FCA Safeguarding Report: New Requirements Explained for UK E-Money and Payments Firms

The UK Financial Conduct Authority (FCA) has introduced new safeguarding oversight measures for all e-money institutions and payment institutions operating in the UK.

Previously, safeguarding audits applied only to larger EMIs, and safeguarding information formed a small part of a broader regulatory submission. As a result, the FCA had limited insight into how smaller firms safeguarded money day-to-day.

PS25/12 changes this.

From 7 May 2026, all UK EMIs and PIs that safeguard funds must complete an annual safeguarding audit, and all firms will begin submitting a dedicated monthly safeguarding return through RegData.

But verifying that these changes are being applied correctly in practice isn’t going to be an easy feat.

For compliance teams, this mainly means more frequent reporting and more structure around safeguarding data.

Let’s dive in to the main changes EMIs and PIs need to be aware of.

What Exactly are the New FCA Safeguarding Requirements?

Let’s start with recapping what safeguarding means in practice.

Safeguarding requires firms to hold customer funds in a separate, protected account so that the money remains isolated from the firm’s own assets. This way, if a firm collapses, safeguarded customer funds should be returned quickly to customers (as they are not used for business operations).

With the PS25/12 coming into effect from May 2026, the FCA has two major objectives: expanding who must undergo an annual audit, and who must submit a monthly return, to have more oversight into how firms safeguard funds day-to-day.

Here’s an overview of the FCA’s annual audit and monthly return:

Who is in Scope?

The return applies to all firms that are required to safeguard customer funds, including:

• E-money institutions (EMIs)
• Authorised payment institutions (APIs)
• Small payment institutions (SPIs) that have opted in
• Small e-money institutions (SEMIs) that have opted in

The return covers relevant funds safeguarded under the PSRs and EMRs.

All firms must complete sections 1–9. Sections 10–17 apply only where firms provide unrelated payment services, such as EMI + UPS models or opted-in credit unions.

Timing, Frequency, and Submission

The new rules go live on 7 May 2026.

The return must be submitted monthly, within 15 business days after month-end, via the FCA’s RegData platform. The first return is expected to be due on 19 June 2026, based on the initial reporting period.

Returns can be keyed directly into RegData or submitted using XML or API-based automation (we can help! 😉).

What truly sets Complyfirst apart is its ability to simulate a regulator’s review, identifying potential data discrepancies or inconsistencies across multiple reports before submission.

Pamela Crilly, EU COO, TrueLayer

Read case study

How FCA Safeguarding Reporting Works in Practice

In practice, safeguarding reporting is a repeatable monthly process that sits alongside month-end close.

Each month, firms will calculate how much customer money should be safeguarded, confirm where those funds are held, and reconcile customer liabilities against safeguarding accounts. The return then records whether safeguarding requirements were met at all times, including on a D+1 basis where required.

Any shortfalls, excesses, adjustments, or notifiable issues must be identified and explained. Over time, this creates a consistent audit trail that feeds directly into the annual safeguarding audit.

What Information Firms Need to Report

Now, on to the data fields you’ll need to collect. If you were required to safeguard during the period, sections 1-9 apply:

Now on to the data fields you’ll need to collect.

If you were required to safeguard during the period, sections 1–9 apply:

Basic set-up

Your firm name, category of safeguarding institution, and details on your last safeguarding audit.

Safeguarding method

If you were in scope for safeguarding, what method did you use (segregation, insurance/guarantee, or some combination), the number of clients you safeguarded for, and any use of non-standard internal reconciliation procedures during the period.

Balances

Simply your highest and lowest safeguarding requirement during the period.

Where funds are held

• If segregation is used:
  The institution where funds are held, the type of account, number of accounts, total amounts held, country, and whether the contract is fixed-term or has a notice period.
• For insurances/guarantees:
  Name of insurer or guarantor, amount covered, date of expiry, and total overdue premiums.
• For investment in secure liquid assets:
  The asset type, name of custodian, and total value of assets held at the end of the period.

Resource vs requirement

You report what you’ve actually safeguarded across bank accounts, segregated funds not yet placed, relevant assets, and any insurance/guarantee cover.

Then you compare that to what you should be safeguarding (including any amounts received but unallocated to an individual client).

Then you work out whether you had an excess or shortfall at month-end and disclose what you did to fix it.

The D+1 (Day plus 1) segregation check

You report your requirement vs resource from your last internal reconciliation, along with any adjustments made.

Reconciliations

Did you carry out:

• Internal reconciliations using your own records every reconciliation day?
• External reconciliations using external evidence (e.g. bank statements)?

Record-keeping

This is your inventory of all safeguarding accounts and assets, including:

• How many accounts you had at the start of the month
• How many you opened
• How many you closed
• How many you had at the end of the month

Then you confirm how many of those accounts are covered by an acknowledgment letter, and if letters are missing, explain why.

Notifiable breaches

This is where the FCA is basically asking: did anything happen this month that you were required to notify them about under CASS, for example:

• Material errors in records — materially out of date, inaccurate, or invalid
• Failed reconciliations — you can’t perform the required internal/external reconciliations
• Unresolved discrepancies — you’re unable to fix shortfalls or excess after reconciliation
• Material shortfalls — a material difference between safeguarding requirement vs resource
• Insurance/guarantee — about to expire without replacement lined up (you need to tell the FCA three months in advance)
• Any other breach of duty under CASS 15

For firms providing unrelated payment services i.e. payment services unrelated to the issuance of e-money, you repeat the same checks as above in sections 10-17.

EMIs who provide UPS, SEMI opt-in and credit union opt-ins may have to complete this section.

Complyfirst Supports Monthly FCA Safeguarding Reporting

In practice, the biggest impact is the shift to regular reporting. Safeguarding data often sits across finance, operations, and compliance teams, and monthly reporting requires tighter coordination between those groups.

Month-end is already a busy period. Adding a safeguarding return means processes need to be repeatable, reconciliations need to be reliable, and last-minute fixes need to be kept to a minimum. This is where we can help.

Here’s how Complyfirst can help pick up the monthly load:

Direct API Integration with FCA RegData

Complyfirst has a direct API integration with the FCA RegData platform.

This means:

• No manual keying of fields line by line into RegData
• No re-entering data already reconciled internally
• No duplication between internal reports and FCA submission

Instead, safeguarding data flows directly into the FCA reporting format via system integration.

What This Enables in Practice

Because submission is integrated rather than manual, firms will benefit from:

• Automated safeguarding data collection
• Built-in data validation and error checks before submission
• Accurate RegData-ready XML generation
• Clear review, sign-off, and version control processes
• Responsive support during month-end madness

Conclusion

The FCA’s safeguarding changes are mainly about consistency. By moving to monthly reporting, the FCA gains regular visibility of how customer funds are protected. For EMIs and payment institutions, the focus now is on setting up clear, repeatable processes so safeguarding reporting becomes part of the normal month-end cycle, rather than a recurring disruption.