Regulatory Update: New UK Safeguarding Regime

UPDATE: New Safeguarding Regime Published (with the FCA’s trust proposals dropped)

Ahead of our usual Payments View, the FCA has published Policy Statement PS25/12 on the incoming changes to the UK safeguarding regime (helpfully released right in the middle of the holiday period). This flash edition of Payments View breaks down the key points to try and get you back to your late summer reading (rather than a 176 page Policy Statement) as quickly as possible.

The biggest point is a win for the industry in that the extensive "Post-Repeal Regime" proposals (which had included imposing a statutory trust and restrictions on how relevant funds can be received) have been shelved following significant push-back. Beyond this, the Policy Statement introduces the "Supplementary Regime," which comes into force on 7 May 2026, following a nine-month implementation period and but which is broadly aligned with the original ‘interim proposals’. This new regime focuses on addressing what the FCA sees as poor safeguarding practices with a number of operational requirements that firms will need to start implementing. Key points here include the confirmation that resolution packs will indeed be required by firms (we have a draft pack ready to go if you’d like to discuss) as well as new and enhanced monitoring, reporting and due diligence obligations. An updated Approach Document will also be published and will incorporate clarifications on safeguarding obligations and ensure consistency with the Supplementary Regime.

All in all, we see this as a sensible response by the FCA to industry feedback and, although we think that a good bit of work will still be required by firms to uplift their policies, processes and procedures to fit the new regime, the changes and additional guidance help to address some of the more challenging safeguarding obligations that firms currently face.

Overview of the new Supplementary Regime

The previous Interim Proposals (renamed the ‘Supplementary Regime’) is proceeding with adjustments based on feedback from the industry. One of the main changes is that additional guidance for the Approach Document is being brought forward and the implementation period has been pushed back to 9 (rather than 6) months. The changes here are focused on improving what the FCA sees as poor safeguarding practices by firms (as called out in the recent portfolio letter and multi-firm review) with a number of additional operational requirements focused around:

• Improved books and records: where the FCA’s main changes are to the frequency of reconciliations as well as the requirement for resolution packs to be prepared and maintained by firms.
• Enhanced monitoring and reporting: where the new obligations include the previously proposed safeguarding audit requirement (subject to a threshold of £100,000 of relevant funds) as well as new monthly returns aimed at providing the FCA with much greater oversight of firms.
• Strengthening elements of safeguarding: which includes due diligence now being required on third parties involved in a firm’s safeguarding.

We have set out below the key points of each limb of the regime, but do let us know if it would be useful to quickly speak on the points you’re identifying as key for your business.

Other updates

As explained above, the proposed wholesale changes to the regime (renamed the ‘Post-Repeal Regime’) which included proposals on imposing a statutory trust and restricting how relevant funds could be received have been scrapped in full. The FCA indicates that these points may be re-consulted on after the first full audit period has been completed (i.e. in the next two years) but they are not proceeding with them after the decisive responses back from the industry. While this Post-Repeal Regime has not been taken forward, the Policy Statement nevertheless sets out some of the (unsurprisingly overwhelmingly negative) feedback against the proposals. As the proposals haven’t been adopted, the FCA hasn’t responded to the feedback for each question in detail (and has understandably kept their summary of the feedback quite brief) but this section of the Policy Statement is nevertheless an interesting read.

Another point which stood out to us on how firm the pushback from the industry has been here is that the FCA has also revisited its Cost Benefit Analysis. This was an area of the original consultation that we thought was quite ambitious in some of its assumptions and even though we still think that a lot of the costings that FCA have assumed would be extraordinarily good value if firms can stick to them, it is good to see the FCA listening to industry and taking a slightly more practical stance on the costs that significant regulatory involves.

We also wanted to flag that a potential consultation on the Payment and Electronic Money Institution Insolvency Regulations 2021 has been lined up, but no detail has yet been set out by the FCA in light of the Government’s current review of the regime.

Improved books and records

This is a key area of the proposals and will likely be one the first that firms need to consider. Here, the FCA is intending to address what they see as issues in how robust firms’ safeguarding processes and procedures are – while changes have been made to the proposals to make these requirements somewhat less onerous, firms may want to consider these as part of a much wider review of their existing safeguarding documents to ensure that they remain up to standard.

• Reconciliation packs: These are going to be one of the big uplifts for the industry and have been implemented broadly as originally proposed. The FCA’s approach is firmly drawn from the requirements under CASS 10. Importantly, the regulator also sees these as ‘living documents’ that capture information that firms maintain in the ordinary course of business. We have already prepared a ready-made reconciliation pack for firms to adapt and so would highlight that the amount of information that is required here is significant and could be quite an uplift, particularly if current documents and systems are not in formats that can be easily linked as the FCA seems to expect.
• In another win for the industry, the FCA has amended the rules so that safeguarding reconciliations are required at least once each ‘Reconciliation Day’, rather than business day. Reconciliation Days exclude weekends, bank holidays and days on which relevant foreign markets are closed. This is a helpful move from the FCA in terms of the requirements on firms; non-working days have always raised problems for firms particularly around the need for ‘buffers’. However, firms must still ensure that they can comply with their obligation to “maintain records and accounts to enable them, at any time and without delay, to distinguish between relevant funds and other funds”.
• Changes have also been made to ‘simplify’ the reconciliation rules themselves, with a move towards a higher-level comparison of the relevant funds that should be held in relevant funds bank accounts (the ‘D+1 segregation requirement’) against the balances of those accounts (the ‘D+1 segregation resource’). Any shortfall here would need to be remedied using relevant funds first, and then a firm’s own funds – while on its face this might be a simplification in terms of the approach, we imagine that for many firms this might result in operational changes needing to be made to their current processes.
• In light of the above obligations, firms have also been given the ability to use ‘non-standard methods of internal safeguarding reconciliation’. However, there are restrictions on how far these can deviate, as well as requirements on reviewing and documenting such processes.
• Another point that was introduced in the Consultation Paper is that firms may use data that is ‘received from third parties’ for the purpose of creating and maintaining their internal records, ‘where no other method is reasonable’.

Enhanced monitoring and reporting

These proposals are quite clearly aimed at remedying the issue raised in the Consultation Paper, that the FCA felt it did not have enough tools to monitor firms compliance with safeguarding obligations.

• There are also changes around external safeguarding audit which need to be performed by qualified auditors. The FCA has also introduced the requirement for firms to take reasonable steps to make sure that an auditor has the required skill, resources and experience to perform their functions. It appears that the FRC is working on the introduction of an auditing standard for this but there is no confirmation on timing except that the FCA is hoping to align timelines as far as possible. Some concessions have, however, been made:
  • an exemption to the audit requirement has been included for firms who have not been required to safeguard more than £100,000 of relevant funds at any time over a period of at least 53 weeks;
  • the timing of submission for the first audit has been extended to 6, rather than 4, months following the end of the payment firm’s audit period; and
  • updated guidance has been included to clarify that payments firms are not required to appoint the same auditor for their safeguarding audit and their statutory audit.
• The monthly safeguarding reporting directly to the FCA (in the form of a new ‘Safeguarding return’) has been retained, both in form and frequency. The FCA continues to believe that monthly reporting is necessary and proportionate and have not exempted SPIs from the obligation. Some adjustments have been made to the form that simplify some of the requirements, and questions on safeguarding from other regulatory returns have been removed. Firms will however have to identify whether they are using a non-standard method of reconciliation as part of this return and confirm they have conducted at least one internal and external safeguarding reconciliation each Reconciliation Day.

Strengthening elements of safeguarding

Due to the scrapping of the ‘Post-Repeal Reforms’, this limb is likely to have less of an impact for firms than originally proposed but still includes a number of key changes firms will need to consider.

• Chief amongst them will be the new rules on diversification of third parties involved in the firm’s safeguarding processes, which have been implemented without change. To demonstrate ongoing compliance with this requirement firms will need to document not only the approach and rationale for decisions about whether diversification changes are required, but also for the frequency of review.
• No changes have been made yet on firms investing relevant funds in secure, liquid assets but the FCA confirms that they maintain a “low risk tolerance” towards broadening the types of assets considered secure and liquid. As the main changes in this area were wrapped up in the proposal for the statutory trust, which would have significantly changed how firms approached their ability to invest, this will be one for firms to consider as part of any movement on any Post-Repeal Reforms.
• Further guidance has been provided on insolvency policies and guarantees around the ‘3 month lead time’ ahead of the end of such a policy / guarantee and the steps that a firm would need to take.
• Guidance requested by the industry on the nuanced topic of when safeguarding obligations start and end has been brought forward, including on the requirements for inbound transactions, payments made before funds are received and FX transactions. Firms will need to make sure their approach fully reflects the new guidance.

As always, do let us know if you would like to discuss.