Safeguarding rules for payments firms: what to do if you’re not ready yet
The new safeguarding regime for UK payments and e-money firms came into effect in May 2026.
This marked the end of a long consultation process, culminating in a major shift in regulatory requirements for the payments sector – so if your firm is still adjusting, don’t be embarrassed about seeking guidance.
The background
The new Interim Rules around safeguarding client money, also known as the Supplementary Regime, were published by the Financial Conduct Authority (FCA) in August 2025.
They consist of key additions to the FCA’s CASS (Client Assets Sourcebook): CASS 15 and CASS 10A, as well as new rules and guidance set out in the FCA’s supervision manual (SUP).
This followed a two-year consultation period with particularly high levels of industry engagement and speculation about the shape the new rules would ultimately take. This means that many firms could be forgiven for feeling a sense of safeguarding fatigue by the time the Interim Rules were finally announced.
Coupled with that, firms were given just nine months to comply before the new rules came into effect on 7 May 2026. If you have felt overwhelmed by these changes to the safeguarding requirements, this may have led to you still being behind on your preparations for the new Interim Rules.
If you recognise that you’re in this position, now is the time to seek specialist advice.
Safeguarding audits
One important area of change relates the safeguarding audit obligations. In a move designed to improve the integrity and credibility of the overall safeguarding audit process, more firms are now required to have audits of their safeguarding arrangements, and those audits can now be performed only by statutory auditors.
Even if your firm was previously confident under the legacy rules, you may now feel exposed to a level of scrutiny you are neither used to nor comfortable with.
Perhaps this has translated into a sense of embarrassment about your current state of readiness, causing you to delay engaging with or appointing an auditor.
An opportunity to seek support
There’s no need to be embarrassed about recognising that there may still be work to do.
The new safeguarding rules are a big ask for the payments sector. Even the Financial Reporting Council (FRC) acknowledge in their guidance that ‘the transition to the Supplementary Regime may present complexity for firms [which] stems from overlapping legacy rules and new expectations from regulators and stakeholders.’
Put another way: if you’re finding this difficult, you’re certainly not alone.
The good news is that you don’t need to face this challenge on your own. Instead of shying away from the safeguarding audit process, this is a perfect opportunity to seek expert support with identifying and addressing any gaps or weaknesses in your safeguarding systems and controls.
How BKL can help
Our specialists in financial services regulations combine the very best safeguarding audit experience and specialist safeguarding advisory expertise.
This dual capability means your safeguarding audit becomes a truly value adding exercise that provides clarity, insight and a practical roadmap for achieving and maintaining the highest levels of compliance with the new rules.
We can also support you with navigating safeguarding audits conducted by other providers. From performing pre-audit gap analysis and targeted remediation exercises to preparing your audit pack and helping you engage constructively with your auditor, we can help make the audit process more efficient and more effective for all parties.
Safeguarding under the supplementary regime is demanding, but it needn’t be a source of embarrassment. With the right support, you will benefit from stronger governance, better controls and greater confidence in your regulatory compliance.
For a chat about how we can help you, get in touch with Ben using the form below.
You can also find a range of insights, videos and practical tips on our CASS 15 hub.
Contact Ben
Frequently asked questions: FCA rules for safeguarding client money
What is the FCA safeguarding supplementary regime for payment and e-money firms?
The safeguarding supplementary regime is the FCA’s enhanced framework for protecting customer funds held by payment institutions and e-money firms. It came into force on 7 May 2026 and introduces more detailed requirements around safeguarding systems, controls, record-keeping, reconciliations, governance, and assurance activities. Its aim is to improve customer protection and increase regulatory confidence in how firms safeguard client money.
Does every payment or e-money firm need a safeguarding audit?
No. Audit requirements depend on the firm’s permissions, activities and safeguarding arrangements. However, the new regime has expanded the number of firms that require safeguarding audits, meaning some organisations that were not previously subject to audit requirements may now need independent assurance over their safeguarding compliance.
Firms should review the FCA rules carefully and seek professional advice if they are unsure whether the audit requirements apply to them.
Why are safeguarding audits becoming more rigorous?
Safeguarding audits are becoming more rigorous because regulators want stronger assurance that customer funds are properly protected. Under the supplementary regime, safeguarding audits can only be performed by statutory auditors, which increases the level of scrutiny and consistency applied to firms’ safeguarding arrangements.
The change is designed to strengthen confidence in the sector and improve the quality and credibility of safeguarding assurance.
What should a firm do if it is not fully prepared for the new safeguarding requirements?
The best approach is to seek expert help with assessing the gaps and starting to address them as early as possible. Many firms are still adapting to the new regime, particularly where legacy safeguarding processes do not fully align with current expectations.
A structured gap analysis can help identify weaknesses in governance, documentation, reconciliations, controls, and reporting processes. Early engagement often reduces compliance risks and makes future audits more efficient.
What happens if weaknesses are identified during a safeguarding audit?
Finding weaknesses during an audit does not automatically mean a firm has failed. Audits are designed to identify areas where controls, processes or documentation may need improvement.
In practice, the most valuable outcome is often a clear understanding of where remediation is needed. Firms that address issues promptly are generally better positioned to strengthen compliance, improve resilience and demonstrate good governance to regulators and stakeholders.
Is safeguarding just about protecting customer money?
No. While protecting relevant customer funds is the core objective, effective safeguarding also involves governance, oversight, record-keeping, reconciliations, risk management and internal controls.
The supplementary regime reflects the FCA’s expectation that safeguarding should be embedded into a firm’s overall control environment rather than treated as a standalone compliance exercise. Strong safeguarding arrangements can also support customer trust and operational resilience.
How long does it typically take to prepare for a safeguarding audit?
Preparation time varies depending on the complexity of the business and the maturity of its safeguarding framework. Firms with well-established controls may only need targeted improvements, while others may require more substantial remediation work.
Starting preparations well before an audit allows time to resolve issues, gather evidence, update policies and ensure key personnel understand their responsibilities under the new regime.
Are smaller payment firms affected by the safeguarding changes?
Potentially, yes. The supplementary regime is not solely a concern for larger payments firms. Smaller and growing firms may face significant operational and governance changes, particularly if their safeguarding arrangements were built around previous requirements.
Smaller firms often benefit from reviewing whether their systems, documentation and management oversight remain appropriate as regulatory expectations evolve.
What is a safeguarding gap analysis and why is it useful?
A safeguarding gap analysis is a structured review that compares a firm’s existing arrangements against current regulatory requirements and expectations.
It helps identify areas where policies, controls, reconciliations, governance structures or evidence may be insufficient. Conducting a gap analysis before an audit can reduce surprises, prioritise remediation efforts and help firms demonstrate a proactive approach to compliance.
Is it a misconception that firms should wait until they are fully ready before engaging an auditor?
Yes. Many firms assume they should only engage an auditor once everything is perfect, but delaying engagement can create additional risk and reduce the time available to address issues.
Early discussions with auditors and advisers often help firms understand expectations, prioritise improvements and plan more effectively. Given the scale of the safeguarding changes introduced under the supplementary regime, recognising that further work may be required is not unusual and should not be a barrier to seeking support.
How can firms strengthen their safeguarding compliance on an ongoing basis?
Effective safeguarding is an ongoing process rather than a one-off project. Firms should regularly review their safeguarding framework, including maintaining up-to-date documentation, testing systems and controls, monitor regulatory developments and ensuring senior management remains engaged in oversight.
Regular independent reviews, remediation exercises and training can help organisations maintain compliance and adapt as FCA expectations continue to evolve.
