A safeguarding audit is an annual independent check, by a qualified auditor, that a payment or e-money firm has protected its customers' money as the rules require. The rules are in SUP 3A of the FCA Handbook, and the standard the auditor tests against is CASS 15, which FCA Policy Statement PS25/12 brought into force on 7 May 2026. The report goes to the FCA as well as to the firm's board.
Who Needs a Safeguarding Audit?
Under SUP 3A.1.1R the audit applies to authorised payment institutions authorised for services other than only payment initiation or account information, and to electronic money institutions. A firm is exempt if it has not been required to safeguard more than £100,000 of relevant funds at any time over a period of at least 53 weeks. Senior management must keep that exemption under review and appoint an auditor once the firm no longer qualifies (SUP 3A.1.4G). Small payment institutions do not have a mandatory safeguarding duty, so the audit does not apply to them unless they safeguard voluntarily.
The auditor must be eligible for appointment as a statutory auditor under Part 42 of the Companies Act 2006, must not be disqualified, and must be independent of the firm. It can be the same firm that audits the statutory accounts.
| Point | Rule | Requirement |
|---|---|---|
| Who | SUP 3A.1.1R | Authorised PIs (not PIS or AIS only) and EMIs |
| Exemption | SUP 3A.1.1R(2) | Never above £100,000 safeguarded over at least 53 weeks |
| Assurance level | SUP 3A.9.1R | Reasonable assurance engagement |
| Period | SUP 3A.9.6R | Ends no more than 53 weeks after the start date |
| Report to FCA | SUP 3A.9.7R | Within 4 months of the period end (6 months for the first audit) |
Scope of the Safeguarding Audit
The auditor's task is to assess whether the firm's safeguarding arrangements comply with the relevant requirements: regulation 23 of the Payment Services Regulations 2017 for PIs, regulations 20 to 22 of the Electronic Money Regulations 2011 for EMIs, and CASS 15 for both. The key areas the audit covers include:
- Method of safeguarding: Whether the firm uses the segregation method (placing relevant funds in a designated safeguarding account with a credit institution or approved investment), the insurance or guarantee method, or a combination. The auditor verifies that the chosen method is properly implemented.
- Timing of segregation: Relevant funds still held at the end of the business day following the day of receipt must be in a safeguarding account or invested in approved secure, liquid assets (regulation 23(6) of the PSRs). The auditor tests whether the firm meets this consistently.
- Reconciliation: Under CASS 15 the firm performs an internal and an external safeguarding reconciliation at least once each reconciliation day. The auditor tests the frequency, accuracy and completeness of these reconciliations and how discrepancies were resolved.
- Safeguarding account documentation: Under CASS 15.7 the firm completes and signs an acknowledgement letter for each safeguarding account, sends it to the bank, reviews it at least annually and keeps it for five years after the account closes. The auditor checks that these letters are in place and current.
- Record-keeping. The firm must maintain adequate records to identify, at any time, the funds held for each customer and to distinguish safeguarded funds from the firm's own money.
Common Audit Findings
Auditors and the FCA report the same findings again and again. Firms should address them before fieldwork:
Segregation timing breaches remain the most common finding. Many firms process high volumes of transactions and struggle to achieve same-day or next-business-day segregation for all relevant funds. The root cause is often manual processing steps, batch payment runs that occur only once daily, or delays caused by banking cut-off times. Reconciliation gaps arise where the firm's internal ledger of customer balances does not perfectly match the safeguarding account balance. Small discrepancies (e.g., from bank charges debited to the safeguarding account or timing differences on pending transactions) are common but must be identified, documented and resolved promptly. Missing or outdated acknowledgement letters. Firms change banking providers, open new safeguarding accounts or restructure existing arrangements without obtaining fresh acknowledgement letters. Every safeguarding account must have a current letter confirming its designated status.
Commingling of funds. The auditor may find instances where the firm's own funds have been inadvertently deposited into a safeguarding account, or where customer funds have been used to cover the firm's operational expenses. This is a serious regulatory breach. Inadequate records. The firm cannot demonstrate, at the point of audit, exactly how much is owed to each individual customer and how this matches the total safeguarded balance.
Post-PS25/12 Expectations
PS25/12 was published in August 2025 and its rules took effect on 7 May 2026 after a nine-month implementation period. The changes that shape the audit are:
- CASS 15 sets the detailed safeguarding standard: records that distinguish relevant funds from other money at any time, internal and external reconciliations each reconciliation day, and prompt resolution of discrepancies.
- A single director or senior manager of sufficient skill and authority must be responsible for oversight of safeguarding compliance and report to the board (CASS 15.2.4R).
- A monthly safeguarding return is due within 15 business days of each month end (SUP 16.14A).
- A resolution pack under CASS 10A must hold the documents an insolvency practitioner would need to return funds quickly.
- The insurance or guarantee method requires the firm to tell the FCA at least two months before first relying on it or changing the cover (CASS 15.5.7R).
The first audit under the new rules covers the first period in which they apply. Firms should run a self-assessment against CASS 15 before the auditor arrives.
Preparing for a Smooth Audit
Practical steps to ensure an efficient safeguarding audit include: conducting an internal pre-audit review at least six weeks before the auditor's planned fieldwork; ensuring all acknowledgement letters are current and accessible; preparing a schedule of all safeguarding accounts, balances and reconciliation records; briefing relevant staff on the audit process and their role in providing information; and addressing any known reconciliation discrepancies or process weaknesses before the auditor arrives.
The auditor delivers the report to the FCA within 4 months of the end of the audit period, or 6 months for the first audit under the new rules, and must tell the FCA in advance if it will miss that date. Qualified opinions or material findings attract supervisory attention. Firms should treat the audit not as a box-ticking exercise but as an opportunity to demonstrate the robustness of their safeguarding arrangements.
Regulatory Counsel advises payment institutions and EMIs on safeguarding compliance, audit preparation and remediation of audit findings. Contact us for a written proposal. See our safeguarding compliance page for more.
Frequently asked questions
Authorised payment institutions (other than those providing only payment initiation or account information) and EMIs need an annual audit under SUP 3A, unless they never safeguarded more than £100,000 at any time over at least 53 weeks.
The auditor assesses the method and timing of segregation, reconciliation accuracy and frequency, safeguarding account documentation (acknowledgement letters), record-keeping and overall compliance with the PSRs 2017 or EMRs 2011.
Segregation timing breaches, where relevant funds are not protected by the end of the business day following receipt, together with reconciliation gaps and missing or out-of-date acknowledgement letters.
Since 7 May 2026 the audit is a reasonable assurance engagement under SUP 3A against CASS 15, covering reconciliations each reconciliation day, acknowledgement letters, records, the resolution pack and the monthly return. The report goes to the FCA within 4 months of the period end.
The auditor sends it to the FCA within 4 months of the end of the audit period (SUP 3A.9.7R). PS25/12 allows 6 months for the first report under the new rules.
SUP 3A applies to electronic money institutions, which includes small EMIs, subject to the same £100,000 over 53 weeks exemption. A small EMI above that level needs an annual audit.
Definitive guides on this topic
The permanent reference pages this article relates to.
Safeguarding and CASS 15
Safeguarding arrangements, reconciliations and the CASS 15 regime.
UK Electronic Money Institution licence
FCA EMI requirements, EUR 350,000 capital, safeguarding, cost and timeline.
UK Authorised Payment Institution licence
FCA API requirements, own funds methods, safeguarding, cost and timeline.