PS25/12 Explained: What the FCA's Safeguarding Policy Statement Changed
- Aug 5
- 6 min read
Buckingham Capital Consulting has advised payment and e-money firms on FCA authorisation, safeguarding and regulator engagement since 2013.
PS25/12 is the FCA policy statement that introduced the Supplementary Regime for safeguarding, published on 7 August 2025 and effective from 7 May 2026. It created CASS 15 in the FCA Handbook, extended the resolution pack requirement to payment and e-money firms through CASS 10A, introduced a monthly safeguarding return under SUP 16.14A and made annual safeguarding audits mandatory for most authorised firms.
This article sets out what the policy statement proposed, what changed between consultation and final rules, and what firms are now required to operate.
What is PS25/12?
PS25/12 is the FCA's policy statement on changes to the safeguarding regime for payment institutions and electronic money institutions. It followed consultation paper CP24/20, published in September 2024, and confirmed the final rules alongside an amended Approach Document.
The policy statement sets out the FCA's response to feedback, the rules it adopted, the changes it made following consultation and its reasoning. The rules themselves sit in the Handbook: primarily in CASS 15, with related provisions in CASS 10A, SUP 3A and SUP 16.14A.
The FCA allowed a nine-month implementation period between publication and the rules taking effect.
Why the FCA acted
The FCA had been reviewing safeguarding practice across the payments sector for several years and found significant variation in standards. Reviews of firms' arrangements identified weaknesses in record keeping, reconciliation practice, the treatment of relevant funds and the quality of oversight.
The consequences appear in insolvency. Where a payment or e-money firm fails, customers depend entirely on the safeguarded funds being complete and identifiable. Failures have repeatedly revealed shortfalls, and the process of returning funds has been slow and costly where records were inadequate.
The FCA's conclusion was that principle-based obligations in the Payment Services Regulations and Electronic Money Regulations were insufficient, and that firms needed detailed rules capable of being tested by an auditor and supervised consistently.
The two-stage approach
PS25/12 describes a two-stage reform.
The Supplementary Regime, now in force, supplements the existing requirements in the PSRs 2017 and EMRs 2011 with detailed Handbook rules. Firms remain subject to both the regulations and CASS 15.
The Post-Repeal Regime, which the FCA intends to introduce later, would repeal the safeguarding provisions of the PSRs and EMRs and replace them with a full CASS-style regime under which relevant funds are held on statutory trust.
The interim structure matters when reading the rules. CASS 15 does not stand alone, and firms must continue to comply with the underlying regulations alongside it.
What PS25/12 introduced
Detailed reconciliation requirements
The most significant operational change. Firms must perform an internal safeguarding reconciliation and an external safeguarding reconciliation, each at least once on every reconciliation day.
The comparison itself was also restructured. The previous deposit requirement and resource test was replaced by a higher-level comparison between the D+1 segregation requirement, being the relevant funds that should be held in relevant funds bank accounts or as relevant assets, and the D+1 segregation resource, being the balances of those accounts.
The resolution pack
CASS 10A was extended to payment and e-money firms, requiring a resolution pack retrievable within 48 hours containing the records needed to return relevant funds to customers in an insolvency procedure.
The monthly safeguarding return
A new regulatory return under SUP 16.14A, submitted through RegData, covering the firm's safeguarding position, reconciliation performance, shortfalls, accounts, assets, method and breaches during the reporting period.
The annual safeguarding audit
Under SUP 3A, authorised payment institutions and authorised e-money institutions must arrange an annual safeguarding audit by a qualified auditor, with the report submitted to the FCA. Firms safeguarding less than £100,000 throughout a period of at least 53 weeks are exempt.
For most firms in scope, this was the first time any part of their business had been subject to a CASS-style audit.
Governance and oversight
Responsibility for safeguarding compliance must sit with a director or senior manager of sufficient skill and authority, with documented policies and procedures supporting the arrangements.
Third-party due diligence
Documented due diligence on banks, custodians, insurers and guarantors, subject to periodic review, with consideration of whether diversification is appropriate.
What changed between consultation and final rules
Two changes are worth understanding, because they show where the FCA accepted that its original proposals were impractical.
Reconciliation frequency. CP24/20 proposed reconciliation on every business day. Firms responded that this created difficulties where operations span markets with differing holiday calendars, and that data from some third parties would not be available. The final rules require reconciliation on each reconciliation day, defined to exclude weekends, UK bank holidays and days on which a relevant foreign market is closed.
The reconciliation comparison. The FCA moved from the more prescriptive deposit requirement and resource test to the higher-level D+1 segregation comparison, reflecting the range of business models in scope and the practical difficulty of applying a single prescriptive calculation across all of them.
The FCA also confirmed that firms may use a non-standard method of reconciliation where the standard approach does not suit their business, subject to obtaining a written report from an independent auditor.
What firms must now operate
PS25/12 translates into a set of activities with defined frequencies.
Every reconciliation day: internal safeguarding reconciliation, external safeguarding reconciliation, comparison of the D+1 segregation requirement against the resource, remediation of any shortfall, withdrawal of any excess, and a record of each.
Every month: the safeguarding return under SUP 16.14A, submitted through RegData.
Continuously: the resolution pack, maintained and retrievable within 48 hours; the breach register; acknowledgement letters; third-party due diligence records; policies and procedures.
Annually: the safeguarding audit, with the report submitted to the FCA within six months of the first audit period end and four months thereafter.
On occurrence: notification to the FCA where records are materially inaccurate, where a reconciliation cannot be performed, where a discrepancy cannot be remedied, or where there has been a material difference between the amount safeguarded and the amount that should have been.
What PS25/12 means in practice
The policy statement changed the nature of safeguarding compliance rather than only its detail.
Under the previous regime, a firm could satisfy its obligations through arrangements that were correct in substance but lightly evidenced. Under CASS 15, the evidence is itself the obligation. An annual audit tests whether controls operated throughout the period, which requires a record created as each control operated rather than assembled afterwards.
That has a structural consequence. The monthly return, the board reporting, the resolution pack and the audit evidence all describe the same underlying safeguarding position. Where each is compiled separately from different sources, they diverge, and that divergence is what auditors and supervisors identify. Where all four are drawn from the same daily record, the position is consistent by construction.
Frequently asked questions
When was PS25/12 published and when did the rules take effect?
The FCA published PS25/12 on 7 August 2025. The rules came into force on 7 May 2026, following a nine-month implementation period.
What is the difference between PS25/12 and CASS 15?
PS25/12 is the policy statement explaining the FCA's final rules and its response to consultation feedback. CASS 15 is the Handbook chapter containing the rules themselves. Related requirements sit in CASS 10A, SUP 3A and SUP 16.14A.
Does PS25/12 apply to small payment institutions?
Small payment institutions are not required to safeguard, so the regime does not apply automatically. An SPI that opts in to safeguarding becomes subject to it.
What is the Post-Repeal Regime?
The FCA's intended second stage, under which the safeguarding provisions of the Payment Services Regulations 2017 and Electronic Money Regulations 2011 would be repealed and replaced by a full CASS-style regime holding relevant funds on statutory trust. Timing has not been confirmed.
What changed between CP24/20 and the final rules?
The most significant changes were the move from reconciliation on every business day to reconciliation on each reconciliation day, and the replacement of the deposit requirement and resource test with the higher-level D+1 segregation comparison.
Operating the Supplementary Regime
Safeheld runs the daily internal and external reconciliations, calculates the D+1 segregation position, manages breaks through to approved resolution, assembles the monthly SUP 16.14A return, maintains the CASS 10A resolution pack from live data and produces audit-ready evidence — all from a single record.
About Safeheld
Safeheld is the safeguarding platform for FCA-regulated payment and e-money firms, covering daily reconciliation, breach management, regulatory reporting, resolution pack maintenance and audit evidence. Safeheld is a Buckingham Capital Consulting company. safeheld.com
About Buckingham Capital Consulting
Buckingham Capital Consulting is a leading UK and European financial services regulatory consultancy. Since 2013 we have advised payment institutions, electronic money institutions, investment firms and cryptoasset businesses on authorisation, prudential and conduct requirements, safeguarding, governance and regulator engagement across the UK and EU. Contact our safeguarding team
