PS25/12 Safeguarding: A Guide for Payments and E-Money Firms (2026)

PS25/12 Safeguarding

PS25/12 is the Financial Conduct Authority's policy statement, published on 7 August 2025, setting out a significantly strengthened safeguarding regime for payments and e-money firms. It introduces a two-stage reform. The first stage, the Supplementary Regime, is an interim set of rules that comes into force on 7 May 2026 and strengthens the existing safeguarding requirements under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011. The second stage, the Post-Repeal Regime, would eventually replace those requirements with a client-assets, CASS-style regime built around a statutory trust, but it has been paused pending further consultation and the legislative repeal on which it depends. For firms, the immediate priority is the Supplementary Regime and the 7 May 2026 deadline.

This guide explains what PS25/12 requires, who it applies to, the key obligations under the Supplementary Regime, and how firms should prepare. It is written for payment institutions, e-money institutions, their boards and their compliance teams.

Why the FCA is strengthening safeguarding

The reform is a direct response to persistent safeguarding failures. The FCA found that for payments and e-money firms that failed between the first quarter of 2018 and the second quarter of 2023, there was an average shortfall of around 65 per cent in the funds owed to customers. Safeguarding under the existing Payment Services Regulations and Electronic Money Regulations had been implemented inconsistently, with limited oversight and, critically, unclear legal protection for customer funds on insolvency. Because e-money use has grown substantially and a high proportion of e-money account holders show characteristics of vulnerability, the consumer harm from these failures is significant. The objectives of PS25/12 are to reduce shortfalls in safeguarded funds, to ensure funds are returned to customers quickly when a firm fails, and to give the FCA better data with which to identify and intervene in firms that fall short.

The two-stage structure

PS25/12 confirms a two-stage approach. The Supplementary Regime, described as interim rules, supplements the existing legislation, codifies FCA guidance, improves record-keeping and strengthens reporting and monitoring, all without requiring a change in the underlying legislation. It takes effect on 7 May 2026, with firms having been given a nine-month implementation period, extended from the six months originally proposed. The Post-Repeal Regime, described as the end-state, would repeal the safeguarding provisions of the Payment Services Regulations and Electronic Money Regulations and replace them with a CASS-style regime under which relevant funds and assets are held on statutory trust for customers. The FCA has decided not to implement the Post-Repeal Regime without further consideration and consultation, and will review how the Supplementary Regime works in practice, over a full audit period, before deciding whether further change is necessary.

Which firms PS25/12 applies to

The Supplementary Regime applies to authorised payment institutions, except those that solely provide payment initiation services or account information services; authorised e-money institutions; small e-money institutions; and credit unions that issue e-money in the United Kingdom. Small payment institutions are not automatically within scope but may continue to opt in to comply with safeguarding requirements, including the new rules, if they choose to do so. Firms that hold customer funds should assume they are in scope and plan accordingly, because the consequences of getting safeguarding wrong are precisely what the FCA has designed the regime to detect early.

The key requirements of the Supplementary Regime

The Supplementary Regime introduces a set of obligations that, taken together, move payments safeguarding much closer to the CASS standards that apply to investment firms. The main elements are set out below.

Requirement	What it involves
Monthly safeguarding return	A new return submitted to the FCA within 15 business days of each month-end, covering the safeguarding requirement, methods used, reconciliations, shortfalls and rectifications, breaches, and account, asset and insurance details
Annual safeguarding audit	A qualified auditor provides a reasonable-assurance report to the FCA on the adequacy of the firm's safeguarding arrangements, submitted within four months of the period end, or six months for the first audit
Audit exemption	Firms that have not been required to safeguard more than £100,000 of relevant funds at any time over at least 53 weeks are exempt from the audit requirement
Reconciliations	Enhanced internal reconciliation, including a D+1 segregation comparison, with board sign-off of reconciliation processes
Resolution pack	A CASS 10A-style resolution pack, demonstrating a clear wind-down plan for the orderly distribution of relevant funds on insolvency
Third-party due diligence	Annual due diligence on third parties that hold relevant funds, and consideration of diversification to mitigate concentration risk
Secure, liquid assets	Where funds are invested, they must be held in eligible secure, liquid assets that remain accessible on mass redemption or insolvency
Insurance or guarantee	Where safeguarding uses insurance or a comparable guarantee, enhanced requirements apply, including headroom for fluctuations and trust-based structuring

The relevant rules sit within the FCA Handbook in the new CASS 15 chapter, the CASS 10A resolution-pack provisions, the SUP 3A safeguarding-audit requirements and the SUP 16 reporting requirements, following the structure of the existing client-assets regime.

What firms need to do before 7 May 2026

Preparation is substantial and should not be left late. Firms need to assess their current safeguarding arrangements against the new rules, update systems and processes to support daily-cycle reconciliation and monthly reporting, put in place a compliant resolution pack, arrange an annual safeguarding audit with a suitable auditor unless the £100,000 exemption applies, and train operations, finance and compliance teams in the new requirements. Boards need to be ready to take on their new sign-off responsibilities for reconciliations. Firms should also monitor the FCA's evaluation of the Supplementary Regime, because the eventual shape of the Post-Repeal Regime will be informed by how the interim rules work in practice.

How Buckingham Capital Consulting can help

Buckingham Capital Consulting advises payment institutions and e-money institutions on safeguarding compliance and on preparing for the PS25/12 Supplementary Regime. We assess current safeguarding arrangements against the new rules, help firms implement the reconciliation, monthly reporting and resolution-pack requirements, advise on the annual safeguarding audit and the exemption threshold, and prepare the policies and governance changes the regime requires, including the board's new reconciliation sign-off responsibilities. We also help firms model how the proposed Post-Repeal, statutory-trust regime would affect their business so that they are not caught out by the eventual end-state.

If you need to prepare your firm for the 7 May 2026 deadline, or to review your safeguarding arrangements against PS25/12, contact our team for an initial assessment.

Email: info@buckinghamcapitalconsulting.co.uk.

Buckingham Capital Consulting has launched Safeheld (safeheld.com), a regulatory software platform that helps payment and e-money firms meet their PS25/12 safeguarding obligations. Firms looking to operationalise safeguarding - reconciliations, monthly returns, audit readiness and resolution packs - can use Safeheld to move from policy to day-to-day compliance. BCC clients can access a launch offer - reach the team at hello@safeheld.com

Frequently asked questions

When does PS25/12 come into force?

The Supplementary Regime, which is the interim stage of PS25/12, comes into force on 7 May 2026. The FCA published the policy statement on 7 August 2025 and gave firms a nine-month implementation period, extended from the six months originally proposed, to prepare. The second stage, the Post-Repeal Regime, does not have a confirmed implementation date. The FCA has decided to pause it, to review how the Supplementary Regime operates over a full audit period, and to consult again before implementing any end-state rules, which in any event depend on the repeal of the existing safeguarding provisions in the Payment Services Regulations and Electronic Money Regulations. For now, the operative deadline that firms must plan around is 7 May 2026.

Which firms does PS25/12 apply to?

The Supplementary Regime applies to authorised payment institutions, other than those that solely provide payment initiation services or account information services, to authorised e-money institutions, to small e-money institutions, and to credit unions that issue e-money in the United Kingdom. Small payment institutions are not automatically caught but may opt in to comply with the safeguarding requirements if they wish, and many do so to support a future transition to authorised status. In practice, any firm that holds customer funds in connection with payment or e-money services should assume it is in scope and prepare accordingly, because the regime is designed precisely to strengthen protection of those funds and to detect shortfalls early.

What is the annual safeguarding audit under PS25/12?

The Supplementary Regime introduces a requirement for most payments firms to appoint a qualified auditor to carry out an annual safeguarding audit and to provide the FCA with a reasonable-assurance report on the adequacy of the firm's safeguarding arrangements and its compliance with the rules. The report must be submitted within four months of the end of the audit period, extended to six months for the first audit to allow capacity to adjust. Firms that have not been required to safeguard more than £100,000 of relevant funds at any point over a period of at least 53 weeks are exempt from the audit requirement, although senior management must keep the firm's eligibility for that exemption under continuing review.

What is the difference between the Supplementary Regime and the Post-Repeal Regime?

The Supplementary Regime is the interim stage of PS25/12. It strengthens the existing safeguarding requirements under the Payment Services Regulations and Electronic Money Regulations, without repealing them, by improving record-keeping, reconciliation, reporting, audit and resolution-planning. It takes effect on 7 May 2026. The Post-Repeal Regime is the intended end-state, under which the existing safeguarding provisions would be repealed and replaced with a CASS-style regime holding relevant funds and assets on statutory trust for customers, giving stronger legal protection on insolvency. The Post-Repeal Regime has been paused, is contingent on legislative repeal, and will be the subject of further consultation, so firms should focus on the Supplementary Regime while modelling the potential impact of the end-state.

Does PS25/12 require a statutory trust over customer funds?

Not in the Supplementary Regime that takes effect on 7 May 2026. The statutory trust is a feature of the proposed Post-Repeal Regime, the end-state that the FCA has paused pending further consultation and the necessary legislative repeal. Under the Supplementary Regime, firms continue to safeguard under the existing legal framework, but with substantially enhanced record-keeping, reconciliation, reporting, audit and resolution-pack obligations. Firms should nonetheless understand the direction of travel, because the FCA's long-term intention is a trust-based, CASS-style regime, and modelling how a statutory trust and safeguarding-account structure would integrate with the business is sensible forward planning even though it is not yet a legal requirement.