Key takeaways
- SUP 3A requires authorised payment institutions (other than payment initiation or account information only firms) and e-money institutions to have an annual safeguarding audit.
- A firm is exempt if it has not been required to safeguard more than £100,000 of relevant funds at any time for a period of at least 53 weeks (SUP 3A.1.1R(2)).
- The test turns on the highest safeguarding requirement over the period, not the average, the month-end figure or the balance held.
- Senior management must decide on a continuing basis whether the exemption applies and appoint an auditor as soon as it does not (SUP 3A.1.4G).
- The auditor's reasonable assurance report goes to the FCA within 4 months of the period end, or 6 months for the first report under the new rules.
What are the key facts on the audit exemption?
Most payment and e-money institutions need an annual safeguarding audit, and only firms below a £100,000 peak over at least 53 weeks are exempt.
| Item | Position |
|---|---|
| Rule | SUP 3A.1.1R; audit and report under SUP 3A.9 |
| Regulator | Financial Conduct Authority |
| Applies to | Authorised payment institutions (other than payment initiation or account information only) and e-money institutions |
| Exemption | Not required to safeguard more than £100,000 at any time for a period of at least 53 weeks |
| Deadlines | Audit period of no more than 53 weeks; report within 4 months, or 6 months for the first report |
| Last checked | 11 October 2026, against the FCA Handbook and PS25/12 |
Which firms must have a safeguarding audit?
Authorised payment institutions and e-money institutions, called relevant institutions in SUP 3A, must have one unless they are exempt.
SUP 3A.1.1R(1)(a) defines relevant institutions as authorised payment institutions authorised for services other than payment initiation or account information, and electronic money institutions. Small e-money institutions fall within the e-money institution definition, so they need an audit unless they meet the exemption. SUP 3A.1.2G confirms the chapter applies whether funds are protected by segregation, insurance or guarantee, or a mix.
| Firm type | Annual safeguarding audit? |
|---|---|
| Authorised payment institution | Yes, unless exempt |
| Payment initiation or account information only | No, not in scope |
| Authorised e-money institution | Yes, unless exempt |
| Small e-money institution | Yes, unless exempt |
| Small payment institution that opts in to safeguarding | Not listed as a relevant institution; may arrange a voluntary audit |
| Credit union issuing e-money | Not listed as a relevant institution; may arrange a voluntary audit |
Firms outside the definition still have to keep adequate safeguarding arrangements under CASS 15.2.1R, and SUP 3A.1.3G notes that voluntarily arranging an audit under the chapter may help them show this. For the opt-in decision itself, see small payment institution safeguarding.
How does the £100,000 exemption work?
A firm is exempt only if, across a period of at least 53 weeks, its safeguarding requirement never exceeded £100,000.
The wording of SUP 3A.1.1R(2) is that the institution "has not been required to safeguard more than £100,000 of relevant funds" under the relevant funds regime "at any time for a period of at least 53 weeks". Three consequences follow. The measure is what the firm was required to safeguard, which is its safeguarding requirement, not the balance in its safeguarding accounts. The test is a peak, so a single day above £100,000 within the period removes the exemption. And the period must be at least 53 weeks, slightly longer than a year, so a firm needs a full daily history to rely on it.
Some summaries describe the exemption as applying to firms that hold less than £100,000. That shorthand can mislead: a firm whose requirement is £60,000 today but reached £140,000 on one day in the last 53 weeks is not exempt.
The monthly return asks the question directly. Question 2 of the monthly safeguarding return asks whether the firm was a relevant institution, with the options Yes, No (not in scope) and No (exempt), and question 3 asks whether a firm that is not will arrange a voluntary audit.
How is the exemption tested in practice?
The test is run on the daily safeguarding requirement series for the 53 weeks under review.
Worked example. Two small e-money institutions review the 53 weeks to 30 September 2026.
| Measure | Firm A (GBP) | Firm B (GBP) |
|---|---|---|
| Average daily safeguarding requirement | 71,400 | 62,900 |
| Requirement at 30 September 2026 | 84,250 | 58,300 |
| Highest daily requirement in the 53 weeks | 96,500 | 118,200 |
| Days above £100,000 | 0 | 1 (a payroll top-up on 27 March 2026) |
| Exempt under SUP 3A.1.1R(2)? | Yes | No |
Firm B's average and month-end figures are lower than Firm A's, yet Firm B is not exempt, because on one day its requirement exceeded £100,000. Firm A records the review, the data used and the approval, and repeats it each month. Firm B appoints a safeguarding auditor and changes its answer to question 2 of the monthly return to Yes. The one-day spike came from a corporate client funding a payroll run a day early. Firm B could not have avoided the result by moving the money out quickly afterwards, because the test asks what the firm was required to safeguard at any time, and on that day it was required to safeguard £118,200. A firm that expects occasional large receipts should plan on the basis that it will need an audit.
Does the exemption change any other safeguarding duty?
No: an exempt firm is relieved only of the annual audit, and every other CASS 15 obligation continues in full.
An exempt firm still reconciles internally and externally on every reconciliation day under CASS 15.8, still files the monthly return under SUP 16.14A, still keeps a resolution pack under CASS 10A and still notifies the FCA of the circumstances in CASS 15.8.60R. Because no auditor reviews its arrangements each year, the firm's own records carry more weight if the FCA asks how it complies. Small firms often find that a light internal review, documented each quarter, fills the gap the audit would otherwise cover.
How should the exemption decision be documented?
As a dated senior management decision supported by the daily requirement data for the period relied on.
A good record states the period tested, its start and end dates, the highest daily safeguarding requirement in that period with the date it occurred, the source of the data, and the conclusion. It names the person who approved it and the date of the next review. Where the firm safeguards both e-money and unrelated payment services funds, the record should show how both pools were taken into account. Keeping the decision with the monthly return working papers means the answer to question 2 can always be traced to evidence.
What happens when a firm loses the exemption?
Senior management must appoint a qualified auditor and notify the FCA of the appointment.
SUP 3A.1.4G requires senior management to determine, on a continuing basis, whether the firm is exempt, and to appoint an auditor if it is not. SUP 3A.3.2R requires the firm to notify the FCA of the appointment, including the auditor's name, business address and effective date, and to notify any vacancy without delay. If a firm fails to appoint within 28 days, the FCA may appoint an auditor itself (SUP 3A.3.4R).
Before appointing, the firm must take reasonable steps to confirm the auditor has the skill, resources and experience required and is eligible under Part 42 of the Companies Act 2006 (SUP 3A.4.2R). The audit period must end no more than 53 weeks after the firm became subject to the chapter, including after ceasing to be exempt, or after the end of the previous period (SUP 3A.9.6R).
What does the safeguarding audit involve?
It is a reasonable assurance engagement that reports to the FCA on the adequacy of systems through the period and compliance at the period end.
SUP 3A.9.1R and 3A.9.2R set the two opinions, and SUP 3A Annex 1 sets the report form, including a schedule of breaches identified (SUP 3A.9.12R). The report must reach the FCA within 4 months of the end of the period (SUP 3A.9.7R); PS25/12 extended the first report under the new rules to 6 months. The auditor gives the firm a draft so it can explain the circumstances of breaches and any remedial action (SUP 3A.10.1G), and the firm must report the final report to its governing body (SUP 3A.10.2R).
The Financial Reporting Council published interim guidance on safeguarding assurance engagements in March 2026 for use until it issues a final standard, which it expects in 2027. Under SUP 3A.9.4G the FCA expects auditors to consider relevant FRC material. Exempt firms do not file any limited assurance report instead; that option was dropped from the final rules. Our guide to the CASS 15 safeguarding audit covers what auditors test.
| Milestone | Timing | Rule |
|---|---|---|
| Supplementary Regime in force | 7 May 2026 | PS25/12 |
| Exemption reviewed | Continuously | SUP 3A.1.4G |
| Auditor appointed after exemption ends | Promptly; FCA may appoint after 28 days | SUP 3A.1.4G, SUP 3A.3.4R |
| Audit period ends | No more than 53 weeks after the start trigger | SUP 3A.9.6R |
| First report to the FCA | Within 6 months of the period end | PS25/12 |
| Later reports | Within 4 months of the period end | SUP 3A.9.7R |
What should a firm check?
These steps make the exemption decision defensible to the FCA and to a future auditor.
- Keep the daily safeguarding requirement for every day, not only month ends.
- Run the peak test over a rolling period of at least 53 weeks and keep the workings.
- Record the senior management decision, the date and the person who approved it.
- Set an internal trigger well below £100,000, so the firm can prepare before the threshold is crossed.
- Answer question 2 of the monthly return consistently with the recorded decision.
- Identify an eligible auditor in advance, so an appointment can be made quickly.
- Diary the audit period end and the 4 or 6 month report deadline once an auditor is appointed.
How does Safeheld help?
Safeheld keeps the daily safeguarding requirement for each pool, so the exemption test is a report rather than a reconstruction.
Audit packs draw on the same reconciliation and break records the auditor will sample. See audit evidence, who is responsible for safeguarding and our CASS 15 and PS25/12 guide.
Frequently asked questions
What is the safeguarding audit exemption?
A firm is exempt from the SUP 3A audit if it has not been required to safeguard more than £100,000 of relevant funds at any time for a period of at least 53 weeks.
Is the £100,000 test based on the average balance?
No. It is a peak test on the safeguarding requirement. One day above £100,000 within the period removes the exemption.
Do small e-money institutions need a safeguarding audit?
Yes, unless they meet the exemption. Small e-money institutions are e-money institutions for the purposes of SUP 3A.1.1R.
Do small payment institutions that opt in need an audit?
They are not listed as relevant institutions in SUP 3A.1.1R, but SUP 3A.1.3G notes that a voluntary audit may help them show their arrangements are adequate.
Who decides whether the exemption applies?
Senior management, on a continuing basis, under SUP 3A.1.4G. If the firm is no longer exempt, it must appoint an auditor.
When is the safeguarding audit report due?
Within 4 months of the end of the audit period, or within 6 months for the first report under the new rules.
Who can carry out a safeguarding audit?
An auditor eligible under Part 42 of the Companies Act 2006, whom the firm has taken reasonable steps to confirm has the skill, resources and experience required (SUP 3A.4.2R), and who is not disqualified (SUP 3A.4.4R).
References
- FCA Handbook, SUP 3A.1 Application
- FCA Handbook, SUP 3A.3 Appointment of auditors
- FCA Handbook, SUP 3A.4 Auditors' qualifications
- FCA Handbook, SUP 3A.9 Duties of auditors: safeguarding report
- FCA Handbook, SUP 3A.10 Review of auditor's safeguarding report
- FCA, PS25/12: Changes to the safeguarding regime for payments and e-money firms (PDF)
- FCA, Safeguarding requirements for payment institutions and e-money institutions
About Safeheld
Safeheld is reconciliation and regulatory financial control software for regulated firms that hold client money. It records the daily safeguarding requirement for each pool and produces audit packs from the same reconciliation and break records that a safeguarding auditor tests. To discuss your safeguarding operations, contact us at safeheld.com/contact.
This article is general information on the UK safeguarding rules and is not legal or regulatory advice.