EMI Safeguarding: What Electronic Money Institutions Must Do

The principle: e-money is a liability, safeguarding is its cover

When a customer pays an EMI, the firm issues electronic money and incurs a redemption liability. Safeguarding exists so that this liability is covered by identifiable assets held outside the firm's general estate, and so that customers are paid ahead of general creditors if the firm fails.

Every operational requirement follows from that. Segregation exists so the funds are identifiable. Daily reconciliation exists so cover is confirmed continuously rather than assumed. The resolution pack exists so an insolvency practitioner can act quickly. Records exist so entitlements can be attributed to individual customers.

Firms that internalise the principle build better controls than firms that work from a checklist, because the principle answers the edge cases that the checklist does not anticipate. The wider regime this safeguarding duty now sits within, brought in through PS25/12, is covered in the cornerstone explainer on what PS25/12 changed.

Calculating outstanding e-money, the figure everything else reconciles to

Outstanding e-money is the redemption liability the firm owes its customers at a given moment: the sum of every e-money balance in issue that has not yet been redeemed, converted, or expired under a proper contractual basis. It is a derived figure, built from the issuance ledger, not an observed one, and it is the figure the safeguarding account balance has to cover, not the other way round.

This distinction matters more than it sounds. The safeguarding account balance is simply what sits in the bank. The obligation is the outstanding e-money figure calculated from the customer and programme ledgers. A firm that reconciles the account balance against itself, or against a prior day's obligation carried forward unchanged, has produced a number that balances but proves nothing, because it never tested the balance against the current liability.

Timing between issuance and receipt of funds is where the calculation is most often built wrong. E-money is typically issued at the moment funds are received, so the liability and the cash arrive together. But where a top-up clears into a collection account ahead of conversion, or where a distributor collects on the EMI's behalf and reports with a lag, the receipt and the issuance date can diverge. Relevant funds are safeguardable from the moment of receipt regardless of when the corresponding e-money is issued, so a ledger that only counts liability from the point of issuance will understate what needs to be covered.

Partial redemptions add a further layer. Where a customer redeems part of a balance, the outstanding e-money figure must fall by exactly that amount from the moment the redemption is effected, not from the moment the payout instruction is logged or the moment it clears at the receiving bank. Firms that reduce the liability on request logging release safeguarding cover for money that has not yet left the firm, and firms that wait for payout confirmation before recognising the redemption at all continue to over-report a liability that has already reduced. Neither error is safe; both distort the reconciliation in a direction that hides the true position.

The underlying risk is a stale ledger. If the outstanding e-money figure is pulled from a batch process that runs once a day, or from a programme manager's file that arrives a day late, the reconciliation performed against it will tie out cleanly and still be wrong, because both sides of the comparison are built from the same lagging source. A reconciliation that agrees with itself is not evidence of adequate cover; it is only evidence that two numbers derived from the same stale input matched. The control that catches this is independent verification of the liability calculation against source ledgers and distributor feeds on the same cycle as the reconciliation itself, not trust in the fact that the numbers tied.

Segregation versus insurance or guarantee

The segregation method requires relevant funds to be placed in a separate account with an authorised credit institution or the Bank of England, or invested in secure liquid assets held with an authorised custodian. The account must be designated to show it holds safeguarded funds, and the institution must acknowledge that the firm has no beneficial interest and that no right of set-off applies against the firm's other liabilities.

The insurance method requires a policy or comparable guarantee from an authorised insurer or credit institution, unconnected to the firm, with proceeds payable into a segregated account on the firm's insolvency and cover matching the amount that would otherwise be segregated.

In practice the overwhelming majority of UK EMIs use segregation. Insurance is difficult to place at commercially viable pricing for the amounts involved, and supervisory scrutiny of the policy terms, particularly exclusions and the payment trigger, is intense. Firms using the insurance method should expect to evidence the adequacy of cover on the same daily cycle as a segregating firm evidences its balances.

Segregation or insurance: how firms actually choose, and what each costs operationally

The choice is rarely made on regulatory preference; it is made on what a firm can actually operate and evidence day to day. Segregation gives the firm direct, continuous sight of its own cover: the balance sits in an account the firm controls and can reconcile against at any point in the day. That visibility is exactly what daily reconciliation requires, which is why it is the default model for firms of any real scale.

Insurance shifts the evidence burden elsewhere. Instead of proving a balance, the firm has to prove that a policy remains in force, that its cover level tracks the current outstanding e-money figure rather than a level fixed when the policy was underwritten, and that no exclusion has been triggered by the firm's own conduct. That is a harder thing to evidence on a daily cycle than a bank statement, because policy documentation does not update itself the way an account balance does.

Counterparty and provider concentration cuts both ways. A segregating firm concentrated in a single credit institution carries the risk that institution's own failure or operational disruption removes access to the safeguarding account precisely when it is needed. An insured firm concentrated with a single insurer carries an equivalent risk if that insurer's rating deteriorates or it exits the safeguarding line of business, which has happened often enough in this market that firms relying on insurance build in renewal lead times of several months.

The lapse scenario is the sharpest operational test of the insurance method. A policy that lapses mid-period, whether through non-renewal, a dispute over premium, or the insurer withdrawing from the class of business, leaves relevant funds uncovered from the moment of lapse unless the firm has already moved to segregation or secured replacement cover. Because this is foreseeable, supervisors expect firms using insurance to hold a credible contingency plan for a lapse, not to treat renewal as a formality to be handled when the current term ends.

This is the practical reason most firms segregate: it removes a dependency on a third party's continued willingness to underwrite the firm, removes the valuation question of whether cover matches the current liability, and produces evidence, a bank balance, that reconciles on exactly the same basis the regulator expects to see tested daily.

The D+1 deadline and where firms fall down

Relevant funds must reach the safeguarding account promptly and, at the latest, by the close of the business day following the day of receipt. This is the requirement most frequently breached, and the breaches are almost always structural rather than deliberate.

The common pattern is receipt into an operational collection account, followed by a sweep. Where the sweep runs on a schedule that assumes same-day settlement, any settlement delay pushes the transfer beyond the deadline. Where the sweep is manual, a public holiday or a staff absence produces the same outcome.

The control is not a better sweep schedule. It is monitoring the age of every unsegregated receipt continuously and escalating before the deadline rather than reporting the breach after it. A platform that only reconciles the safeguarding balance will report the breach; a platform that tracks receipt ageing prevents it.

Cross-border corridors compound this. Where funds pass through a correspondent, the receipt date recorded by the firm and the date funds became available can differ, and the deadline runs from receipt. The FCA's expectations on reconciliation frequency and why daily testing matters even where the D+1 deadline itself is met are set out in the piece on why D+1 reconciliation matters. The deadline and the CASS 15.8.35R comparison are explained in D+1 segregation timing.

Why firms miss the D+1 deadline

Most D+1 breaches trace back to a small set of recurring causes rather than a single systemic failing, which is why they are preventable once the pattern is understood. First, payment cut-offs: a same-day transfer instructed after a bank's internal cut-off time settles the following business day, and a sweep scheduled without margin against that cut-off will routinely miss it, particularly around month end when transfer volumes and processing queues both grow.

Second, weekend and bank holiday sequencing. Funds received on a Friday must reach the safeguarding account by the close of the next business day, which is normally the following Monday, but a sweep process built around a five-day week without an explicit holiday calendar will either miss extended weekends entirely or apply the wrong deadline when a bank holiday falls between receipt and the calculated due date.

Third, funds received through a distributor or programme manager. Where a third party collects on the EMI's behalf, the receipt date for D+1 purposes runs from when the distributor received the funds, not from when the distributor reports or remits them to the EMI. A remittance file that arrives two or three days after collection can put the EMI in breach before it has even recorded the receipt, which is why the reconciliation population has to reach into distributor-level receipt data rather than relying on the EMI's own bank statement as the starting point.

Fourth, card scheme settlement timing. Card acquiring flows settle through the scheme on a cycle the EMI does not control, and the date the scheme reports settlement can lag the date the underlying transaction occurred. Treating the scheme settlement date as the receipt date, rather than establishing when the EMI's right to the funds actually arose, systematically understates how long funds have been outstanding.

Fifth, delayed inbound files generally: any batch process, whether a card acquirer file, an open banking payment initiation confirmation, or a partner bank's end-of-day report, introduces a gap between economic receipt and system-visible receipt, and that gap is where D+1 monitoring built on system timestamps rather than true receipt dates fails silently.

It is also worth separating a late transfer from a shortfall, because they call for different responses. A late transfer means funds that belong in the safeguarding account have not yet arrived, but the firm still holds them and can complete the transfer; it is a timing breach, correctable immediately once identified. A shortfall means the firm does not hold enough to cover the current outstanding e-money figure even once every transfer that should have happened has happened, which is a capital and control failure requiring the firm to fund the difference from its own resources immediately. A firm that treats every aged receipt as a mere timing issue without checking whether the underlying funds still exist risks mischaracterising a shortfall as a delay.

Reconciling outstanding e-money against safeguarded funds

The internal reconciliation compares total outstanding e-money, being the sum of customer balances plus any amounts received and not yet converted, against the firm's recorded safeguarding obligation. The external reconciliation compares that obligation against confirmed balances at every safeguarding institution and third party.

Both are daily obligations for any firm with meaningful flow. Any shortfall is funded immediately from the firm's own resources; any excess is withdrawn so that firm money does not sit commingled with relevant funds.

The subtlety specific to e-money is unredeemed and dormant balances. E-money remains a liability until redeemed, and balances that have been inactive for years remain outstanding e-money requiring cover. Firms that write dormant balances to income without a proper legal basis create a safeguarding shortfall that persists until corrected.

The balances EMIs get wrong

The reconciliation that most EMIs build first covers the safeguarding account against the customer ledger. That covers the easy part of the population and misses the balances that actually cause shortfalls. Distributor and programme-manager balances are the most common gap: where a third party issues e-money on the EMI's behalf or distributes it under a programme arrangement, funds can sit with that party between collection and remittance, and unless the EMI's reconciliation reaches into the distributor's reporting, that money is treated as safeguarded when it has not yet arrived.

Pending redemptions are the second gap. Once a customer requests redemption, the corresponding e-money is being extinguished but the cash has not yet left the safeguarding account, and firms that release the safeguarding obligation the moment a redemption request is logged, rather than when the payout actually clears, can under-safeguard the intervening balance.

Unspent balances on expired or dormant cards are a persistent source of unnoticed liability. E-money issued onto a card that has since expired, or that a customer has stopped using, remains outstanding e-money until formally written back under a proper legal and contractual basis; treating expiry as extinguishing the liability is not correct and produces a shortfall that compounds quietly over years.

Chargeback and scheme settlement timing catches EMIs operating card programmes specifically. A chargeback reverses a transaction days or weeks after the original settlement, and the safeguarding position has to reflect the reversal from the date it takes effect, not from when the scheme report happens to be reconciled. Funds received before e-money is issued, for example a top-up that has cleared into a collection account but not yet been converted into a customer's e-money balance, are relevant funds from the moment of receipt and must be captured in the reconciliation population even though no e-money exists yet to reconcile them against. The allocation and recording rules for such receipts are set out in unallocated and unidentified receipts.

What the EMI board and the auditor will each ask for

A board overseeing safeguarding does not need to see every reconciliation line; it needs management information that actually demonstrates control rather than simply asserting it. That means reconciliation population completeness, showing which safeguarding accounts, distributors, and card programmes were included in a given day's run and confirming that nothing dropped out silently. It means exception ageing, showing how long each open break has been unresolved rather than only the count of breaks currently open, because a break resolved in hours and a break open for three weeks are very different control signals that a simple total conceals.

It also means a shortfall funding events register that records when a shortfall was identified, when it was funded, and the gap between the two, since a pattern of shortfalls that are always funded but always late is itself a control weakness even if no single instance looks severe. And it means a breach register that is current, covering D+1 breaches, reconciliation exceptions, and any other safeguarding-relevant incident, rather than a document that gets updated ahead of the next board meeting rather than as events occur.

The external auditor is testing something broader than any of this in isolation. The SUP 3A audit opinion addresses whether the firm maintained adequate systems and controls throughout the period under review, not merely whether the safeguarding position was correct on the day the auditor happened to look. That means an auditor will sample dates across the period, not just the period end, and a firm that can produce evidence for an arbitrary date in month four just as readily as for the year-end date is in a materially different position from one that can only demonstrate current-state compliance.

Firms building this evidence base manually tend to discover the gap at exactly the wrong moment, when the auditor asks for a specific historic date and the reconstruction takes days rather than minutes. The operational and evidential requirements this creates for audit preparation are set out in the piece on replacing manual evidence collection for safeguarding audits, and the equivalent standard for resolution pack content, which overlaps with but is distinct from audit evidence, is covered in what regulators and auditors expect from evidence packs.

How Safeheld covers e-money safeguarding

Safeheld tracks outstanding e-money and the corresponding safeguarding cover on the schedule the firm sets, normally daily, reconciling internally and externally across every safeguarding account, acquirer, agent, and distributor in the population.

Receipt ageing is monitored against the D+1 deadline so that an unsegregated receipt escalates before the deadline rather than being reported as a breach afterwards. Shortfalls and excesses are recorded as attributable events linked to the run that identified them.

Runs are sealed with a SHA-256 Merkle root and are independently verifiable. Monthly FCA returns, resolution packs, board reporting, and audit evidence all generate from those sealed runs.

Frequently asked questions

What is EMI safeguarding?

EMI safeguarding is the requirement on an electronic money institution to protect the funds it receives for issued e-money from its own creditors, either by segregating them in a designated account or by covering them with insurance or a comparable guarantee, so customers are repaid ahead of the general estate if the firm fails.

How quickly must an EMI safeguard funds it receives?

Relevant funds must be safeguarded promptly and, at the latest, by the close of the business day following the day of receipt. This D+1 deadline applies whether the firm uses segregation or insurance, and it is measured from the date the funds were actually received, including receipts collected by a distributor on the firm's behalf.

Does an EMI have to reconcile daily?

The FCA's expectation for firms with material flow is daily internal and external reconciliation of relevant funds against outstanding e-money. Both reconciliations must be performed each business day, with any shortfall corrected immediately from the firm's own resources and any excess withdrawn promptly.

What happens if an EMI has a safeguarding shortfall?

The firm must fund the shortfall immediately from its own resources so that safeguarded assets again cover the full outstanding e-money liability. The shortfall, when it was identified, and when it was corrected should all be recorded, since a pattern of late-funded shortfalls is itself treated as a control weakness even where each individual gap is small.

When must e-money safeguarding funds be segregated?

Promptly, and at the latest by the close of the business day following the day on which the funds were received, unless the firm relies on a permitted insurance or guarantee method instead.

Do dormant e-money balances still need safeguarding cover?

Yes. Electronic money remains a redemption liability until it is redeemed, so inactive customer balances continue to require cover. Writing them to income without a proper legal basis creates a safeguarding shortfall.

Is the insurance method a practical alternative to segregation?

It is permitted but uncommon in the UK. Placing cover at viable pricing is difficult at scale, and supervisors examine exclusions and payment triggers closely. Firms using it must evidence the adequacy of cover on the same daily cycle that a segregating firm evidences balances.