Prepare a UK payment institution or electronic money institution for its safeguarding obligations and first applicable audit. The review connects customer contracts, collection accounts and processor settlements to the records, responsibilities and documents needed to protect relevant funds.
For an international group, the work also identifies where overseas accounts or shared operations need additional legal checks. The proposed scope covers the funds flow, remediation documents and evidence for the independently appointed safeguarding auditor.
Establish which firms and funds are covered
The FCA's supplementary safeguarding rules took effect on 7 May 2026. They operate alongside regulation 23 of the Payment Services Regulations 2017 and regulations 20–24 of the Electronic Money Regulations 2011. Preparation must address CASS 15, the CASS 10A resolution pack and the applicable SUP reporting and audit requirements. (Payments and Electronic Money (Safeguarding) Instrument 2025, FCA 2025/38, paragraph C.)
Authorised payment institutions receiving relevant funds and authorised and small EMIs fall within the applicable safeguarding requirements. Small payment institutions can elect to safeguard. For a small EMI, safeguarding funds for unrelated payment services requires a separate assessment from safeguarding its e-money receipts. Payment initiation or account information activity alone does not create the same customer-funds model. (Payment Services Regulations 2017, regulation 23; Electronic Money Regulations 2011, regulation 20; CASS 15.1.2R–15.1.8R.)
The review starts with the UK entity's permissions, customer obligations and operating locations. A group company's permission or a processor contract cannot establish the UK entity's authority to provide a different regulated service. Where the activity itself changes, the payment and e-money licensing service addresses that permission question. (Payment Services Regulations 2017, regulation 138(1); Electronic Money Regulations 2011, regulation 63(1).)
Trace each receipt through the safeguarding process
A funds-flow review identifies who receives each payment, in what capacity, for which customer and under which contract. Receipt through an agent or distributor can start the institution's safeguarding responsibility before cash reaches its central account. Sending funds to a processor does not end that responsibility merely because the ledger records a settlement. The recipient's legal role and the customer's entitlement determine the result. (FCA, Payment Services and Electronic Money, Our Approach, May 2026, paragraphs 10.31–10.35.)
Safeguarding generally begins when relevant funds are received. Under the segregation method, the next-business-day placement requirement is a further deadline, not permission to leave receipts unprotected. E-money funded through a payment instrument must be protected when credited or otherwise made available, and in any event by the end of five business days after issuance. The map records each route's trigger and deadline. (Payment Services Regulations 2017, regulation 23(5)–(6); Electronic Money Regulations 2011, regulations 20(4) and 21(1)–(2).)
Fees can be deducted from the customer balance only when due, payable and contractually deductible. Finance must identify the full customer liability where a processor settles net of charges. A refund instruction or failed payout cannot justify removing an amount while the institution still owes the relevant funds. Where both are safeguarded, e-money funds and unrelated payment-service funds require separate pools. (CASS 15.1.6G, 15.8.3R and 15.8.33R.)
Currency transfers remain within safeguarding; an independent FX transaction can require a different classification. Where protection is held in another currency, its amount must be adjusted on each internal reconciliation day using the previous day's closing spot rate. (FCA, Our Approach, paragraphs 10.22–10.25; CASS 15.3.3R.)
The review tests the selected segregation, insurance or guarantee method against the actual arrangements. A group treasury account is not automatically an eligible safeguarding account. Overseas providers require checks on the particular legal entity, applicable law and protection of customer rights. (Payment Services Regulations 2017, regulation 23(18)–(19); Electronic Money Regulations 2011, regulations 21(7)–(8) and 22; CASS 15.6.1R–15.6.3R.)
Put the documents and control owners in place
The preparation package comprises six connected deliverables:
- A funds-flow map recording receipt, allocation, safeguarding, conversion, settlement and return, with the responsible entity and evidence at each step.
- A safeguarding legal gap list linking each unresolved issue to its rule, required change, owner, dependency and closure evidence.
- A bank-letter review covering account designation, provider eligibility, acknowledgement wording, signature authority and conflicting account terms.
- A reconciliation responsibility schedule allocating preparation, review, funding of shortfalls, exception investigation and escalation across operations, finance and the group service centre.
- A resolution-pack checklist covering required records, agreements, responsible people, document locations and access arrangements.
- An auditor evidence index connecting the applicable rules and audit period to source records, reconciliations, breach history and remediation evidence.
For new acknowledgement letters, the prescribed template and its fixed wording matter. Existing letters in the November 2024 Approach Document form may qualify for transitional treatment. They still require review at least annually and when relevant information changes. The review distinguishes a missing signature from a contractual term that defeats the required protection. Existing third-party appointments covered by CASS 15.4.9R(1) or 15.6.1R(1) also required review within three months of 7 May 2026, that is by 7 August 2026. (CASS 15.7.3R–15.7.13R; CASS TP 1.1, rows 18 and 21–22.)
Reconciliation procedures must cover internal calculations and comparison with external records at the required frequency, ordinarily each reconciliation day. The applicable safeguarding method determines the calculations and exceptions. The schedule identifies who investigates differences and restores a shortfall within the applicable deadline. (CASS 15.8.10R–15.8.19R and 15.8.42R–15.8.58R.)
The UK institution must allocate operational safeguarding oversight and reporting to its governing body to one sufficiently skilled and authoritative director or senior manager. Important operational outsourcing must preserve the institution's control and management responsibility. Group agreements should specify records access, delivery deadlines, escalation, continuity and exit arrangements that support those duties. (CASS 15.2.4R; Payment Services Regulations 2017, regulation 25; Electronic Money Regulations 2011, regulation 26.)
The resolution pack must already exist and be retrievable as soon as practicable, within 48 hours of the specified trigger. A group drive alone does not establish compliant access. The preparation includes a retrieval exercise using the institution's actual records and permissions. (CASS 10A.1.3R–10A.1.8R.)
Prepare for the audit and allocate reporting duties
Audit scope needs its own assessment. SUP 3A generally covers payment institutions authorised to carry out services other than payment initiation or account information, and EMIs. Its exemption requires that the institution has not been required to safeguard more than £100,000 of relevant funds at any time for at least 53 weeks. During the initial transition until 14 May 2027, that assessment instead runs from 7 May 2026. Small-EMI status alone does not establish an exemption. (SUP 3A.1.1R–3A.1.4G; SUP TP 1.2, row 3D.)
The first audit period must end no more than 53 weeks after the institution enters scope. The ordinary report deadline is four months after period-end. Six months applies where the period ends within 53 weeks of the reporting rule taking effect on 7 May 2026. The engagement records the institution's actual scope-entry date, period-end and submission deadline. (SUP 3A.9.6R–3A.9.7R; SUP TP 1.2, row 3E.)
The institution appoints an eligible external auditor with appropriate skills, resources and experience, and checks independence. The auditor determines its work, gives the reasonable-assurance opinion and submits the safeguarding report to the FCA. Legal preparation covers the requirements, remediation documents and supporting evidence. Management owns the controls and its explanations of breaches. (SUP 3A.3.2R, 3A.4.2R, 3A.5.2R, 3A.9.1R–3A.9.3R and 3A.10.1G.)
The statutory safeguarding provisions and CASS 15 define the audit opinion's scope. Resolution-pack and monthly-return preparation remain additional parts of this review. (FCA Handbook Glossary, definition of “relevant funds regime”; SUP 3A.9.2R.)
Monthly reporting and urgent notifications follow separate rules. The safeguarding return is due within 15 business days after month-end, excluding the month in which the firm becomes a safeguarding institution. Relevant failures require notification under the applicable rules; they cannot wait for the annual audit. (SUP 16.14A.3R–16.14A.4R; CASS 15.8.60R; CASS 10A.1.15R.)
Supply the evidence and agree the delivery stages
The firm supplies its permissions, customer terms, account inventory, processor and group agreements, safeguarding policies and regulatory correspondence. Finance provides transaction-level ledgers, statements, fee and FX calculations, reconciliation history, exceptions and the highest required safeguarded balance. Banks and processors must provide the account terms, confirmations, settlement data and acknowledgement responses needed to assess their arrangements.
The auditor supplies its agreed reporting period, evidence requests and access requirements. Those inputs determine the preparation timetable and the remaining dependencies.
Work proceeds through scope confirmation, funds-flow analysis, document and control review, remediation planning and evidence handoff. Each unresolved item identifies the decision-maker and evidence needed for closure. Before a changed arrangement is used, the firm must resolve any permission, account-protection or control defect that would make it non-compliant. Foreign-law questions require the actual provider and service-centre countries to be identified.
Request a safeguarding review
Send the UK entity's regulatory status, account and processor structure, group support arrangements and intended audit period. Licentium can scope the funds-flow, bank-letter, reconciliation and resolution-pack work needed for the remediation plan.