Safeguarding After PS25/12: The Interim Regime Is Live, the Real Test Is the CASS Endgame

Since 7 May 2026, every authorised payment institution and e-money firm in the UK has been living under the FCA's Supplementary Regime for safeguarding, the first stage of the overhaul set out in policy statement PS25/12. Nearly six months in, the question worth asking is no longer whether firms have implemented the rules, but what they built when they did.

TrustSphere's house view is that too many firms treated the Supplementary Regime as a compliance project with a finish line at the first safeguarding audit. That is a category error. The FCA has been explicit that this is stage one of two: the interim rules shore up the existing regime under the Payment Services Regulations and Electronic Money Regulations, while the end-state Post-Repeal Regime will replace those safeguarding provisions with a client assets style regime once the Treasury legislates. A firm that solved for the audit has bought itself a second implementation programme; a firm that solved for data quality and daily operational discipline has already built most of the endgame.

We would go further: the Supplementary Regime is best understood as a diagnostic the regulator is running on the sector. The monthly return and the annual audit will show the FCA, firm by firm, whose books and records can actually support a trust-style regime and whose cannot. The firms that look weakest in that data should expect the sharpest supervisory attention well before any end-state rules arrive.

What has actually changed

The sequence is worth stating precisely. HM Treasury's 2023 Payment Services Regulations Review and Call for Evidence set the direction. The FCA consulted in CP24/20 between September and December 2024, and published final interim rules in PS25/12 on 7 August 2025, with the Supplementary Regime and amendments to the payments Approach Document taking effect on 7 May 2026. The rules sit in the Handbook at CASS 15 and CASS 10A, with audit requirements in SUP 3A and reporting in SUP 16.14A.

The substance, as set out in PS25/12, is a step change in operational cadence. Firms must perform safeguarding reconciliations at least once each reconciliation day, with weekends and bank holidays excluded after consultation feedback. They must maintain a resolution pack so that an insolvency practitioner can find and return relevant funds quickly. Most firms must arrange an annual audit of safeguarding compliance by a qualified auditor, though the FCA introduced a threshold of 100,000 pounds of relevant funds below which no audit is required. A new monthly safeguarding return goes to the regulator. Firms using insurance or comparable guarantees must ensure policies carry no conditions or restrictions that could delay payout, and must hold a contingency plan at least three months before a policy expires.

Scope is broad: authorised payment institutions (other than those providing only payment initiation or account information services), authorised and small e-money institutions, and credit unions issuing e-money, with small payment institutions able to opt in.

What is settled, what is drafted, what is speculation

Settled: the Supplementary Regime is in force and has been since 7 May 2026. The final rules, the audit and return requirements, the reconciliation expectations and the updated Approach Document guidance are law of the regime now, and the first full audit cycles are under way.

Drafted but not made: the end-state. CP24/20 consulted on Post-Repeal proposals, including replacing the safeguarding provisions of the EMRs and PSRs with a CASS style regime, and PS25/12 summarises the FCA's approach to that destination without making rules. The direction is on paper; the rules are not.

Speculation: everything that depends on legislation. The Post-Repeal Regime cannot exist until the Treasury repeals the current statutory safeguarding provisions, and no commencement timetable for that repeal has been set out. The timing of end-state rules, the precise trust mechanics, and the length of any transition are expectations, not facts, and we would treat any vendor or adviser presenting an end-state compliance date as selling certainty that does not exist. Our working assumption is that firms get a further consultation before end-state rules are made, but that is our expectation, clearly flagged as such.

The operational bill: people, data, systems, governance

The deepest change is cadence. Safeguarding used to be a policy document and a periodic exercise; it is now a daily operational process with a monthly regulatory witness. On people, that means named ownership of the daily reconciliation, trained cover for absence, and a standing relationship with a qualified safeguarding auditor whose capacity is already stretched across the sector.

On data, PS25/12 is quietly demanding. Internal reconciliations compare safeguarded resources against the firm's own records and ledgers; external reconciliations compare those records against third-party balances; and firms using non-standard reconciliation methods must document why and obtain an auditor's written report on the method. None of that works if the firm cannot evidence which ledger snapshot, at which reconciliation point, fed which figure.

That is precisely where we see firms fail. In TrustSphere's safeguarding readiness reviews for payments and e-money firms between January and September 2026, the recurring weakness was not policy but data lineage: firms performing reconciliations whose inputs could not be traced to a defined point-in-time source, which turns a daily control into a daily guess. Our RiskTech Index work points the same way: the reconciliation and safeguarding reporting vendors we scored in April 2026 sat between 5.8 and 7.2 against an index mean of 6.06, but their capability scores for payments-specific safeguarding returns ranged as low as 3 out of 9. The tooling market has not caught up with the regime, which means spreadsheets persist, and spreadsheets at daily frequency are where discrepancies hide.

On governance, boards should treat the monthly return as a disclosure they own. It is a recurring, signed statement of safeguarding health flowing straight into supervisory analytics, and a drifting return series will invite questions no firm wants to improvise answers to. Board papers should carry safeguarding as standing management information, discrepancy trends included, rather than surfacing it annually when the audit letter arrives. In our experience the firms that struggle in supervisory conversations are rarely the ones with the worst numbers; they are the ones whose boards are hearing the numbers for the first time in the meeting where they are asked about them.

Who carries the weight

Payments firms and e-money institutions bear the direct cost, and it falls unevenly. The 100,000 pound audit threshold spares the smallest firms, but a mid-sized firm just above it carries near-fixed audit and systems costs on thin margins, and we expect safeguarding economics to accelerate consolidation at the bottom of the market. That is our expectation, not the regulator's stated intent.

Tier 1 banks and other credit institutions sit on the other side of the safeguarding account. They are not in scope of the rules, but they hold the accounts the regime protects, and they will field a rising volume of designation confirmations, balance evidence for external reconciliations and resolution pack documentation requests from their payments clients. The banks that industrialise those responses will quietly become the preferred safeguarding partners; the ones that handle them as bespoke correspondence will lose the better-run clients first.

Challengers and fintechs that depend on banking partners should expect sharper counterparty scrutiny. Safeguarding banks now sit adjacent to a regime with monthly regulatory visibility, and in our client work the due diligence questionnaires arriving from credit institutions have already lengthened. Access to safeguarding accounts was never guaranteed; it is becoming conditional on demonstrable reconciliation discipline.

Auditors and professional bodies acquire a new annual market and a new liability. Qualified safeguarding audit capacity is the sector's bottleneck resource, and firms that left auditor appointment late for the first cycle have discovered what scarcity pricing feels like.

Regulators and supervisors gain what they have lacked since the e-money boom began: a recurring data feed on client fund protection rather than episodic discovery at the point of failure. The FCA's stated aims in PS25/12 are to reduce shortfalls and speed the return of funds when firms fail; the monthly return is how it will find tomorrow's failures early.

Consumers are the quiet beneficiaries. They will notice nothing until a firm collapses, at which point the difference between the old regime and this one is measured in how much of their money comes back, and how quickly.

Our read

The interim regime is live, auditable and already generating supervisory data; that much is settled. The end-state is directionally certain and temporally unknowable. The rational response is to stop treating the two stages as separate projects: build reconciliation data lineage, resolution pack maintenance and return automation to a standard a trust regime would demand, because every pound spent on minimum interim compliance that cannot carry forward is a pound spent twice.

Suggested Next Steps

• Commission an independent review of your first six months of daily reconciliations, testing data lineage from ledger snapshot to reported figure before your first safeguarding audit does.

• Rehearse the resolution pack: give it to someone outside the safeguarding team and time how long it takes them to locate every relevant funds account and acknowledgment.

• Automate the monthly return from reconciliation source data rather than compiling it manually, and trend your own series the way a supervisor would.

• Map every interim-regime control against a CASS-style end state and record which components carry forward, so the next implementation starts from an inventory rather than a blank page.

Sources: FCA PS25/12 policy statement and publication page; FCA CP24/20; HM Treasury Payment Services Regulations Review; TrustSphere Risk Index, April 2026.

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai