On 7 May 2026, the FCA's new Supplementary Safeguarding Regime came into force for payment and e-money firms. If you hold customer funds, the obligations you've had since the PSRs 2017 and EMRs 2011 haven't changed — but how you have to evidence them has changed substantially. High-level guidance has been replaced with prescriptive, operational rules across CASS 15, CASS 10A, SUP 3A and SUP 16.14A. Firms that treated 7 May as a soft deadline are now finding it was a hard one: the monthly return runs from day one.
Here's what is actually required now
- Daily reconciliations of relevant funds on every reconciliation day. After industry feedback, the FCA excludes weekends and bank holidays — but non-standard methods require an independent auditor's report.
- A monthly safeguarding return to the FCA, due within 15 business days of each month-end, confirming reconciliations and safeguarding practices.
- An annual safeguarding audit by a qualified auditor — no longer an unqualified consultant — unless you've held less than £100,000 in relevant funds over a rolling 53-week period. The first report is due within six months of your first relevant period-end; subsequent reports within four.
- A living resolution pack (CASS 10A) that lets an administrator trace where funds sit, who your agents and distributors are, and how money is returned quickly if the firm fails — retrievable at short notice, not reconstructed after the event.
- Reviewed acknowledgement (trust) letters, refreshed at least annually, plus a review of any existing third-party safeguarding arrangement within three months of the rules coming into force.
The reason the FCA has done this is straightforward: safeguarding has been a persistent source of consumer harm. When firms fail, customers too often wait too long — or recover too little — because records were incomplete, or customer money was commingled with the firm's own working capital. The regime is designed to make customer funds visible, verifiable and repeatable, so they can be returned quickly and in full. To support the first cycle, the Financial Reporting Council published interim guidance for safeguarding auditors on 18 March 2026, drawing on the existing CASS Assurance Standard; a dedicated standard will follow consultation.
The real bottlenecks are assembling and maintaining the resolution pack, and securing audit capacity in time.
For most firms, the daily reconciliation isn't the hard part — many already do some version of it. The real bottlenecks are assembling and maintaining the resolution pack, and securing audit capacity in time. Qualified auditors are in finite supply, and firms that haven't started those conversations risk missing the first reporting deadline. And this is only stage one. A full CASS-style regime, with a statutory trust over safeguarded funds, has been deferred but not dropped — the FCA expects to consult again in 2027/28. Firms that build the operating capability now won't just clear this cycle; they tend to move faster with sponsor banks and custodians, and they'll be ready for what comes next.
What firms should do (if you haven't already)
- Confirm your monthly return is being produced and filed on time — that clock is already running.
- Stress-test your resolution pack: could someone outside your team locate and return customer funds using it today?
- Lock in a qualified auditor and agree your audit period and scope now, not near the deadline.
- Reconcile the substance, not just the format — make sure customer funds and working capital are genuinely and provably separate.
- Work through every existing third-party arrangement within the three-month window, and refresh acknowledgement letters.
Sources: FCA PS25/12 and CASS 15 / CASS 10A / SUP 3A / SUP 16.14A (in force 7 May 2026); FCA Payments Regulatory Priorities (25 March 2026); FRC interim guidance for safeguarding auditors (18 March 2026); Norton Rose Fulbright, Ashurst, RSM and Bratby Law commentary (Feb–May 2026).