clarity as to which funds are ‘relevant funds’ - if funds received from, or on behalf of customers, are not identified as ‘relevant funds’ this can lead to shortfalls in asset pools, at the point of insolvency.
Adequacy and robustness of the reconciliations conducted - inadequate or insufficiently frequent reconciliations can undermine the identification and rectification of discrepancies.
Ongoing oversight and governance of safeguarding risks - protecting customer funds should be at the heart of an e-money or payment firm’s operations, so ongoing management oversight and assurance are critical. Particularly so where relevant funds might be received via Agents or Distributors
Poor quality records – incomplete or inaccurate records of customer entitlements can significantly delay the work of administrators, slowing the return of funds to customers, and increasing the costs of distribution
Customer understanding of safeguarding and its limitations - even under the Supplementary Regime, safeguarding is not the same as a deposit guarantee scheme. E-money and payments firms are expected to make their customers aware that there can be delays to return or funds, and customers may not receive all of their money back.
The FCA’s concerns are reinforced by market data and case experience. Recent insolvency cases have revealed significant shortfalls between safeguarded funds and amounts owed to customers, with complex Special Administration processes further underlining the operational and financial risks to consumers.
Sector growth has amplified these concerns. More UK consumers are choosing payment and e-money firms as either an alternative or a complement to traditional banks, meaning that any safeguarding failure now has the potential to affect a far greater number of customers.
Key statistics:
- The proportion of UK consumers using an account at a non-bank PSP has grown from 1% in 2017 to 12% in 2024
- The value of relevant funds safeguarded by e-money institutions has increased from £11bn in 2021 to £26bn in 2024
In response, HM Treasury invited the FCA in January 2023 to consult on changes to the safeguarding regime in light of evolving market practices and legal developments. This led to the September 2024 consultation on PS25/12, which sought to modernise safeguarding requirements and close gaps in current rules. While the FCA had originally aimed to publish its policy statement in the first half of 2025, it extended its timeline to consider feedback in greater depth before finalising the new rules.
Who is impacted?
The FCA’s new safeguarding rules apply to a wide range of firms operating in the UK payments and e-money sector. Specifically, they affect:
Authorised and Small Electronic Money Institutions (EMIs)
Authorised Payment Institutions (APIs)
Credit unions that issue e-money in the UK
While these firms are the primary audience, the changes will also be relevant to:
Consumers who use payment and e-money services
Insolvency practitioners tasked with returning funds in the event of firm failure
Auditors responsible for assessing safeguarding arrangements
Banks, custodians, and insurers providing safeguarding services to EMIs and APIs
By influencing how firms segregate, protect, and account for customer funds, the reforms will also have an indirect impact on the wider financial services ecosystem.
‘Supplementary Regime’ and ‘Post Repeal Regime’
The FCA’s policy outlines two distinct stages for reforming the safeguarding framework:
1. Supplementary Regime
This is the interim framework that will take effect on 7 May 2026. It introduces targeted changes to strengthen fund protection, enhance operational readiness, and improve the speed and certainty with which customer funds can be returned in the event of firm failure.
2. Post Repeal Regime
This represents the FCA’s intended “end state” for safeguarding. However, it will only proceed if:
An FCA review of the effectiveness of the Supplementary Regime (to be conducted after at least one complete audit cycle under the Supplementary Regime) concludes that further changes are necessary to secure the desired outcomes; and
Parliament repeals the safeguarding provisions within the Electronic Money Regulations 2011 and Payment Services Regulations 2017.
Given the uncertainty as to whether the Post Repeal Regime will proceed, our expectation is that impacted firms will effectively ‘park’ this, to enable focus on preparation for the Supplementary Regime.
What are the main changes in the Supplementary Regime?
The FCA’s Supplementary Regime introduces a series of targeted reforms designed to strengthen how non-bank PSPs safeguard customer funds. The key changes include:
Introduction of a ‘reconciliation day’
Reconciliation days exclude weekends and public holidays to avoid confusion with the Payment Services Regulations’ definition of “business day.”Mandatory resolution pack
Firms must maintain a resolution pack to enable administrators to return funds promptly and cost-effectively in the event of insolvency.Revised annual audit requirement
Safeguarding audits must be carried out by a qualified auditor. Firms safeguarding less than £100,000 during the period will be exempt, although the FCA encourages consideration of voluntary audits.New monthly safeguarding return
Firms must submit a monthly regulatory report detailing their safeguarding arrangements.
The FCA has also re-confirmed several existing expectations, including:
Due diligence on third parties
Appropriate pre-appointment and periodic due diligence must be undertaken for banks, custodians, and insurers providing safeguarding services.Safeguarding insurance or guarantees
These should not include pay-out restrictions beyond confirmation of the insolvency event.Contingency planning
Non-bank PSPs using an insurance policy or guarantee should have a contingency plan in place, at least three months prior to the renewal or replacement of such a policy or guarantee.
What are the desired outcomes?
Through the Supplementary Regime, the FCA aims to deliver outcomes that go beyond regulatory box-ticking. The reforms are designed to ensure that:
Customer funds are always secure
Funds received in relation to payment services or e-money are either held in a properly segregated account or protected by an appropriate insurance policy or guarantee.Segregation is accurate and maintained
The correct amount of safeguarded funds is consistently separated from the firm’s own money, reducing the risk of shortfalls due to commingling.Customer claims can be met from the safeguarded asset pool
The safeguarded asset pool is sufficient to cover all customer entitlements, avoiding the partial payouts seen in past insolvencies.Funds are returned quickly, and as fully as possible, in the event of a wind-down or market exit
Operational processes — supported by accurate records and a ready-to-use resolution pack — enable administrators to return money to customers promptly, minimising disruption and uncertainty, in the event of an insolvency, wind-down or market exit.
For firms, achieving these outcomes means embedding robust, sustainable safeguarding controls that will stand up to regulatory scrutiny and operational stress events alike.
Implementation approach for the Supplementary Regime
The FCA’s new rules, along with amendments to its Approach Document, will take effect on 7 May 2026. This provides firms with a nine-month implementation period to understand the requirements, plan their approach, and embed changes before the deadline.
The rules are set out in:
CASS 10A and CASS 15 – new and updated safeguarding provisions
SUP 3A – revised audit requirements
SUP 16.14A – new reporting obligations
This implementation period is not an opportunity for delay. Given the FCA’s historic concerns about safeguarding and its stated focus on consumer harm, firms should expect limited tolerance for non-compliance after the deadline. Planning, testing, and embedding changes well ahead of May 2026 will be essential.
Selected highlights of the FCA’s feedback
In finalising PS25/12, the FCA addressed several points raised during consultation. Key clarifications and refinements include:
Use of third-party data
Payments firms may use data received from third parties to create and maintain internal safeguarding records, where no other method is reasonable.Introduction of the ‘reconciliation day’
Rather than amending the statutory definition of “business day” in the Payment Services Regulations, the FCA has created the concept of a reconciliation day, excluding weekends, bank holidays, and relevant foreign market closure days.Simplified reconciliation rules
Internal safeguarding reconciliations can now be conducted as a higher-level comparison between the ‘expected balance’ and ‘actual balance’. Non-standard reconciliation methods may be used if certain conditions are met.Audit expectations
Firms exempt from the revised annual audit requirement are encouraged, via FCA guidance, to consider arranging safeguarding audits on a voluntary basis.Third-party diversification
Firms must consider whether diversification of safeguarding service providers (e.g., banks, custodians, insurers) is appropriate and implement changes where necessary.Future consideration of start/end points
Clarification on the start and end points of safeguarding obligations have been deferred until any move to the Post Repeal Regime.Audit standard development
The FCA and the Financial Reporting Council (FRC) will work together to introduce a new safeguarding audit standard.
These points offer important context for how the rules will be applied in practice, and highlight areas where firms have flexibility — and where the FCA will expect proactive decision-making.
Steps for impacted firms to take
With just nine months to prepare, firms should begin work now to ensure they are fully compliant with the Supplementary Regime by 7 May 2026. A structured readiness approach can help maintain momentum and provide assurance to senior management and Boards.
1. Understand the new requirements
Review the FCA’s rules and guidance in CASS 10A, CASS 15, SUP 3A, and SUP 16.14A.
Brief senior management and Boards on the changes and their implications.
2. Assess your current position
Conduct a gap analysis comparing existing safeguarding arrangements against the new requirements.
Identify where processes, documentation, or controls need to change.
3. Develop and resource your action plan
Map out the steps needed to close each gap, with clear deadlines.
Allocate sufficient resources — this may involve:
Procuring reconciliation software
Appointing a safeguarding auditor
Creating or updating your resolution pack
Build in time for testing and embedding any materially new or revised controls.
4. Address existing weaknesses
Use this implementation period to resolve any material findings from your most recent safeguarding audit.
Strengthen oversight of third parties providing safeguarding services, and consider diversification if appropriate.
5. Monitor and assure progress
Track delivery through normal governance channels so senior stakeholders remain informed.
Undertake assurance testing to confirm changes are effective, sustainable, and aligned to regulatory expectations.
By following a clear roadmap — and seeking external advice where needed — firms can position themselves to meet the FCA’s expectations and protect customer funds with confidence.
Whilst some impacted firms might be wary of the costs associated with possible changes, and the ongoing costs of maintaining appropriate safeguarding systems and controls under the Supplementary Regime, giving customers greater confidence as to the security of funds should help to improve customer trust in non-bank PSPs.
How FINTRAIL can help
Navigating the FCA’s safeguarding reforms requires more than just understanding the rules — it calls for a practical, well-sequenced plan to enable transition to the Supplementary Regime, and an ongoing approach that enables customers, management teams, Boards, the FCA and safeguarding service providers to be confident that customer funds are appropriately secure in highly dynamic sector.
At FINTRAIL, we are experienced in guiding firms through complex regulatory change and devising systems and controls which are fit for purpose, sustainable, effective and deliver the desired outcomes.
If you would like to discuss how we can support you in building and delivering your Supplementary Regime readiness roadmap, get in touch — our team is here to help you prepare with confidence.