Since 7 May 2026, UK payment and e-money firms have had to reconcile customer funds every working day, report monthly and face annual audits. Six months in, the first audit cycle is about to test whether firms are ready.

When a UK payment firm fails, its customers are not covered by the Financial Services Compensation Scheme. Their money is meant to sit in a separate, protected pool. Too often, that pool has come up short. The FCA safeguarding rules that took effect on 7 May 2026 are designed to fix that.

Fintechbits analysis

Why the FCA acted

The numbers behind the change are stark. Twelve payment firms that held customer funds failed between 2018 and 2023. On average, customers faced a shortfall of 65% of what they were owed, according to the FCA’s consultation paper CP24/20. At e-money firms the gap was worse, at 80%.

The sector has also grown, which raises the stakes for FCA safeguarding rules. E-money firms safeguarded around £26 billion in 2024, more than double the 2021 figure. Meanwhile, about one in eight UK consumers now holds an account with a payments firm. As a result, a weak safeguarding pool is no longer a niche risk.

What the FCA safeguarding rules require

The FCA set out the FCA safeguarding rules in policy statement PS25/12 in August 2025. The rules sit in a new chapter, CASS 15. They apply to authorised payment institutions and e-money firms, while small payment institutions can opt in.

The FCA safeguarding rules set four core duties. First, firms must reconcile customer funds on every reconciliation day, both against their own records and against the bank. Weekends and bank holidays are excluded. Any shortfall must be topped up from the firm’s own money. Second, firms must file a monthly safeguarding return, known as REP027, within 15 business days of month end.

Third, firms need an annual audit by a qualified auditor. Only firms that have never safeguarded more than £100,000 over a 53-week period are exempt. Finally, every firm must keep a resolution pack, so an administrator can find and return customer money quickly if the firm fails.

Firms must also tell the FCA without delay if they cannot complete a reconciliation or fix a discrepancy. In addition, they must check their safeguarding banks and insurers when they appoint them and regularly afterwards. For a wider look at how UK and US rules protect customer money, see our explainer on business deposits at fintechs.

What it costs

The FCA puts the main cost of the FCA safeguarding rules at £55.6 million, most of it for audits. Its central estimate for audit costs is £53.3 million. Against that, it expects benefits of £137.5 million over ten years. The regime breaks even if just over half of failing firms would have complied.

Industry groups argued those figures understated the true cost of the FCA safeguarding rules. Many firms had to bring their processes up to audit standard before an auditor could sign off. Readiness was patchy too. A survey of 75 compliance and finance staff by Kani Payments, a reconciliation software vendor, found that 32% thought they were compliant but only 13% reconciled daily. In addition, 64% used spreadsheets for their monthly return.

The end state is on hold

One common misunderstanding needs correcting. The FCA safeguarding rules do not put customer funds on trust. The FCA had planned a second stage with a statutory trust and client money style rules. However, it has paused that plan until at least one full audit cycle has run.

The courts reached a similar view earlier. In the Ipagoo case, the Court of Appeal held in 2022 that UK e-money rules do not create a statutory trust. Instead, customers have a ring-fenced claim, and any shortfall must be topped up from the firm’s general estate. Meanwhile, HM Treasury consulted this summer on moving detailed safeguarding rules out of legislation and into the FCA rulebook.

Audits without a final standard

The next test arrives with the first annual audits. However, auditors do not yet have a final standard. The Financial Reporting Council issued interim guidance in March 2026 and opened a consultation on a dedicated standard on 30 September. Responses close on 26 November 2026.

Past experience suggests early results may be rough. When a new audit standard for client money arrived in 2016, adverse opinions rose to 13% of firms before falling to 6% by 2024. Therefore, firms should expect findings in the first round of FCA safeguarding rules audits.

Bank access remains a structural problem for the FCA safeguarding rules too. The Electronic Money Association has warned for years that few banks want to offer safeguarding accounts. Without a reliable bank, even a well-run firm struggles to meet the rules. That pressure also explains why some firms seek their own licences, as Pliant’s FCA e-money authorisation showed.

What firms should be doing now

Taken together, the FCA safeguarding rules point to a short order of work. Automate the daily reconciliation rather than relying on spreadsheets. Next, log every break, its cause and its fix, because auditors will ask. Then test the resolution pack as if an administrator needed it tomorrow. Finally, review safeguarding banks and insurers, and document a backup plan if one withdraws.

The same discipline now applies across the industry. Sponsor banks in the US expect daily reconciliation from their fintech partners too, as our report on embedded finance compliance showed. In both markets, the question has moved from whether a firm has a policy to whether it can prove the money is there.

What to watch next

Several dates will shape the FCA safeguarding rules in 2027. The FRC’s consultation closes on 26 November 2026, with a final audit standard expected in the first half of 2027. The first annual audit reports will follow. HM Treasury is also expected to bring forward legislation in 2027 or 2028 that could revive the trust question.

So far, the FCA has not published data from the first monthly returns or brought any enforcement case under CASS 15. That will likely change once the audits land. Above all, firms that treat safeguarding as daily finance work, not an annual box-tick, will be best placed when it does.

FintechBits covers payments, banking and fintech developments for readers in the US and UK. This article is for information only and is not financial or legal advice. Views expressed are those of the FintechBits editorial team.