New payments safeguarding rules: more stringent obligations, but no statutory trust yet

Following consultation, the Financial Conduct Authority (FCA) has published the hotly anticipated changes to its safeguarding rules for payments firms. But the changes are far from the wholesale shift towards an investment business-type protection model that the FCA originally proposed. In short: there are new requirements in respect of record keeping, monitoring and reporting, and methods of safeguarding, but the FCA will not take forward proposals for a statutory trust over relevant funds at this stage.

The reforms nevertheless constitute a considerable tightening of the safeguarding landscape for payment firms, and brings parts of the framework in line with the client assets (CASS) regime used elsewhere in the regulated financial sector.

The new rules – which the FCA previously called the "interim rules" in anticipation of the greater shift to the "final rules" as a next step, but now calls the "Supplementary Regime" – take effect from 7 May 2026, giving firms nine months to implement appropriate frameworks.

In this article we consider why reform was needed, the impact of the changes on relevant firms and their stakeholders in the event of insolvency, and proposals the FCA has put on pause.

What is the safeguarding regime?

Under the Payment Services Regulations 2017 (PSRs) and the E-Money Regulations 2011 (EMRs), payments and e-money institutions and credit unions that issue e-money are required to protect funds received in connection with making a payment, or in exchange for e-money issued. They must do so immediately on receiving the funds.

The purpose of the safeguarding regime is well known and understood: ensuring there is a pool of funds available to protect customers if a firm fails so that they receive the maximum value of their funds as soon as possible. Unlike other parts of the financial services industry, there is no recourse to the Financial Services Compensation Scheme (FSCS) under the payment services and e-money regime.

Why was reform needed?

The FCA has long been concerned about standards of compliance with the rules under the PSRs and EMRs, despite having issued guidance in its Approach Document. Statistics from Companies House suggest there has been an average shortfall in funds of 65% at firms who became insolvent between Q1 2018 and Q2 2023. These figures sit against a background of a five-fold increase in the use of current accounts with e-money institutions between 2017 and 2022, as reported by the FCA's Financial Lives survey, and an estimated £5bn in relevant funds being held by relevant firms on any given day in 2023.

The FCA has noted a marked increase of firms with safeguarding issues, and in 2023, opened supervisory cases relating to around 15% of the total number of firms that safeguard. Its March 2023 portfolio letter identified a number of weaknesses in compliance, including:

• Lack of documented processes for consistently identifying which funds are 'relevant funds' are therefore must be safeguarded
• Inadequate reconciliation procedures to ensure that the correct amounts are protected on a continuous basis
• Lack of due diligence and acknowledgment of segregation from credit institutions providing safeguarding accounts.

If a large payments firm with poor safeguarding practices failed, consumer harm would be particularly severe. Such an event would likely involve significant costs of distribution on top of any shortfalls in safeguarded funds. IPs would need to spend time conducting a reconciliation exercise in order to return funds to consumers, the associated costs ultimately reducing the amount of funds available for consumers. The failure could cause wider harm to the market if the firm held funds on behalf of other regulated firms, which in turn could see those firms fail. The FCA noted particular concerns about harm to vulnerable consumers, with an estimated 40% of e-money account holders having at least one vulnerability characteristic.

Among other concerns, the FCA's consultation highlighted the legal uncertainty generated by the judgment in Re Ipagoo LLP [2022] EWCA Civ 302, where the Court of Appeal took a novel approach in ruling that EMRs do not create a statutory trust over funds received from e-money holders. The judgment also ruled that in a case of a shortfall in the insolvent E-Money Institution (EMI)'s safeguarded asset pool, the pool should be topped-up, but left questions as to how the top-up exercise should rank against other creditor claims.

The FCA's consultation covered rules and guidance for a new safeguarding regime, the ultimate proposal having been to replace the requirements as set out in the PSRs and EMRs with a CASS-style regime requiring relevant funds and assets to be held on trust.

Even though the FCA has now stepped back from the original "end state" proposed, the majority of the new rules are still contained in a new Chapter 15 of CASS, although there are also new rules added to the Supervision Manual (SUP).

What does the Supplementary Regime change?

The Supplementary Regime rules are to be implemented substantively as proposed - they were designed to strengthen the safeguarding regime while the transition to the Post-Repeal Regime took place, but will now constitute the safeguarding regime for the foreseeable future.

Although not as radical as the original proposals for the statutory trust, the Supplementary Regime contains several new obligations that firms must plan to be compliant with by May 2026, including:

Improved books and records

The FCA's changes to the record-keeping and reconciliation requirements largely codify and build upon existing guidance its Approach Document, and share many of the features of the existing requirements for investment firms in CASS 7.

Firms must now:

• Maintain adequate policies and procedures to help ensure compliance with safeguarding requirements
• Maintain accurate records and accounts to enable it – at any time and without delay – to distinguish between relevant funds and other funds
• Perform funds reconciliations at least once each reconciliation day
• Determine the reason for, and promptly resolve, any discrepancy identified by its reconciliations
• Inform the FCA in writing and without delay if:
  • Their internal records are materially out of date, inaccurate or invalid
  • They will be unable to perform a reconciliation or remedy, and/or
  • At any time in the previous year there was a material difference between the amount of relevant funds safeguarded and the amount they should have been safeguarding.
• Maintain a resolution pack to ensure they can retrieve – as soon as practicable, and in any event within 48 hours of a request – information that would, among other things, help an IP achieve a timely return of relevant funds to consumers and help the FCA in the event of insolvency.

Enhanced monitoring and reporting – the independent audit

The FCA has now codified the requirement for a safeguarding audit, and extended it to all payments firms other than payment initiation service providers, small payment institutions (SPIs) and credit unions that issue e-money.

To address concerns about proportionality, for small payments firms, the FCA has introduced an exemption from the audit requirement for those firms safeguarding small amounts of relevant funds, namely if they have not been required to safeguard more than £100,000 of relevant funds at any time for at least 53 weeks. It also will not take forward proposals to apply the audit requirement as guidance to payment initiation service providers, SPIs and credit unions that issue e-money. Instead, there will be guidance that voluntarily arranging an audit may help ensure those firms meet their obligations to maintain adequate safeguarding arrangements.

Firms to whom the requirement does apply must:

• Appoint an independent, qualified auditor to carry out the safeguarding audit, and take reasonable steps to ensure they have the required skills, resources and experience
  • If a firm fails to appoint an auditor within 28 days of being required to do so, the FCA can appoint in its place
• Co-operate with the auditor in the discharge of their duties, the auditor themselves being subject to a duty to co-operate with the regulator in discharging its functions under the PSRs and EMRs
• Submit a prescribed-format annual audit report confirming compliance with safeguarding requirements, details of any breaches and any remedial actions taken.

Firms – including smaller payments firms - must also submit a new monthly regulatory return covering comprehensive information on safeguarded funds and arrangements, and allocate oversight of compliance with the safeguarding requirements to an individual in the firm.

Out of concerns over auditor capacity, the FCA has extended the deadline for the first audit to six (rather than four) months after the end of the firm's audit period. Subsequent audit will be required within four months.

Strengthening elements of safeguarding practices

Firms can safeguard relevant funds by either segregating them or protecting them through an insurance policy or comparable guarantee.

On safeguarding via insurance policies or comparable guarantees, the FCA has replaced existing guidance with more detailed requirements, including that other than there being an insolvency event, there must be no further condition or restriction on the prompt paying out of the insurance or guarantee. It will also require that no less than three months before their policy or guarantee expires, the firm must:

• Decide whether it intends to continue using the insurance or guarantee method and notify the FCA of this intention
• If it does not have a replacement or renewal in place, submit a plan to the FCA outlining how it will move to the segregation method should one not be secured
• If it cannot safeguard all relevant funds through segregation, consider its financial position, including whether it is appropriate to enter into a process under the Payments and Electronic Money Special Administration Regime (PESAR) or Insolvency Act 1986 (IA86) so a claim can be made before the cover lapses.

It is notable that the FCA has not changed the types of secure, liquid assets that firms are able to invest in, which it feels strikes the right balance between appropriate investment capabilities and ensuring those investments are accessible in the event of mass redemption requests or insolvency. However, the Supplementary Regime does impose requirements on ensuring a suitable spread of investments, investing in line with an appropriate liquidity strategy and credit risk policy, and managing foreign exchange risks.

What's next for the Post-Repeal Regime?

The Post-Repeal Regime received considerable negative feedback from stakeholders, and the FCA has decided that it will not be taking forward its two key proposals at this stage: receiving relevant funds directly into a designated safeguarding account or imposing a statutory trust.

The FCA's proposed end-state rules would have required payments firms to receive relevant funds into an approved designated safeguarding account, and for payments firms that use agents, to receive relevant funds directly into their designated safeguarding account (instead of via agents and distributors) or to segregate an estimated amount of the relevant funds received by those third parties. Respondents had concerns about the significant costs of replacing several non-bank payment accounts and standard bank accounts with relevant funds bank accounts, and about the availability of those accounts. Some also noted that the conversion would require some firms to decouple their UK operations from their global infrastructure, increasing risk, complexity and cost.

The imposition of a statutory trust of relevant funds, relevant assets, insurance policies and guarantees would have constituted a huge change in regulatory obligations for payments firms. The FCA had hoped it would address legal uncertainties following firm failures, but respondents had many concerns, including:

• Whether a statutory trust would fundamentally change the legal status of e-money
• The willingness of banks to provide trust accounts
• The ability of payments firms to retain interest earned
• The potential imposition of new fiduciary duties for relevant funds.

During consultation, the FCA said that when the current safeguarding requirements in the PSRs and EMRs no longer apply, the principles in the Ipagoo judgment will no longer bite, and that it believed that imposing a statutory trust would be the only way to ensure adequate consumer protection under its current powers. While these proposals are not taken forward, the novel approach in Ipagoo, and questions around the creditor claims waterfall, will continue to apply.

The FCA has said that it will review its end-state proposals and consult again on how the final regime should look after a full audit cycle has been completed. It does acknowledge, however, that the timing, nature and feasibility of transitioning to a Post-Repeal Regime will ultimately depend on HM Treasury’s approach to revoking the PSRs and the EMRs.

What do the changes mean for in the context of an insolvency process?

Overall, the rule changes should have the effect of simplifying – and reducing the time spent on – the distribution of client funds in a payments firm insolvency process. This means stakeholders should receive their funds more quickly and subject to fewer costs deductions; though the creation of a single asset pool and a statutory trust might have made this process considerably easier.

The strengthened requirements around record keeping will surely be welcomed – indeed, the new resolution pack is designed with insolvency practitioners (IPs) in mind, aiming to offer a readily available store of information which enables the timely return of client funds. With insurance / guarantee -method firms now required to contingency-plan at least three months before cover expires – including for those who cannot safeguard through segregation, reviewing their financial position and whether PESAR or another IA86 process would be appropriate –this may lead firm to consider the suitability of restructuring or insolvency processes more proactively.

Beyond safeguarding-specific concerns, the new rules will also have an impact on payment firms' wind-down planning framework, which among other things will need to interact with the resolution pack and audit process, and where relevant, should consider all implications and practical steps leading from an insurance policy or guarantee not being renewed. For now though, a wind-down plan will not need to consider how any IP would assume control of the statutory trust or work with the third-party trustee to ensure a smooth distribution process.