July 2026
[email protected]
+44 7563 115980 (phone and WhatsApp)
Your safeguarding ready for the annual audit, before the auditor arrives.
Since 7 May 2026, authorised payment institutions and e-money institutions above a £100,000 threshold must have an annual safeguarding audit, reported to the FCA. We prepare firms for it: we test the arrangements the auditor will test and fix what would fail.
The auditor reports on whether your systems were adequate throughout the period and whether you complied at the period end. We check both.
See also: Safeguarding services · Compliance health check
| Item | Position from 7 May 2026 |
|---|---|
| Firms in scope | Authorised payment institutions (other than payment initiation or account information only) and e-money institutions |
| Exemption | Not required to safeguard more than £100,000 at any time over at least 53 weeks |
| Assurance level | Reasonable assurance |
| Auditor | Eligible as a company auditor under the Companies Act 2006, and independent |
| First report | Within six months of the period end |
| Later reports | Within four months of the period end |
Tell us where you are and where you want to be.
[email protected]
+44 7563 115980 (phone and WhatsApp)
The safeguarding audit itself must be carried out by an auditor eligible for appointment as a company auditor. We are not your auditor. We prepare the firm so the audit finds working arrangements and a clear record, and we can help you respond to the auditor’s findings.
The auditor tests the whole audit period, not one date. A weakness in month three must be disclosed even if it was fixed in month nine. What counts is a clear record of the issue, the fix and the evidence that the fix worked. Our guide to safeguarding audits explains the rules in full.
Firms within the £100,000 exemption, and small payment institutions that safeguard voluntarily, still need adequate arrangements and still file the monthly return. Many banks and partners ask for independent assurance, and a readiness review provides it.
Yes, if you are an authorised payment institution or an e-money institution and have been required to safeguard more than £100,000 at any time in the last 53 weeks. One day above the threshold is enough.
No. The audit must be carried out by an independent auditor eligible for appointment as a company auditor. We prepare you for it and help you respond to the findings.
For audit periods ending within 12 months of 7 May 2026, within six months of the period end. Later reports are due within four months.
Whether your systems were adequate to comply with the safeguarding rules throughout the period, and whether you complied at the period end. Every breach found is listed in the report.
It should be fixed as soon as it is found, but it is still reported. The auditor looks for a clear record of the breach, the fix and the evidence that the fix worked.