FCA Safeguarding Checklist: 25 Points for Payment and E-Money Firms

Key takeaways

• This checklist covers the 25 points a UK payment or e-money firm should be able to evidence under CASS 15 and PS25/12.
• It is grouped into governance, accounts, daily operations, reporting and audit, and resolution.
• Each point should be answerable with a document or a record, not a statement of intent.
• Firms can use it as a self-assessment before the annual safeguarding audit.

How to use this checklist

The checklist below is built from the requirements of CASS 15, CASS 10A, SUP 3A and SUP 16.14A, which came into force on 7 May 2026 under PS25/12. It is written for the head of compliance, the head of finance and the senior manager accountable for safeguarding. For each point, the test is whether the firm can produce evidence today, not whether it intends to.

Work through it before the annual safeguarding audit, after any material change to the business, and whenever a new product, bank or currency is added. For short answers on the rules behind each point, see CASS 15 questions answered, and give the results to the individual responsible for safeguarding oversight.

Governance

Governance points test whether safeguarding has an owner and a written framework that the board has approved. Without them, every other control lacks authority, and auditors will treat gaps elsewhere as a governance failure rather than an isolated error.

1. A named senior manager is accountable for safeguarding.
2. The board has approved the safeguarding policy within the last 12 months. See our safeguarding policy template.
3. Relevant funds are defined for every product, including when the obligation starts and ends.
4. The safeguarding method for each pool of funds is documented: segregation, insurance or guarantee.
5. The board receives regular management information on reconciliations, differences and breaches.

Accounts and institutions

Account points test whether customer money sits only where it should, at institutions the firm has checked, with the legal protections that stop it being used for the firm's own debts. A single account opened without a designation or an acknowledgement letter can undermine the protection of every customer whose money passes through it.

1. Every safeguarding account is listed in a register with its institution, currency and designation.
2. Every safeguarding account has a signed acknowledgement letter. See acknowledgement letters.
3. Bank charges are not debited from safeguarding accounts.
4. Due diligence on each institution has been reviewed in the last 12 months. See bank due diligence.
5. Concentration limits across institutions are set and monitored.

Daily operations

Daily operations are where most safeguarding failures begin. These points test whether the firm knows its position every reconciliation day, keeps its pools separate, and corrects differences before the day ends. If the firm can evidence only one group of points perfectly, it should be this one, because the monthly return, the audit and the resolution pack all depend on these records.

1. Reconciliation days are defined, including foreign market closures.
2. A fixed reconciliation point is set and used every day.
3. The internal safeguarding reconciliation is performed on every reconciliation day. See CASS 15 reconciliation.
4. The internal deposit reconciliation is performed where funds are received outside safeguarding accounts.
5. The external safeguarding reconciliation is performed on every reconciliation day.
6. E-money and payment services pools are calculated separately.
7. Shortfalls are funded and excesses withdrawn by close of business on the day found. See shortfalls and excesses.
8. Every difference is recorded with its cause, owner and approval.

Reporting, audit and resolution

The final group covers what the FCA and the auditor see. These are the points where gaps become visible outside the firm, so they deserve particular attention before each audit period closes.

1. The monthly safeguarding return is submitted within 15 business days of month end. See REP027.
2. The return agrees to the daily reconciliation records.
3. The firm knows when it must notify the FCA and has a procedure to do so without delay.
4. A qualified auditor is appointed if more than £100,000 was safeguarded at any point in the previous 53 weeks.
5. The audit period and submission deadline are diarised.
6. The resolution pack is complete, current and retrievable within 48 hours. See the CASS 10A resolution pack.
7. The resolution pack has been tested by retrieving it within the last 12 months.

Using the results

Any point the firm cannot evidence today is a gap. Rank gaps by the harm they could cause customers: missing reconciliations and unfunded shortfalls first, documentation gaps second. Record the plan and the owner for each, and report progress to the board. An auditor who finds a gap the firm already identified and is fixing reaches a different conclusion from one who finds it first.

Repeat the exercise at least twice a year. Safeguarding operations drift as businesses grow: new currencies, new processors and new products each add steps that the original design did not cover. A checklist completed only once describes the firm as it was, not as it is.

Safeheld produces the daily reconciliation records, difference log, monthly return figures and audit evidence that most of these points depend on. See Safeheld reconciliation and CASS 15 software.

Frequently asked questions

What does an FCA safeguarding checklist cover?

Governance, accounts and institutions, daily reconciliation and shortfall handling, monthly reporting, the annual audit and the resolution pack.

When should firms use a safeguarding checklist?

Before each annual audit, after material changes and when adding products, banks or currencies.

Which rules does the checklist reflect?

CASS 15, CASS 10A, SUP 3A and SUP 16.14A, introduced by PS25/12.

What is the most important point?

Daily internal and external reconciliation with same-day correction of shortfalls, because every other control depends on it.

References

• FCA, PS25/12: Changes to the safeguarding regime for payments and e-money firms
• FCA, Policy Statement PS25/12 (full text)
• FCA Handbook, CASS 15.8 Records, accounts and reconciliations
• The Electronic Money Regulations 2011
• The Payment Services Regulations 2017

About Safeheld

Safeheld reconciles client money every day, resolves every difference and prepares every regulatory return for sign-off, for regulated firms in the United States, the United Kingdom, the European Union, Canada, Australia, Singapore and Hong Kong. To discuss your operations, contact us at safeheld.com/contact.

This article is for general information and does not constitute legal or regulatory advice.