#
The FCA Supplementary Safeguarding Regime (CASS 15, CASS 10A, SUP 3A, SUP 16.14A) has applied since 7 May 2026, introducing daily reconciliation, diversification review, independent audit and resolution-pack obligations for payment and e-money institutions.
The operational detail is significant. The new rules introduce a mandatory annual safeguarding audit by an independent auditor, separate from the statutory audit; a resolution-pack requirement under CASS 10A; and a new monthly safeguarding return under SUP 16.14A. Insurance proceeds must be paid into a safeguarding account promptly on insolvency under CASS 15.5.4R. These independent-audit and monthly-return obligations materially raise compliance cost for smaller EMIs and PIs, where fixed compliance overhead bites hardest.
On the promotions limb, a May 2026 FCA review of 10 financial-promotions s.21 approver firms found failings including approving promotions with unsubstantiated claims, exposing retail investors to professional-client promotions, and over-reliance on third-party templates. This signals heightened FCA enforcement appetite on the s.21 approver gateway, an under-indexed enforcement vector that affects both bank and non-bank firms acting as approvers.
Outlook
W1b is escalating. The 7 May 2026 in-force date for the Supplementary safeguarding Regime is the dominant near-term event, after which audit, resolution-pack and monthly-return obligations bind. Beyond that, the end-state Post-Repeal Regime — a CASS-style statutory trust — sits on the medium horizon pending repeal of underlying EMR/PSR requirements under FSMA 2023. The financial-promotions review signals a parallel enforcement track that is likely to intensify supervisory attention on s.21 approvers through 2026.
Conduct, Safeguarding & Financial Promotions
The UK's payments safeguarding regime has shifted from a principles-based standard to a detailed, prescriptive rulebook. The FCA's Supplementary Safeguarding Regime, published via Policy Statement PS25/12 on 7 August 2025 and comprising amendments across CASS 15, CASS 10A, SUP 3A and SUP 16.14A, came into force on 7 May 2026. Under the new regime, safeguarding institutions must perform daily internal safeguarding reconciliations, and where relevant, daily external safeguarding reconciliations, comparing their safeguarding resource against their safeguarding requirement and promptly resolving any discrepancy. Institutions holding more than GBP 100,000 of relevant funds at any time over a period of at least 53 weeks must arrange an independent annual safeguarding audit, with the auditor required to deliver the safeguarding report to the FCA within four months of the end of the period covered (extended to six months under a transitional rule for periods ending within 53 weeks of 7 May 2026). Institutions must also submit monthly safeguarding returns to the FCA within 15 business days of the end of each calendar month, and maintain a CASS resolution pack retrievable within 48 hours of an insolvency event, administrator appointment, or equivalent trigger. CASS 15.6 separately requires due skill, care and diligence in selecting and periodically reviewing the banks, custodians, insurers and guarantors that hold safeguarded funds, with explicit consideration of the need for diversification, though no numerical diversification cap has been set.
The regime's practical bite is already visible. Euro Exchange Securities UK Limited was placed into special administration on 11 June 2026 under the Payment and Electronic Money Institution Insolvency Regulations 2021, following FCA requirements imposed on the firm on 2 June 2026 and the appointment of interim managers on 4 June 2026. The grounds cited for these actions include systemic weaknesses in the firm's financial-crime framework and in its safeguarding arrangements. The FCA subsequently opened a possible investigation into Money Laundering Regulations offences on 16 September 2026. This is a live enforcement matter illustrating how the new, more prescriptive safeguarding standard is being applied in practice to a firm found wanting against it.
The backdrop against which this tightening sits is instructive: the FCA has stated that payment firms which became insolvent between the first quarter of 2018 and the second quarter of 2023 had average shortfalls of 65% of their customers' funds, and that funds held by payment and e-money firms are not directly protected by the Financial Services Compensation Scheme. Instead, firms must safeguard funds themselves, and a shortfall at insolvency falls on customers rather than being made good by a deposit guarantee scheme. Notably, the FCA has stated it is not proposing to move to a full statutory trust model — the so-called Post-Repeal Regime — without a further audit period and consultation, stating explicitly that it has listened to industry concerns and will review implementation once a full audit period has been completed following the Supplementary Regime coming into force.
A further governance obligation worth flagging: firms already holding a relevant appointment when the new safeguarding rules came into force are required to review that appointment within three months of the rules coming into force, a transitional obligation that would have fallen due in early August 2026.
Outlook
The Supplementary Regime's first full audit cycle has not yet completed, so the FCA's own stated review of whether to progress toward the statutory trust Post-Repeal Regime remains pending; firms should not assume the current prescriptive-but-not-trust-based model is final. The Financial Reporting Council's consultation on a safeguarding assurance standard for payment and e-money institutions closes 26 November 2026, and its outcome will shape how auditors approach the independent safeguarding audit requirement going forward. The Euro Exchange Securities enforcement matter remains live, with the FCA's Money Laundering Regulations investigation opened in September 2026 still in progress as at this cycle; further developments in that case would be a natural signal of how the FCA treats combined safeguarding and financial-crime-framework failures going forward.
3 earlier distinct update(s)
Conduct, Safeguarding & Financial Promotions
The defining event this cycle for UK payments conduct regulation is confirmation that the FCA's Safeguarding Supplementary Regime (CASS 15, PS25/12) in force from 7 May 2026. The regime replaces the FCA's prior safeguarding framework with a considerably more prescriptive rulebook, and it applies specifically to non-bank payment institutions and e-money issuers rather than to bank-based payment providers. That scope decision reinforces the persistent divide in UK payments oversight between banks — which hold customer money inside deposit protection and prudential capital frameworks — and non-bank PIs/EMIs, whose customer funds are protected only through safeguarding segregation arrangements that the regulator has judged require substantially tighter operational discipline.
Under the new regime, in-scope firms face daily reconciliation, monthly reporting, annual independent audit obligations for balances of £100,000 or more, together with 48-hour-retrievable resolution-pack requirements for PIs/EMIs. The resolution-pack requirement in particular is aimed squarely at insolvency scenarios: it exists so that an insolvency practitioner appointed after a PI or EMI failure can access, within 48 hours, the information needed to identify and return safeguarded customer funds, rather than the extended and uncertain recovery processes that have characterised past PI/EMI insolvencies.
The FCA's own rationale for the intervention centres on the scale the safeguarded-funds pool has reached: PS25/12 published 7 August 2025 sets a nine-month implementation window, and the accompanying data point is that EMIs safeguarded ~£26bn in 2024 (up from £11bn in 2021). That growth trajectory is treated by the regulator as evidence that the prior, lighter-touch safeguarding regime was designed for a smaller, less systemically consequential non-bank payments sector than the one that now exists. The tightening is therefore best read as a scale-driven recalibration of the bank/non-bank divide rather than a response to a specific failure event.
On the assurance side, the Financial Reporting Council's interim transitional guidance for safeguarding auditors published 18 March 2026 ahead of a dedicated Safeguarding Assurance Standard expected after a 2027 consultation. This creates a two-stage timeline for the audit function: firms conducting their first CASS 15 annual audit will do so under interim guidance rather than a purpose-built assurance standard, with the latter not arriving until after next year's consultation process concludes. Financial-promotion enforcement activity for approved-persons/s.21-approver regimes and crypto/BNPL promotions was not actively searched this cycle and is not covered in this sub-brief.
Outlook
Firms safeguarding £100,000 or more should expect the daily reconciliation, monthly reporting, annual independent audit cadence and resolution-pack readiness requirement to be operationally binding from 7 May 2026. PS25/12 published 7 August 2025 sets a nine-month implementation window, which is the runway firms have had to build the new reconciliation, reporting and resolution-pack capability. The audit function will operate on interim FRC guidance until the dedicated Safeguarding Assurance Standard emerges from its 2027 consultation, meaning methodology for the first cycle of CASS 15 annual audits is not yet settled. Continued tightening on the conduct and safeguarding side is the base case for the remainder of this cycle, and the bank/non-bank asymmetry in how customer funds are protected looks set to remain — and arguably widen — as this regime beds in.
Conduct, Safeguarding & Financial Promotions
The FCA's Safeguarding Supplementary Regime, spanning CASS15, CASS10A, SUP3A and SUP16.14A, has been in force since 7 May 2026, following a nine-month implementation runway from policy statement PS25/12. It applies to authorised and small payment institutions, authorised and small e-money institutions, and credit unions issuing e-money, not to deposit-taking banks — the regime's obligations fall squarely on the non-bank payment and e-money sector. The regime requires daily reconciliation, a new monthly safeguarding return under CASS15, and a mandatory annual independent audit, with the audit waived for firms holding below £100,000 average outstanding relevant funds over 53 weeks. The monthly return is, for the first time, standardising D+1 segregation, reconciliation and custodian data across the non-bank payments sector, closing a data gap regulators previously lacked in supervising how client funds are held. This represents a structural shift from the FCA's previous principles-based safeguarding approach to a prescriptive, data-driven regime.
Outlook
A fuller CASS-style statutory-trust Post-Repeal Regime remains on the horizon, deferred to a future HM Treasury payment-services-law consultation expected later in 2026 or in 2027, which would require amending the Payment Services Regulations 2017 and the Electronic Money Regulations 2011. No material UK financial-promotion enforcement action, such as against section 21 approvers or crypto/BNPL promotions, surfaced this cycle.
Conduct, Safeguarding & Financial Promotions
On 30 June 2026 the FCA published its final cryptoasset rules and guidance, completing its Crypto Roadmap. The rules apply to firms granted FSMA permission on or after 25 October 2027, when the regime comes into force. This publication moves the UK crypto-conduct perimeter from proposal to final form and applies to both bank and non-bank entities, though the most commercially significant calibrations this cycle are directed at non-bank stablecoin issuers.
The headline conduct calibration is the reduction of the stablecoin issuer capital requirement from 2% to 1% of the total value of stablecoins issued, with the FCA citing proportionality for larger issuers. This halved capital buffer materially lowers the cost of being a UK stablecoin issuer and is a deliberate competitiveness lever. The FCA's 1% level positions the UK below the EU MiCA 2% stablecoin issuer capital level — a tangible jurisdiction-selection factor for issuers choosing a base.
Beyond the capital recalibration, the FCA made several further conduct easings relative to earlier consultation drafts. Firms were given more time in some cases to return funds to customers redeeming stablecoins. Certain public-disclosure obligations present in earlier drafts were removed. The regime shifted to firm-run internal stress tests submitted annually to the FCA, replacing certain prior public-disclosure obligations for stablecoin reserves. These changes ease the operational and disclosure burden on stablecoin issuers; the shift to internal stress tests reduces public transparency but lowers compliance cost. These calibrations are currently anchored primarily to Tier 2–3 journalism rather than two distinct Tier 1 primary anchors and are held at High confidence pending direct rulebook citation.
The safeguarding architecture for non-systemic stablecoin issuers under the FCA regime includes the redemption-fund return timeline relaxations noted above. For systemic issuers under Bank of England regulation, the safeguarding design is more prescriptive — two statutory trusts plus a wind-down reserve, with redemption at par into central bank money — and is addressed in the W2 module.
Looking ahead within the FCA's own pipeline, the regulator will publish a further perimeter-guidance policy statement in September 2026 and consult later in 2026 on DeFi guidance, DLT operational-resilience guidance, and Financial Crime Guide updates. A policy webinar is set for 17 July 2026. The DeFi and Financial Crime Guide consultations carry illicit-finance implications that are routed to the Financial Intelligence Monitor; WPM records the forward pipeline dates only.
The May 2026 safeguarding rules for payment institutions and e-money institutions (PS25/12) remain a live W1b item for non-bank PIs and EMIs outside the crypto perimeter. That development was not the subject of new structured findings this cycle but is noted as a standing position item for the next research pass.
Outlook
The FCA policy webinar on 17 July 2026 is the immediate next event. A further perimeter-guidance policy statement is expected in September 2026. DeFi guidance, DLT operational-resilience guidance, and Financial Crime Guide consultations are expected in H2 2026. The mandatory FCA cryptoasset regime comes into force 25 October 2027. The principal residual uncertainty on conduct calibration is whether the 1% capital level and the redemption and disclosure relaxations will be confirmed without revision when the final rulebook texts are directly cited.
Sources and findings (5)
- T1FCA — PS25/12: Changes to the safeguarding regime — FCA PS25/12 sets out final rules for the Supplementary safeguarding Regime, with the Payments and Electronic Money (Safeguarding) Instrument 2025 (FCA 2025/38) coming into force on 7 May 2026 after a nine-month implementation period.
- T1Farrer & Co / FCA PS25/12 — The reform proceeds in two stages: an interim 'Supplementary Regime' improving compliance/record-keeping/reporting, and an 'end-state' Post-Repeal Regime replacing EMR/PSR safeguarding with a CASS-style statutory trust holding relevant funds for consumers.
- T1FCA CP — Safeguarding reform / PS25/12 (fca.org.uk) — The current safeguarding requirements derive from the EMRs 2011 and PSRs 2017, supplemented by detailed guidance in Chapter 10 of the FCA Approach Document; CP24/20 (Sept 2024) was the consultation underpinning the reform.
- T1FCA PS25/12 — Safeguarding (fca.org.uk) — New rules introduce a mandatory annual safeguarding audit by an independent auditor (separate from statutory audit), a resolution-pack requirement (CASS 10A), and a new monthly safeguarding return (SUP 16.14A); insurance proceeds must be paid into a safeguarding account promptly on insolvency (CASS 15.5.4R).
- T1FCA — financial promotion approver review (fca.org.uk) — Financial-promotions conduct: the FCA s.21 approver gateway applies; a May 2026 FCA review of 10 fin-prom approver firms found failings including approving promotions with unsubstantiated claims, exposing retail investors to professional-client promotions, and over-reliance on third-party templates.