FCA: new safeguarding rules will ‘better protect’ customer funds

The UK Financial Conduct Authority (FCA) is introducing new safeguarding rules for payments and e-money institutions, with a goal to “better protect” customer funds, according to a policy statement published on August 7. Safeguarding holds a customer’s money separately from an institutionʼs own funds.

The new rules will focus on improving books and records; enhancing monitoring and reporting; and strengthening elements of safeguarding. They are aimed at tackling shortcomings in firms’ safeguarding practices, such as ineffective prudential risk management and the absence of a wind-down plan.

Matthew Long, FCA director of payments and digital assets, said: “People rely on payment firms to help manage their financial lives. But too often, when those firms fail, their customers are left out of pocket.”

Not everyone is impressed. “The FCA is essentially admitting they’ve presided over a consumer protection disaster for the past seven years,” said Andy Agathangelou, founder of consumer advocacy group Transparency Task Force (TTF).

Under section 138I(5) of the Financial Services and Markets Act (FSMA) 2000, the new rules are being introduced as a ‘supplementary regime’, meaning they do not require consultation. They will come into force in May 2026.

Daily checks, with exemption

One change is the requirement for firms to “conduct daily checks to ensure customer funds are properly safeguarded”. Payment and e-money institutions will need to implement daily safeguarding audits to comply with the new rules.

The FCA also expects audits to be carried out by qualified auditors and to be consistent with standards set by the Financial Reporting Council (FRC), which can censure auditors who fail to meet required standards.

While the rules tighten monitoring standards for firms, the FCA is also granting an exception for smaller firms — those holding under £100,000 in customer funds — citing concerns over “audit costs and proportionality”. An FCA spokesperson told Compliance Corylated that an estimated 260 firms hold under the £100,000 threshold, including both e-money and payment firms, with the majority being the latter.

The regulator says it is relying on firms’ senior management to determine whether the firm is exempt, and it will monitor when firms exceed the £100k threshold.

However, TFT’s Agathangelou takes issue with the exemption. “The FCA is creating second-class consumers based on arbitrary financial thresholds and introducing a system with a gameable loophole. I wonder how well [its] impact modelling has taken into account the possibility that firms may now use a bit of structural creativity to escape oversight,” he said.

Growing funds

The new rules are intended to protect the growing pool of customer funds in the UK. E-money institutionsʼ safeguarded funds surged to around £26 billion in 2024 from £11 billion in 2021, according to the FCA policy statement.

The UK regulator added that between the first quarter of 2018 and the second quarter of 2023, payments and e-money firms that became insolvent had an average shortfall of 65% in funds owed to clients.

One example, authorised e-money institution Ziglu, which entered special administration in July, is not covered by the above data set. While details are still under investigation by David Shambrook and Damian Webb of RSM UK Restructuring Advisory, it is their current understanding that customer funds were ‘split between safeguarded and non-safeguarded’.

Maybe FSCS?

Another key concern the FCA expects to address is consumer confusion about automatic access to the Financial Services Compensation Scheme (FSCS). In its policy statement, the FCA emphasised that, under the Consumer Duty, firms should clearly highlight where appropriate that they are not banks and that the funds they hold are protected by safeguarding arrangements rather than the FSCS.

“If a payments firm’s UK safeguarding bank fails, the FSCS may be able to ‘look-through’ the payments firm to compensate its customers. However, the FSCS does not cover cases where the payments firm itself fails,” said the FCA.

While the regulator acknowledged the FSCS as a means of mitigating risks, it added that FSCS coverage is ‘out of scope’ of the changes it consulted on, and is a matter for parliament.