Key takeaways
- A safeguarding policy sets out how a payment or e-money firm identifies, segregates, reconciles and protects customer funds.
- Under CASS 15, the policy must describe how the firm actually operates, because auditors test practice against it.
- The template below lists the sections a complete policy contains and what each must cover.
- The policy should be owned by a named senior manager, approved by the board and reviewed at least annually and after any material change.
What the policy is for
A safeguarding policy is the document that explains how a UK payment institution or e-money institution protects its customers' money. It is read by three audiences: the staff who run safeguarding each day, the auditor who tests it each year under SUP 3A, and the FCA when it reviews the firm. Since PS25/12 came into force on 7 May 2026, the expectations behind it are more specific, and a policy that describes an ideal rather than actual practice is a finding in its own right.
The template below sets out the sections a complete policy contains. Each section should be written for the firm's own business model, its banks, its products and its systems. A policy copied from another firm will not survive an audit.
The template
Use the following structure. Each row lists a section and what it must cover. Write each section in plain language that a new member of the finance or operations team could follow on their first day, and refer to the actual systems, reports and accounts the firm uses rather than generic descriptions.
Where the firm runs both e-money and unrelated payment services, the policy should treat the two pools separately in every section that involves a calculation, a reconciliation or a report. Where the firm uses agents or distributors, it should state how funds they receive are brought into safeguarding and how quickly.
| Section | What it must cover |
|---|---|
| 1. Scope and ownership | Which entities, products and funds are covered; the senior manager responsible; board approval date |
| 2. Relevant funds | How the firm identifies relevant funds for each product, when the safeguarding obligation starts and ends |
| 3. Safeguarding method | Segregation, insurance or guarantee, or both; which funds use which method |
| 4. Accounts and institutions | Every safeguarding account and institution; designation; acknowledgement letters |
| 5. Receipt and segregation | How funds are received; how any funds received outside safeguarding accounts are moved by the end of the next business day |
| 6. Reconciliation | Reconciliation days, the reconciliation point, internal and external reconciliations, calculation method for each pool |
| 7. Shortfalls and excesses | How differences are investigated, funded or withdrawn the same day, approved and recorded |
| 8. Third-party due diligence | How safeguarding institutions are selected and reviewed at least annually; diversification |
| 9. Reporting and notification | Monthly safeguarding return; when and how the FCA is notified |
| 10. Resolution pack | Contents, owner, location, and how it is kept current and retrievable within 48 hours |
| 11. Governance and training | Management information to the board; training; record keeping |
| 12. Review | Annual review and review after material change; version history |
The sections that most often fail
Three sections cause most problems at audit. The first is relevant funds. Policies often state that the firm safeguards customer funds without defining, product by product, when a receipt becomes relevant funds and when the obligation ends. For card programmes, prepaid products and payouts, these points are not obvious and must be written down.
The second is reconciliation. The policy must state the reconciliation point, the source of every figure, the calculation method for each pool of funds, and how foreign market closures affect reconciliation days. Our guide to CASS 15 reconciliation covers each element.
The third is shortfalls. The policy must say who can approve a top-up or withdrawal, how quickly, from which account, and how the record is kept. Our guide to safeguarding shortfalls and excesses sets out the same-day deadline.
Ownership and review
The policy should name the senior manager accountable for safeguarding, be approved by the board, and be reviewed at least annually and whenever the business changes materially, for example when the firm adds a product, a bank, a currency or a new processor. Each review should leave a dated record of what changed and why.
A policy is only as good as the evidence that the firm follows it. Safeheld records each reconciliation, difference, approval and correction against the steps the policy sets out, so the firm can show the auditor that practice matches the document. See evidence packs and Safeheld reconciliation.
Frequently asked questions
What should a safeguarding policy include?
Scope and ownership, relevant funds, safeguarding method, accounts, segregation, reconciliation, shortfall handling, due diligence, reporting, resolution pack, governance and review.
Who should own the safeguarding policy?
A named senior manager, with board approval.
How often should a safeguarding policy be reviewed?
At least annually and after any material change to the business.
Can a firm use another firm's safeguarding policy?
Not effectively. The policy must describe the firm's own products, banks, systems and processes, because auditors test practice against it.
References
- FCA, PS25/12: Changes to the safeguarding regime for payments and e-money firms
- FCA Handbook, CASS 15.8 Records, accounts and reconciliations
- The Electronic Money Regulations 2011
- The Payment Services Regulations 2017
About Safeheld
Safeheld reconciles client money every day, resolves every difference and prepares every regulatory return for sign-off, for regulated firms in the United States, the United Kingdom, the European Union, Canada, Australia, Singapore and Hong Kong. To discuss your operations, contact us at safeheld.com/contact.
This article is for general information and does not constitute legal or regulatory advice.