PS25/12 Safeguarding Reconciliation Platform: What It Must Do

What PS25/12 changed, in operational terms

PS25/12 moved FCA safeguarding from a principles-led expectation to a prescribed operating discipline. The underlying purpose is unchanged: relevant funds must be identifiable and returnable if the firm fails. What changed is the evidential standard applied to the firm's demonstration that this is true on any given day.

The practical consequences are four. Reconciliation became a daily discipline rather than a periodic exercise. Records and accounts became subject to a defined standard rather than a general adequacy test. A monthly regulatory return introduced a recurring, dated submission obligation. And the annual safeguarding audit introduced an independent examination performed against a specified standard.

Each of those individually is manageable. Together they change the shape of the problem. A firm now needs a system of record for safeguarding, not a set of processes that produce a conclusion each month.

Internal and external reconciliation are two obligations, not one

The internal reconciliation compares the firm's record of relevant funds received from, or held for, each customer against the total the firm believes it is safeguarding. It answers the question: does our own arithmetic hold together?

The external reconciliation compares that internal position against the balances independently confirmed by every safeguarding institution and every third party holding relevant funds. It answers a different question: does the outside world agree with us?

Firms that collapse the two into a single match run against a bank statement lose the ability to distinguish an internal ledger error from an external timing difference or a missing third-party balance. That distinction determines whether a variance is a bookkeeping matter or a shortfall requiring immediate correction from the firm's own funds, so it cannot be inferred after the fact.

A platform built for PS25/12 executes both, records both, and seals both, so that the audit can test each on its own terms.

Shortfalls, excesses, and the evidence of correction

Where the reconciliation shows less in safeguarding than the firm owes to customers, the firm must pay the difference in from its own resources immediately. Where it shows more, the excess must be withdrawn so that firm money is not commingled with relevant funds.

The obligation is continuous and the evidential expectation is symmetrical. Identification, decision, transfer, and confirmation each need to exist as a dated, attributable record. In manual environments the identification is usually captured in the workbook and the remediation is captured in an email chain, which means the two cannot be joined without human recollection.

A platform treats correction as a first-class workflow attached to the reconciliation run that produced the variance. The run, the break, the explanation, the funding decision, the settlement, and the reviewer are one object. That object is what an auditor tests, and it either exists or it does not.

Monthly returns and the live resolution pack

The monthly safeguarding return is straightforward to complete and easy to get wrong, because the figures must be consistent with the daily reconciliations that preceded them. A return assembled independently from a finance extract will diverge from the reconciliation record, and that divergence is visible to the regulator across submissions.

Generating the return from the sealed reconciliation runs removes the divergence entirely. The return is a view of data that already exists rather than a separate reporting exercise, and every figure in it can be traced to the run that produced it.

The resolution pack carries a different risk. It is required to be current, and it degrades quietly. Banking arrangements change, agents are added, distributors are removed, and the pack on the shared drive continues to describe the arrangements as they were. Generating the pack continuously from live account and counterparty data eliminates drift, because there is no static document to fall out of date.

The annual safeguarding audit, and what auditors actually ask for

Auditors sample. They select dates, ask what the safeguarding position was, ask for the reconciliation that established it, ask who reviewed it, and ask what happened to every variance it raised. They then test whether the record they are given could have been amended after the event.

That last test is where most firms are weakest. A spreadsheet, a PDF, and a database row are all editable. Their existence proves that a record exists now, not that it existed then and has not changed.

Cryptographic sealing resolves this. When a run is hashed and the hash is committed at the time of the run, any later amendment breaks verification. The firm is no longer asking the auditor to trust the record. It is giving the auditor the means to test it.

Safeheld as a PS25/12 operating layer

Safeheld runs internal and external reconciliation continuously across every safeguarding account, acquirer, agent, distributor, and ledger in scope, investigates each break autonomously, and routes only genuinely ambiguous items for human judgement.

Every run is sealed with a SHA-256 Merkle root and can be verified independently by an auditor or the regulator without access to the firm's tenant. Corrections are recorded against the run that identified them. The monthly return, the resolution pack, the board reporting, and the audit evidence set are all generated from those same sealed runs.

The result is a single, date-addressable safeguarding record. Ask what the position was on any historic day and the answer is one query, not one week of reconstruction.

Frequently asked questions

Who does PS25/12 apply to?

Payment institutions, electronic money institutions, and UK credit unions that issue electronic money, where the firm holds relevant funds in the course of providing payment services or issuing e-money.

How quickly must a safeguarding shortfall be corrected?

Immediately. Where a reconciliation identifies a shortfall, the firm must pay the difference into the safeguarding account from its own resources without delay, and must be able to evidence both the identification and the correction.

Can one platform cover PS25/12 and EMR 2011 together?

Yes. The reconciliation, records, and resolution obligations overlap substantially, and running them from one engine avoids the reconciliation of reconciliations that arises when each regime has its own system.