Key takeaways
- PS25/12 is the FCA policy statement, published in August 2025, that created the Supplementary Regime for safeguarding. Its rules have applied since 7 May 2026.
- The rules sit in four parts of the FCA Handbook: CASS 15 for safeguarding, CASS 10A for the resolution pack, SUP 3A for the safeguarding audit and SUP 16.14A for the monthly return.
- They apply to authorised payment institutions, e-money institutions, credit unions that issue e-money and small payment institutions that opt in to safeguarding.
- Firms reconcile internally and externally on every reconciliation day, file a monthly return within 15 business days of month end, keep a resolution pack retrievable within 48 hours and, unless exempt, commission an annual safeguarding audit.
- The statutory trust proposed in consultation is not part of the current rules.
What are the key facts?
CASS 15 is the FCA's safeguarding chapter for payment and e-money firms, introduced by PS25/12 and in force since 7 May 2026.
| Item | Position |
|---|---|
| Rules | CASS 15, CASS 10A, SUP 3A and SUP 16.14A, supplementing EMRs regulations 20 to 24 and PSRs regulation 23 |
| Regulator | Financial Conduct Authority |
| Applies to | Authorised payment institutions, e-money institutions, credit unions issuing e-money, opted-in small payment institutions |
| Key deadlines | Segregate by the end of the business day after receipt; reconcile every reconciliation day; return within 15 business days of month end; pack within 48 hours; audit report within 4 months (6 months for the first) |
| In force | 7 May 2026 |
| Last checked | 11 October 2026, against the FCA Handbook and PS25/12 |
What is PS25/12?
PS25/12 is the FCA policy statement that turned safeguarding guidance into detailed rules for payment and e-money firms.
It followed consultation paper CP24/20 and was published in August 2025 with a nine-month implementation period. The FCA's reason is set out in its own figures: firms that entered insolvency between 2018 and mid-2023 had an average shortfall of 65% in funds owed to customers (PS25/12, paragraph 2.3). The rules sit on top of the Electronic Money Regulations 2011 and the Payment Services Regulations 2017, which still define what must be safeguarded. PS25/12 adds how firms record, reconcile, report and evidence it.
Who does CASS 15 apply to?
CASS 15 applies to every firm that must safeguard relevant funds under the EMRs or the PSRs, and to small payment institutions that choose to.
| Firm type | In scope | Notes |
|---|---|---|
| Authorised payment institution | Yes | Except firms providing only payment initiation or account information services |
| Authorised e-money institution | Yes | Applies to e-money and to any unrelated payment services, as separate pools |
| Small e-money institution | Yes | Same rules as authorised e-money institutions |
| Credit union issuing e-money | Yes | Applies to the e-money it issues |
| Small payment institution | Optional | If it opts in, CASS 15 applies as if it were an authorised payment institution (CASS 15.1.7R) |
Scope is set by CASS 15.1.2R. A firm that provides both e-money and unrelated payment services calculates, reconciles and reports the two pools separately.
What must be safeguarded?
Relevant funds: money received for e-money issued, or received from or for a customer, or from another payment provider, to execute a payment transaction.
The definition, mixed remittances, card receipts and the money that falls outside scope are covered in our guide to relevant funds. Receipts that cannot yet be matched to a customer are still relevant funds and must be recorded as unallocated; see unallocated and unidentified receipts. Funds owed in one currency and held in another must be topped up daily under CASS 15.3.3R; see safeguarding in more than one currency.
How quickly must relevant funds be segregated?
Relevant funds must be kept apart from the firm's own money on receipt, and placed in a safeguarding account or approved assets by the end of the business day after receipt.
That deadline comes from EMRs regulation 21(2) and PSRs regulation 23(6). CASS 15 tests it every reconciliation day by comparing the D+1 segregation requirement with the D+1 segregation resource (CASS 15.8.35R). Our guide to D+1 segregation timing works through the calculation. Firms may instead protect funds with an insurance policy or comparable guarantee; see the insurance and guarantee method.
What does daily reconciliation involve?
On every reconciliation day the firm performs an internal reconciliation of what it owes against what it holds, and an external reconciliation of its records against bank and custodian statements.
A reconciliation day is a business day other than a weekend, Christmas Day, Good Friday or a UK bank holiday, and for a reconciliation involving a non-UK market, a day on which that market is closed. The internal reconciliation is set by CASS 15.8.10R and 15.8.19R and uses the firm's own records at a fixed reconciliation point each day. The external reconciliation under CASS 15.8.39R and 15.8.42R compares balances currency by currency. See CASS 15 reconciliation for the method.
Worked example: an e-money institution with two safeguarding banks and a reconciliation point of 17:00 UK time.
| Line | Amount (GBP) |
|---|---|
| Safeguarding requirement (client balances plus unallocated receipts) | 48,212,070.66 |
| Safeguarding account at Bank 1 | 30,105,220.40 |
| Safeguarding account at Bank 2 | 18,103,150.02 |
| Safeguarding resource | 48,208,370.42 |
| Difference | 3,700.24 shortfall |
The external reconciliation shows both bank statements agree with the firm's records, so the difference does not sit with the banks. The cause is a processor settlement of £3,700.24 that reached the operating account after the sweep. Under CASS 15.8.50R the shortfall must be paid in by the end of the day on which the reconciliation is performed. The firm transfers the amount, records the cause, owner and approval, and considers whether a notification is due. See shortfalls and excesses.
Can relevant funds be invested?
Yes, in secure, liquid assets the FCA has approved, held in a separate account with an authorised custodian.
CASS 15.4.2G approves assets in the UK CRR Article 114 categories with a specific risk capital charge of no higher than 0%, and units in a UCITS that invests solely in those assets. Investments must follow the principles on concentration, liquidity, credit risk and foreign exchange in CASS 15.4.6R, reviewed at least annually. See investing relevant funds in secure, liquid assets.
What is the monthly safeguarding return?
Every safeguarding institution must file a safeguarding return within 15 business days of the end of each calendar month.
The rule is SUP 16.14A.3R and the form is SUP 16 Annex 29BR, often called REP027. It has 17 sections: nine for e-money and related payment services and eight repeating them for unrelated payment services. Figures are taken from the last internal reconciliation of the month, and the FCA states that firms submit it via My FCA. Our section-by-section guide to the monthly safeguarding return includes a filled example, and REP027 automation covers producing it from reconciliation data.
What is the safeguarding resolution pack?
It is the set of documents an insolvency practitioner needs to return customer funds, and it must be retrievable within 48 hours.
CASS 10A.1.7R sets the 48-hour test and CASS 10A.1.11R requires a materially inaccurate document to be corrected within 5 business days. See the safeguarding resolution pack for the ten required documents and a retrieval drill.
Who needs a safeguarding audit?
Authorised payment institutions and e-money institutions need an annual reasonable assurance audit unless they have not been required to safeguard more than £100,000 at any time for a period of at least 53 weeks.
The exemption is in SUP 3A.1.1R(2). The auditor's report goes to the FCA within 4 months of the period end, or 6 months for the first report under the new rules (SUP 3A.9.7R and PS25/12). See the safeguarding audit exemption for how the threshold is measured and the CASS 15 safeguarding audit for what auditors test.
Who is responsible for safeguarding?
A single director or senior manager of sufficient skill and authority must be allocated oversight of operational compliance and must report to the governing body.
That is CASS 15.2.4R. Other duties sit with the governing body and senior management, including the annual CASS 10A report and the continuing decision on the audit exemption. See who is responsible for safeguarding.
When must the FCA be notified?
The firm must tell the FCA in writing without delay if any of the six circumstances in CASS 15.8.60R arise.
They cover inaccurate records, failed or missed internal and external reconciliations, a shortfall or excess that cannot be corrected, an unresolved discrepancy, and discovering that the amount safeguarded in the past 12 months was materially wrong (CASS 15.8.60R). See notifying the FCA of a safeguarding breach.
What happens to customer money if a firm fails?
Customer claims are paid from the asset pool of safeguarded funds ahead of other creditors, less the costs of distributing the pool.
That priority comes from EMRs regulation 24 and PSRs regulation 23(14) and (15). The special administration regime in the Payment and Electronic Money Institution Insolvency Regulations 2021 adds an objective to return relevant funds as soon as reasonably practicable. See what happens to customer money if a payment or e-money firm fails.
Is a statutory trust coming?
Not under the current rules: the Supplementary Regime in force since 7 May 2026 does not create a statutory trust.
CP24/20 proposed a later Post-Repeal Regime under which relevant funds would be held on statutory trust. The FCA has not implemented it and will review the Supplementary Regime after a full audit period, and any move depends on HM Treasury changing the underlying legislation. See safeguarding and the statutory trust.
What are the requirements in one table?
The table below maps each requirement to its rule, frequency and evidence.
| Requirement | Rule | How often | Evidence |
|---|---|---|---|
| Segregate relevant funds | EMRs reg 21, PSRs reg 23 | By the end of the business day after receipt | Safeguarding account statements and D+1 comparison |
| Allocate receipts to clients | CASS 15.2.5R | No later than the end of the business day after receipt | Allocation records and unallocated list |
| Internal safeguarding reconciliation | CASS 15.8.10R, 15.8.19R | At least once each reconciliation day | Requirement against resource at the reconciliation point |
| External safeguarding reconciliation | CASS 15.8.39R, 15.8.42R | At least once each reconciliation day | Records against bank and custodian statements, by currency |
| Correct shortfalls | CASS 15.8.50R, 15.8.51R | By the end of the reconciliation day | Transfer record with cause and approval |
| Review third parties | CASS 15.6.1R, 15.6.5R | Periodically | Due diligence and diversification records (CASS 15.6.7R) |
| Review acknowledgement letters | CASS 15.7.12R | At least annually | Countersigned letters and review record |
| Monthly safeguarding return | SUP 16.14A | Within 15 business days of month end | Return agreeing to the daily records |
| Resolution pack | CASS 10A | Retrieve within 48 hours; update within 5 business days | Indexed, current pack |
| Safeguarding audit | SUP 3A | Annually, unless exempt | Auditor's reasonable assurance report to the FCA |
What should a firm check first?
These are the points an auditor or supervisor can test from the records alone.
- Reconciliation days are counted correctly, including closures of the relevant foreign markets.
- E-money and unrelated payment services funds are calculated, reconciled and reported separately.
- Every account that can receive relevant funds is listed and reconciled, not only the safeguarding accounts.
- Every difference has a recorded cause, owner, approval and correction time.
- The monthly return agrees to the last internal reconciliation of the month.
- Third-party due diligence and acknowledgement letter reviews are dated and on file.
- The resolution pack has been retrieved in a timed drill.
Our CASS 15 questions answered page collects short answers to the questions firms ask most often, and the FCA safeguarding checklist sets out 25 points in more detail.
How does Safeheld support CASS 15?
Safeheld reconciles bank and ledger records for each entity and currency, raises and resolves breaks, and produces the monthly return, resolution pack and audit packs from the same records.
It also forecasts funding 24 hours and 7 days ahead and routes top-ups and withdrawals for approval. The firm reviews the return and files it with the FCA. See Safeheld reconciliation and our coverage of UK requirements.
Frequently asked questions
What is PS25/12?
PS25/12 is the FCA policy statement that introduced the Supplementary Regime for safeguarding by payment and e-money firms. It made rules in CASS 15, CASS 10A, SUP 3A and SUP 16.14A.
When did CASS 15 take effect?
On 7 May 2026, after a nine-month implementation period.
How often must safeguarding reconciliations be performed?
Internal and external safeguarding reconciliations must each be performed at least once every reconciliation day.
What is REP027?
REP027 is the common name for the monthly safeguarding return in SUP 16 Annex 29BR. It is due within 15 business days of each month end.
Which firms need a safeguarding audit?
Authorised payment institutions and e-money institutions, unless they have not been required to safeguard more than £100,000 at any time for a period of at least 53 weeks.
Does PS25/12 introduce a statutory trust?
No. A statutory trust was proposed for a later Post-Repeal Regime, which the FCA has not implemented.
Do small payment institutions have to comply?
Only if they opt in to safeguarding. Once they do, CASS 15 applies as if they were an authorised payment institution.
References
- FCA, PS25/12: Changes to the safeguarding regime for payments and e-money firms
- FCA, Policy Statement PS25/12 (full text)
- FCA Handbook, CASS 15 Payment services and electronic money: safeguarding
- FCA Handbook, CASS 15.8 Records, accounts and reconciliations
- FCA Handbook, CASS 10A Resolution pack
- FCA Handbook, SUP 3A.1 Application
- FCA Handbook, SUP 16.14A Safeguarding return
- FCA, Safeguarding requirements for payment institutions and e-money institutions
- The Electronic Money Regulations 2011, regulation 21
- The Payment Services Regulations 2017, regulation 23
About Safeheld
Safeheld is reconciliation and regulatory financial control software for regulated firms that hold client money. For UK payment and e-money firms it runs daily safeguarding reconciliation and break resolution, and produces the monthly safeguarding return, resolution pack and audit evidence under CASS 15. To discuss your safeguarding operations, contact us at safeheld.com/contact.
This article is general information on the UK safeguarding rules and is not legal or regulatory advice.