PS25/12: Changes to the safeguarding regime for payments and e-money firms

Policy Statement PS25/12 Changes to the safeguarding regime for payments and e-money firms August 2025

This relates to Consultation Paper 24/20 which is available on our website at www.fca.org.uk/publications Email: cp24-20@fca.org.uk Sign up for our news and publications alerts See all our latest press releases, consultations and speeches. All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 1000

3 Contents Chapter 1 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 4 Chapter 2 The wider context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 6 Chapter 3 Feedback on improved books and records and our response . . . . . Page 13 Chapter 4 Feedback on enhanced monitoring and reporting and our response Page 18 Chapter 5 Feedback on strengthening elements of safeguarding practices and our response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 25 Chapter 6 Feedback on the Supplementary Regime’s implementation and transitional arrangements and our response . . . . . . . . . . . . . . . Page 32 Chapter 7 Feedback on the Post-Repeal Regime and our response . . . . . . . . Page 35 Chapter 8 Feedback on cost benefit analysis and our response . . . . . . . . . . Page 40 Chapter 9 Feedback on Equality Act considerations and our response . . . . . . Page 46 Chapter 10 Changes to our Payments Services and Electronic Money Approach Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 48 Annex 1 List of respondents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 49 Annex 2 Cost benefit analysis detailed methodology . . . . . . . . . . . . . . . . . Page 50 Annex 3 Abbreviations used in this paper . . . . . . . . . . . . . . . . . . . . . . . . . Page 57 Appendix 1 Made rules (legal instrument)

4 Chapter 1 Summary 1.1 Payment and e-money institutions, and credit unions that issue e-money (payments firms), must safeguard funds they receive to make a payment or in exchange for e-money they issue (relevant funds). This aims to make sure that if a payments firm fails, consumers receive back the value of their payment or e-money as whole, and as quickly, as possible. 1.2 We have found that some payments firms do not currently have sufficiently robust safeguarding practices. As a result, some payments firms present an unacceptable risk of harm to consumers and market integrity. We want to strengthen the safeguarding regime and address weaknesses in the current safeguarding practices by: • Minimising shortfalls in safeguarded relevant funds. • Ensuring these funds are returned to customers as cost-effectively and quickly as possible if a payments firm fails. • Strengthening our ability to identify and intervene in payments firms that do not meet our safeguarding expectations to ensure these outcomes are met. 1.3 In response to the Treasury’s Payment Services Regulations Review and Call for Evidence, our consultation (CP24/20) proposed rules and guidance to improve the safeguarding regime and make customer funds safer. Some of the proposed changes depended on legislative change. So, we consulted on making changes in 2 stages: • ‘Interim rules’ (the Supplementary Regime) supporting the existing legislative safeguarding provisions in the Electronic Money Regulations 2011 (EMRs) and Payment Services Regulations 2017 (PSRs): – To support a greater level of compliance with existing safeguarding requirements as set out in the EMRs and PSRs. – To support more consistent record keeping. – To enhance reporting and monitoring requirements to identify shortfalls in relevant funds and improve supervisory oversight. • ‘End-state rules’ (the Post-Repeal Regime) that would replace the safeguarding requirements of the EMRs and PSRs with a ‘CASS’ style regime, where relevant funds and assets would be held on trust for consumers. We proposed that the Post-Repeal Regime would replace the existing regime if, and when, the existing safeguarding requirements of the EMRs and PSRs are repealed under the Financial Services and Markets Act 2023. 1.4 In this policy statement (PS) we have used the terms ‘Supplementary Regime’ and ‘Post￾Repeal Regime’ to describe the purpose of each of these stages.

5 1.5 This PS sets out our responses to feedback on our proposals in CP24/20 and our final rules and guidance on the Supplementary Regime. We have also published the amendments we intend to make to our Approach Document (‘Payment Services and Electronic Money - Our Approach’) when the final rules come into effect. This includes consequential and clarificatory changes, and some additional guidance we had previously proposed to make as part of the Post-Repeal Regime. Who this affects 1.6 Our rules apply to all: • Authorised payment institutions (except payment institutions which solely provide payment initiation services or account information services). • Authorised e-money institutions. • Small e-money institutions. • Credit unions which issue e-money in the United Kingdom. 1.7 In addition, small payment institutions (SPIs) will continue to be able to opt-in to comply with safeguarding requirements (including our rules) on a voluntary basis. Small e-money institutions and credit unions (that are required to safeguard funds received in exchange for e-money) will also continue to be able to opt-in to the safeguarding requirements (including our rules) for any payment services they provide which are unrelated to issuing e-money. Our rules also apply to the European Economic Area firms in supervised run-off under the financial services contracts regime. Our rules do not apply to payments firms subject to unsupervised contractual run-off. 1.8 This PS will also interest: • Consumers of payments firms. • Consumer groups. • Insolvency practitioners (IPs). • Auditors. • Professional advisers including lawyers and accountants. • Providers of safeguarding accounts, custodians of assets used for safeguarding purposes, and firms which provide insurance or comparable guarantees to payments firms responsible for safeguarding relevant funds.

6 Chapter 2 The wider context Market developments and risk 2.1 The current safeguarding regime was designed to support competition, innovation and consumer protection in a developing sector. However, some payments firms now have more complex business models, and the number of consumers served by this sector has increased. According to our Financial Lives Survey 2024, the proportion of consumers using a payment account with a payments firm has grown from 1% in 2017 to 12% in 2024. 2.2 Approximately 1 in 10 e-money holders in the UK are using e-money accounts as their main day-to-day transactional accounts and E-money institutions safeguarded approximately £26bn of relevant funds in 2024, an increase from £11bn in 2021. We estimate that payment institutions safeguarded £6bn in relevant funds on any given day in 2024. 2.3 The growth in the number of consumers and amount of relevant funds held by payments firms means more of the UK population is likely to be exposed to harm if a firm fails and there is a shortfall in relevant funds or a delay in their return to consumers. For firms that became insolvent between Q1 2018 and Q2 2023, there was an average shortfall of 65% in funds owed to clients (difference between funds owed and funds safeguarded). 2.4 Consumer harm could be particularly widespread if a large payments firm with poor safeguarding practices fails. If there are poor records, IPs would need to spend significant time and resources resolving which funds should be allocated to consumers and returning these. The failure of a payments firm could also cause wider harm to the market if it held funds on behalf of other regulated firms, as these other firms would then be unable to access their funds and could in turn fail. 2.5 We are particularly concerned about the risks of harm to vulnerable consumers. Our Financial Lives Survey 2022 showed that 40% of e-money account holders had at least 1 characteristic of vulnerability, such as a low resilience to financial shocks. Vulnerable consumers are likely to be more reliant on e-money accounts for day-to￾day transactions and money remitters often serve diaspora communities and financially vulnerable consumers. 2.6 If a payments firm’s UK safeguarding bank fails, the Financial Services Compensation Scheme (FSCS) may be able to ‘look-through’ the payments firm to compensate its customers. However, FSCS does not cover cases where the payments firm itself fails. Because of this, and the risks described above, consumers may lose money if their firm fails and face significant delays in receiving their funds.

7 Poor safeguarding practices 2.7 As the safeguarding requirements set out in the PSRs and EMRs are high-level, we have provided guidance in our Approach Document. However, we have found that some payments firms still do not have sufficiently robust safeguarding practices and present an unacceptable risk of harm to consumers and market integrity. We set out our concerns about this, among other things, in our 2025 portfolio letter to payments firms. In our letter, we outlined common shortcomings we see in safeguarding practices. 2.8 In our recent report ‘Risk management and wind-down planning at e-money and payments firms - multi-firm review’, we also highlighted a number of areas for improvement in firms’ risk management frameworks. These areas included firms not understanding liquidity risks arising from safeguarding arrangements, including shortfalls. Legal uncertainty following the insolvency of Ipagoo LLP 2.9 As we set out in our consultation, recent court judgments have introduced uncertainty over the legal status of relevant funds and how they should be topped up if there is a shortfall when a payments firm enters an insolvency process. How this links to our objectives Consumer protection 2.10 Enhanced reporting, monitoring and record keeping requirements in our Supplementary Regime will help identify shortfalls in safeguarded funds earlier. This will reduce the risk of shortfalls when a payments firm enters an insolvency process and will lead to improved consumer protection. 2.11 There is a risk that any costs from our proposals may be passed on to consumers through firms charging higher fees or cutting other operational costs. However, competitive constraints limit how far payments firms can pass on or reduce costs where this could affect the quality of their offer. Market integrity 2.12 More detailed and clearer rules on reconciliation of relevant funds and monthly reporting in our Supplementary Regime will help early identification of potential risks. For instance, this could occur where a payments firm is unable to use its own funds to rectify a shortfall in its safeguarded relevant funds. Where harm occurs from safeguarding failings which crystalise when a payments firm enters insolvency, this undermines market integrity, trust and confidence in payment firms, which could stifle growth in the payments sector.

8 Competition 2.13 Appropriate standards and a consistent approach to safeguarding requirements will support competition within the wider payments and e-money sector. More detailed rules will help level the playing field among payments firms, by removing inconsistencies in their approaches and providing greater clarity about the requirements. Secondary international competitiveness and growth objective 2.14 Whilst our rules are designed to advance our primary objectives, we believe they can also support our secondary international competitiveness and growth objective by fostering trust in the UK payments sector and supporting an attractive environment for doing business. We recognise that the costs of some of our proposals may encourage some firms to exit the market. However, we consider this to be outweighed by the expected benefits to consumer protection and to market trust, confidence and stability. The Consumer Duty 2.15 Our rules sit alongside the requirements for payments firms set out in the Consumer Duty (the Duty). The Duty requirement for firms to act to deliver good outcomes for their retail consumers is aligned with the objectives of strengthening safeguarding requirements for payments firms. 2.16 Our February 2023 portfolio letter: ‘Implementing the Consumer Duty in payments firms’ reminded payments firms of their obligations under the Duty, including safeguarding. Notwithstanding our proposed changes to the safeguarding regime, payments firms will need to continue to have regard to those obligations. Under the Consumer Understanding outcome of the Duty, firms must support their customers’ understanding by ensuring that their communications equip them to make decisions that are effective, timely and properly informed. For example, they should highlight where appropriate that they are not banks, and that funds which they hold are protected by safeguarding arrangements rather than by the FSCS. Our Strategy 2025 to 2030 2.17 ‘Our Strategy 2025-2030’ focuses on 4 key priorities: being a smarter regulator; supporting sustained economic growth; helping consumers navigate their financial lives; and fighting financial crime. These priorities interact and reinforce one another to create a fair and thriving financial services market for the benefit of consumers and the economy. 2.18 Our proposals support each of the 4 priorities, supporting economic growth and better outcomes for firms and consumers, and enabling the FCA to regulate payment firms more efficiently and effectively: • Payments are fundamental to the UK economy, and essential for businesses to function. Increasing trust in payments, and improving the outcome if firms do fail, should support UK economic growth.

9 • Enhanced safeguarding practices (including regular reconciliations) reduce the risk of misappropriation and fraud, which also increases trust both in payments firms and in the payments ecosystem more broadly. • Consumers need to be able to make payments safely and to understand that they will be protected if things go wrong. Consumers having confidence in the payments they are making, and knowing that they are protected, builds confidence which could facilitate growth. • Increased reporting (both through our new data return and in audit reports) allows the FCA to supervise the sector and to identify and act on any issues more quickly, acting as a smarter regulator, whilst also focussing on improving the system to bring growth and better consumer outcomes. What we are changing 2.19 This PS sets out our final rules and guidance for the Supplementary Regime. We do not consider the changes to the rules and guidance as consulted on are significant for the purposes of s138I(5) FSMA 2000, nor do they have an impact on the compatibility statement in CP24/20. 2.20 These requirements do not apply to SPIs that have not opted-in to complying with safeguarding requirements or credit unions that do not issue e-money. Improved books and records 2.21 In Chapter 3, we confirm requirements for payments firms to: • Perform safeguarding reconciliations at least once each day, other than weekends, public holidays and days when relevant foreign markets are not open. • Maintain a resolution pack, including requirements for the types of documents and records to be included that would help achieve a timely return of relevant funds to customers should the payments firm enter an insolvency procedure. Enhanced monitoring and reporting 2.22 In Chapter 4, we confirm: • Requirements for certain authorised payment institutions and electronic money institutions to arrange annual audits of their safeguarding compliance, carried out by a qualified auditor. • Guidance on our expectations around safeguarding audits for payments firms that are not required to arrange them. • The requirement for payments firms to submit a new monthly regulatory return to the FCA relating to their safeguarding arrangements.

10 Strengthening elements of safeguarding 2.23 In Chapter 5, we confirm rules for payments firms to: • Carry out due diligence when appointing or periodically reviewing third parties that manage or hold relevant funds or assets. • Continue to be able to invest relevant funds in the same range of secure, liquid assets as they can now. • Make sure there are no conditions or restrictions on safeguarding insurance policies and comparable guarantees paying out, other than certification of the occurrence of an insolvency event. • Have a contingency plan at least 3 months before a safeguarding insurance policy or comparable guarantee expires. If they do not have a replacement or renewal in place, they must be ready to safeguard relevant funds through the segregation method. Outcomes we are seeking 2.24 Our changes to the safeguarding regime are designed to address weaknesses in the current safeguarding approach and make sure: • Payments firms hold funds received in exchange for issued e-money or to execute a payment transaction safely and securely, at all times, or make sure they are covered by an appropriate insurance policy or comparable guarantee. • The right amount of funds is segregated from the payment firm’s own funds. • The claims of e-money holders or payment service users can be met from the safeguarded asset pool. • Relevant funds can be returned to customers as quickly and fully as possible if a payments firm fails or decides to wind down and exit the market. Measuring success 2.25 We would consider the Supplementary Regime to be successful if: • Over time, there is a decline in the percentage of shortfalls of relevant funds held by failed payments firms which are driven by non-compliance with safeguarding requirements. This should increase the amount of money returned to consumers. • There is a decline in supervisory cases relating to deficient safeguarding, with fewer formal interventions – such as restrictions being imposed based on failures to comply with safeguarding requirements. While this number may rise in the short term, we ultimately expect the number to fall due to better safeguarding practices in payments firms, through addressing issues raised in audits and more targeted supervisory responses informed by enhanced reporting.

11 Summary of feedback and our response 2.26 We engaged extensively with stakeholders and received 85 consultation responses from authorised e-money institutions, payment institutions, small e-money institutions, consumer groups, trade associations, professional bodies, auditors and advisors. 2.27 We have made our rules more proportionate and improved some implementation pressure points without compromising their overall effectiveness. For example: • We have amended the rules so that reconciliations are not required on weekends and bank holidays. • We have introduced a threshold of £100,000 relevant funds, under which payments firms will not be required to arrange a safeguarding audit. • We have removed the requirement for a limited assurance audit for payments firms holding no relevant funds. • We have increased the implementation period before the rules come into force from 6 to 9 months. 2.28 In addition, we are making some minor clarificatory changes and drafting improvements in our rules and guidance, including a consequential amendment to the GEN module of the Handbook (General Provisions). 2.29 We received a lot of feedback on the Post-Repeal Regime. Much of it raised concerns about the impact of imposing a statutory trust and receiving relevant funds directly into a designated safeguarding bank account. We have listened closely to the concerns and are not proposing to implement the proposals without further consideration and consultation. Once a full audit period has been completed, after the Supplementary Regime has come into force, we will review its implementation and consult on further proposals if changes are necessary. Equality and diversity considerations 2.30 Overall, we do not consider that the rules materially impact any of the groups with protected characteristics under the Equality Act 2010 (in Northern Ireland, the Equality Act is not enacted but other anti-discrimination legislation applies). More information on our considerations of the Equality Act 2010 is in Chapter 9. Environmental, social and governance considerations 2.31 In developing this PS, we have considered the environmental, social and governance implications of our proposals and our duty under ss.1B(5) and 3B(1)(c) of FSMA 2000 to have regard to contributing towards the Secretary of State achieving compliance with the net-zero emissions target under s.1 of the Climate Change Act 2008 and environmental targets under s.5 of the Environment Act 2021. Overall, we do not consider that the rules are relevant to contributing to those targets.

12 Mutual Societies 2.32 The Supplementary Regime applies to credit unions which issue e-money in the United Kingdom. We do not expect our final rules to have a significantly different impact on credit unions than to other firms that are not mutual societies. Next steps What you need to do next 2.33 The Supplementary Regime, and related amendments to the Approach Document, will come into force on 7 May 2026. 2.34 Before then, payments firms that receive funds to make a payment for a customer, or in exchange for e-money issued, will need to familiarise themselves with our new rules and guidance in CASS 10A, CASS 15, SUP 3A, SUP 16.14A and the updated Approach Document. They will also need to establish systems and controls to comply with the Supplementary Regime rules in CASS 10A, CASS 15, SUP 3A and SUP 16.14A. 2.35 Transitional arrangements and our expectations of payments firms during the implementation period are in Chapter 6. What we will we do next 2.36 We will engage with industry to support implementation. We will assess the effectiveness of the Supplementary Regime as set out above. 2.37 In 2021, the Payment and Electronic Money Institution Insolvency Regulations 2021 established the Payments and Electronic Money Special Administration Regime (PESAR). This special administration regime introduced an additional objective for insolvency practitioners, to ensure the return of relevant funds as soon as reasonably practicable. As it is not compulsory for a payments firm to enter the PESAR, in CP24/20 we stated that we intended to consult separately, at a later stage, on rules for when a payments firm fails and enters an insolvency procedure other than the PESAR, and rules to mitigate the impact of the failure of a third party used for safeguarding purposes. We will consider when it is appropriate to consult on such rules, taking into account the Government’s current review of the PESAR, the implementation of the Supplementary Regime and any further rule changes.

13 Chapter 3 Feedback on improved books and records and our response 3.1 Our proposed record keeping and reconciliation rules largely codify and build on the existing guidance in Chapter 10 of our Approach Document. 3.2 We consulted on requiring payments firms to maintain accurate records and accounts to enable them, at any time and without delay, to distinguish between relevant funds and other funds. To help ensure accuracy of payments firms’ records, they would be required to perform internal and external safeguarding reconciliations at least once each business day and in line with the method set out in the proposed rules. Internal reconciliations would be based on the values contained in payments firms’ internal records and ledgers. External reconciliations would compare the balances recorded in payments firms’ internal records to those of third parties, such as banks. They are an important control for preventing loss, misappropriation and fraud. 3.3 We proposed that payment firms would be required to establish, implement and maintain adequate policies and procedures to help ensure compliance with the safeguarding regime, and to notify us in writing and without delay if: • Their internal records are materially out of date, inaccurate or invalid. • They will be unable to perform an internal or external reconciliation. • They will be unable to remedy a discrepancy in their reconciliations. • At any time in the previous year, there was a material difference or discrepancy between the amount of relevant funds they were safeguarding and the amount they should have been safeguarding. 3.4 We asked respondents for feedback on the following questions: Question 1: Do you agree with our proposed rules and guidance on record keeping, reconciliation of relevant funds, and the resolution pack in both the interim and end state? If not, please explain why. Question 2: To what extent will firms incur operational costs relating to record keeping, reconciliation and resolution packs when moving from the interim to end state?

14 Record Keeping Feedback 3.5 Several respondents requested clarity and guidance on the use of external data as the basis for internal records. 3.6 Regarding notification requirements, a respondent suggested clarifying the concept of ‘materiality’ and the timing of notifications. Another respondent recommended reviewing the notification requirements to make sure notifications are ongoing and timely. Our response We have added guidance to clarify that payments firms may use data that is received from third parties for the purpose of creating and maintaining their internal records, where no other method is reasonable. We have not defined ‘materiality’ for the notification requirements or provided additional guidance on when a payments firm’s failure to comply with a specific requirement is material. This is in line with our approach in other areas of CASS. What is material will depend on the circumstances and payments firms will need to consider this on a case-by-case basis. We have also not provided additional guidance on the timing of notifications; the rules state that payments firms must inform us of the matters set out in the rules without delay, and they should ensure that they comply with this requirement. We also refer payments firms to the guidance in paragraph 4.8 of our Approach Document regarding notification of changes in a firm’s circumstances. Reconciliations Feedback 3.7 Several respondents raised concerns about the requirement to perform reconciliations every business day and the definition of ‘business day’ in the rules. Respondents highlighted challenges in complying with the requirement to make payments or withdrawals to address shortfalls or excesses identified by reconciliations at weekends and bank holidays when banks and credit institutions are closed for business. Some respondents asked that we amend the definition of ‘business day’ in the proposed rules. Others highlighted the operational cost of performing reconciliations on weekends and bank holidays. 3.8 Several respondents requested that we provide further guidance on the reconciliation rules or simplify the rules. A few requested guidance on the purpose of the relevant

15 funds deposit resource and requirement. Others suggested that we provide standardised formats and illustrative diagrams for safeguarding reconciliations. Two respondents provided feedback regarding the reconciliation point used for performing internal safeguarding reconciliations. One requested clarity of what ‘up to date’ means. Another was concerned that inconsistency of terminology in respect of when reconciliations should occur could result in a firm calculating the internal resource for the internal reconciliation at a different point in time to the internal records used for the external reconciliation. They suggested specifying that internal reconciliations should use records as at the close of business on the previous day. 3.9 Some respondents welcomed the increased detail in the proposed rules and the explicit approach for internal and external reconciliations. However, a few were concerned that the standard method of reconciliation may not be feasible for payments firms with complex, global business models. Some respondents asked that we consider allowing non-standard methods of internal safeguarding reconciliation. 3.10 One respondent asked for clarity on the different types of data sources used for internal reconciliations. 3.11 One respondent requested a review of the terms ‘differences’ and ‘discrepancies’ to ensure consistency. Our response The glossary definition of ‘business day’ reflects the established definition in regulation 2(1) of the PSRs, so we do not intend to change it. However, we have considered the feedback on the challenges of getting data on some days, the impact on the quality of reconciliations, and the challenges in moving funds where an excess or shortfall is identified. As such, we have amended the rules so that safeguarding reconciliations are required at least once each reconciliation day rather than business day. Reconciliation days exclude weekends, bank holidays and days on which relevant foreign markets are closed. We have also added guidance that this does not prevent payments firms from deciding it is appropriate to perform a reconciliation on business days that are not reconciliation days due to the nature, volume and complexity of their business. Payments firms are also reminded that reconciliations are intended to check the accuracy of a firm’s books and records, rather than being used as the means to maintain books and records. Separate to the reconciliation requirements, payments firms are required to maintain records and accounts to enable them, at any time and without delay, to distinguish between relevant funds and other funds. We have simplified the internal safeguarding reconciliation rules. We have replaced the relevant funds deposit resource and requirement reconciliation with a higher-level comparison of the relevant funds that should be held in relevant funds bank accounts, or as relevant assets in relevant assets accounts (the ‘D+1 segregation requirement’) against the balances of those accounts (the ‘D+1 segregation resource’). If the D+1

16 segregation resource is lower than the D+1 segregation requirement, a payments firm will be required to remedy the shortfall. If it is not possible to use relevant funds to do so, the firm must use its own funds.We have also clarified the requirements around the reconciliation points to be used for internal safeguarding reconciliations. We have also added guidance to emphasise that relevant funds received in respect of e-money must be safeguarded separately from those received for unrelated payment services. There must also be separate safeguarding reconciliations for each. However, we have not provided standardised formats or illustrative diagrams for safeguarding reconciliations, given the number of different business models in the sector. We have introduced rules allowing a payments firm to use a non-standard method of internal safeguarding reconciliation where it follows certain steps set out in the rules. However, payments firms will not be allowed to deviate from our requirements on frequency, regardless of the method of internal safeguarding reconciliation they use. Before using a non-standard method of internal safeguarding reconciliation, a payments firm must document how it will meet its obligations to its clients under the safeguarding rules. An independent auditor must review the proposed method and confirm in a written report that the proposed method meets the payments firm’s obligations. This is separate from, and in addition to, the requirement for an annual auditor’s safeguarding report. A payments firm using a non-standard method must not materially change its method of undertaking internal safeguarding reconciliations unless it has established and documented its reasons for concluding the changed method will meet its obligations to clients under the safeguarding regime and an auditor has prepared a report in respect of the proposed changes. For external reconciliations, we have amended the rules to only require external reconciliations to be carried out on reconciliation days. We have also added guidance that, where possible, the records and accounts used for the external safeguarding reconciliation should relate to the same point in time as the reconciliation point(s) used for internal safeguarding reconciliations. Where the records and accounts used for the external reconciliation cannot be aligned with the reconciliation point(s) for internal reconciliations, payments firms should set out in their policies and procedures how they will ensure the external safeguarding reconciliations will achieve their purpose. We have also removed the requirement to make and retain records of the decision on the frequency with which a payments firm will undertake external safeguarding reconciliations. We have not provided additional guidance on different types of data sources for reconciliations. It will be for payments firms to decide which data sources are appropriate for their circumstances on a case-by-case basis.

17 We have amended the rules on reconciliation discrepancies to refer to discrepancies consistently. Resolution packs 3.12 We consulted on payments firms being required to maintain a resolution pack, including requirements on the types of documents and records to be included. Feedback 3.13 While most respondents agreed with the maintenance of a resolution pack, some were concerned about the cost and proportionality of implementing and maintaining a resolution pack. 3.14 Some respondents requested further guidance on resolution packs, including templates on the form and functionality of the resolution pack. Our response We have introduced the requirements on resolution packs as proposed, with an amendment to clarify the requirement related to client contracts. Our experience from CASS firms is that resolution packs can be effectively implemented and maintained in line with the estimates outlined in the CBA. This is because the content of a resolution pack relates to information that we would generally expect payments firms to maintain in the ordinary course of business, for example: • Where relevant funds are held. • A list of the firm’s agents and distributors. • The firm’s procedures for the management, recording and transfer of relevant funds and assets. Resolution packs help ensure payments firms maintain, and can easily retrieve, information that would help achieve a timely return of relevant funds to consumers. The most effective examples of resolution packs we have seen under CASS 10 tend to be ‘living documents’ which link directly to the latest versions of the relevant records. This approach may also reduce the effort involved in keeping a pack up to date. Further, payments firms with less complex systems and business arrangements are likely to need less time and fewer resources to complete their resolution packs and would therefore incur lower costs.

18 Chapter 4 Feedback on enhanced monitoring and reporting and our response Safeguarding audits 4.1 We consulted on codifying the requirement for a safeguarding audit in rules, and to extend it to all payments firms other than payment initiation service providers, SPIs and credit unions that issue e-money. Our proposed rules further applied to SPIs and credit unions that issue e-money as guidance. The proposed audit requirement applied regardless of whether a payments firm was required to safeguard relevant funds during the period the audit relates to. If it was not, the proposed rules required the audit to be prepared in line with the terms of a limited, rather than reasonable, assurance engagement. 4.2 We asked respondents for feedback on the following questions: Question 3: Do you agree with our proposals for requiring external safeguarding audits to be carried out in both the interim and end state? If not, why not? Question 4: Do you agree with our proposals to require that safeguarding audits are submitted to us? If not, why not? Question 5: Do you agree that small EMIs should be required to carry out an annual safeguarding audit? If not, why not? Feedback 4.3 Most respondents supported our proposal for requiring annual audits to be carried out and submitted to us. However, a number of respondents were concerned about the cost of the safeguarding audit, particularly its proportionality for small payments firms. Other respondents suggested extending the audit requirement to SPIs. 4.4 We received feedback from many respondents on auditor capacity, their experience in the payments sector and increased costs. Many proposed loosening the restriction for a qualified auditor to carry out the audit to help address this. For example, this could be achieved by permitting an independent external firm or consultant to carry out the audit. A few respondents proposed reducing the frequency of audits to reduce the burden on payments firms. 4.5 Some respondents also said that the requirements of SUP 3A.4.2R to take reasonable steps to make sure that an auditor has the required skill, resources and experience to perform their functions may restrict payments firms to a small pool of auditors.

19 4.6 Some respondents fed back that the audit submission period of 4 months would be challenging for payments firms and auditors to meet. They suggested extending this to either 6 or 9 months. 4.7 Several respondents were concerned that the lack of a materiality threshold for audit report breaches could lead to over-reporting and make the audit process more onerous. Respondents suggested introducing a materiality threshold for breaches in the audit report. 4.8 Some respondents asked for clarity on whether the safeguarding auditor needs to be the same as the payments firm’s statutory auditor. Respondents also asked for clarity on whether the safeguarding audit period must be aligned with payments firms’ financial year end. Some suggested it should be, as this could help operationally. 4.9 Some respondents noted the importance of introducing an auditing standard from the Financial Reporting Council (FRC) against which the audits should be performed. They also sought clarity on the timeline for this. 4.10 Two respondents asked for clarity on expectations when an audit period covers rule changes, for example, if the audit period started before the Supplementary Regime rules came into force. 4.11 One respondent asked which payments firms would be required to arrange a limited assurance engagement. 4.12 One respondent suggested reconsidering the proposed change to the glossary definition of ‘internal controls’. This was because the proposed inclusion of ‘accounting procedures’ in the definition is not aligned with the general market understanding of the term. This could cause an expectation gap in the type of safeguarding deficiencies raised by safeguarding auditors. The respondent believed the application of this clause only to payments firms, rather than across the industry, seemed disproportionate. Our response Safeguarding audits are a key tool in improving standards across the sector. Compliance with the safeguarding requirements in the PSRs and EMRs varies significantly across the sector. Regular safeguarding audits will give essential assurance to both the FCA and payments firms’ boards that firms have systems adequate to comply with the safeguarding requirements. They will also help payments firms to identify breaches and improve their safeguarding arrangements to minimise potential consumer harm. We consider it necessary that safeguarding audits should be performed by qualified auditors to ensure consistent audit quality. This will help ensure the expected new FRC audit standard is followed and the FCA, FRC and auditors’ professional bodies have powers to censure auditors that do not conduct safeguarding audits to the required standards. As such, we have introduced the requirement for most payments firms to arrange an annual safeguarding audit report performed by a qualified

20 auditor. Regular and robust audits will help increase compliance with the safeguarding requirements and therefore we have maintained the annual frequency. In light of the feedback on proportionality, we have removed the requirement for a limited assurance engagement where a payments firm claims not to have been required to safeguard relevant funds during the audit period. We have instead introduced guidance clarifying that failing to safeguard relevant funds will usually be of material significance, so should be communicated to the FCA by statutory auditors under the existing notification requirements in regulation 24(3) of the PSRs and regulation 25(3) of the EMRs. We consider this meets our objectives in a more proportionate way. We have also carefully considered the concerns about the cost of safeguarding audits and proportionality for small payments firms which do safeguard relevant funds. We have taken two steps to address these concerns. First, we have introduced an exemption from the safeguarding audit requirement for payments firms safeguarding small amounts of relevant funds. If a payments firm has not been required to safeguard more than £100,000 of relevant funds at any time over a period of at least 53 weeks, it will not have to arrange a safeguarding audit under SUP 3A. It will be the responsibility of a payments firm’s senior management to determine, on a continuing basis, whether it is exempt from the requirement to appoint an auditor to perform a safeguarding audit. If management determines the payments firm is no longer exempt, they are responsible for appointing an auditor accordingly. We will monitor the risks relating to the threshold once the rules come into force – in particular, the risk relating to payments firms trying to use the exemption when they do not meet the criteria. Second, we will not apply the audit requirement as guidance to safeguarding institutions not required to get an audit. Instead, we have added guidance that voluntarily arranging an audit may help ensure they meet their obligations to have adequate safeguarding arrangements in place. We have introduced the requirement for payments firms to take reasonable steps to make sure that an auditor has the required skill, resources and experience to perform their functions. For example, a payments firm should have regard to whether an auditor has expertise in the relevant requirements and standards, and possesses or has access to appropriate specialist skill, and should seek confirmation of this from the auditor as appropriate. This is important to ensure high￾quality audits. Our intention is not to restrict the pool of auditors who can perform safeguarding audits and payments firms are not restricted from appointing smaller audit firms who meet the criteria in the rules. In response to the concerns over auditor capacity, we have extended the timing of submission for the first audit to 6, rather than 4, months following the end of the payments firm’s audit period. We consider this

21 is a reasonable period for firms and auditors and expect that firms will be able to comply with this. As outlined in paragraph 6.2, we have extended the implementation period to 9 months. We expect this will also help provide time for capacity to adjust to the increased demand for audits. For subsequent audits, auditors will be required to submit the audits within 4 months of the end of the period, given the importance of timely submissions. While materiality of audit breaches is a concept for any relevant audit standard, it is not clear that the introduction of a materiality threshold would necessarily lead to significant cost savings or a less burdensome audit process. This is because breaches would still need to be recorded and assessed to see if any materiality threshold was breached. We have amended SUP 3A.3.3G to clarify that payments firms are not required to appoint the same auditor for their safeguarding audit and their statutory audit. Although payments firms may appoint the same auditor if they choose. We have not specified whether a payments firm’s audit period should align with its financial year end. We set out in SUP 3A.9.7R that the period covered by a safeguarding report must not end more than 53 weeks after the period covered by the previous report, or after the payments firm becomes subject to the rules. A payments firm can choose whether it wishes to align its audit period to its financial year end. We are working closely with the FRC on the introduction of an auditing standard. While decisions on the publication of an FRC audit standard are ultimately for the FRC, we are seeking to align our timelines as far as possible. We expect that the longer implementation period will support this. When an audit period covers a date when new rules came into force, auditors will need to assess payments firms against the rules that were in place at the time. We have amended the glossary definition of ‘internal controls’ for CASS 15 and SUP 3A to align with regulation 23(17) of the PSRs and regulation 24(3) of the EMRs. We removed the reference to accounting procedures and instead refer to internal controls to ‘minimise the risk of the loss or diminution of relevant funds or relevant assets through fraud, misuse, negligence or poor administration’.

22 Safeguarding reporting 4.13 We consulted on introducing a new monthly regulatory return for payments firms to submit to us. We proposed that the new regulatory return would replace the current questions on safeguarding in existing regulatory returns. 4.14 We asked respondents for feedback on the following questions: Question 6: Do you agree with our proposals for safeguarding returns to be submitted to us and the frequency of reporting, in both the interim and end state? If not, please explain why. Question 7: Do you agree with the proposed data items to be included in the report? If not, please explain why. 4.15 We also piloted the safeguarding return with a representative sample of payments firms, asking them each to submit 2 returns. We greatly appreciated firms’ voluntary participation in the pilot, which provided valuable insight that has helped us improve the way the questions and guidance are framed. We anticipate this should make the return quicker and easier to complete for payments firms and improve the quality of data we receive. Feedback 4.16 Most respondents supported our proposal for a monthly safeguarding return to be submitted to the FCA. However, many suggested reducing the frequency of reporting. Several suggested reducing the frequency to quarterly due to the cost and time involved in completing the return. Some proposed that smaller or lower risk payments firms could report less frequently or answer fewer questions. 4.17 Some respondents said it was important to make the return easy to complete and requested guidance on how payments firms should complete it. For example, we could provide guidance on what exchange rate should be used for conversions. 4.18 A few respondents suggested that the safeguarding return duplicates other reporting, such as the Financial Resilience report or the Operational and Security Risk report. Some suggested questions could be removed to avoid duplication. Others suggested combining the safeguarding return with financial resilience reporting, because liquidity issues are often a cause of firm failure. 4.19 Some respondents asked for questions to be added to the return. For example, on the balance of frozen funds and customer profiles. 4.20 A few respondents asked how we would use and analyse the data from the return and proposed that we should share insights from our analysis with payments firms. One respondent noted it was important that the reporting does not reduce direct engagement between the FCA and payments firms.

23 Our response We have considered the feedback on firm burden carefully and we continue to believe that monthly reporting is necessary and proportionate. Regular information on relevant funds facilitates targeted proactive supervision and the assessment of risks across the portfolio. In addition, we piloted the return with a representative sample of payments firms. Payments firms reported the cost and time of completing the pilot, and based on this information, we consider monthly reporting is not overly costly or time consuming. It strikes the appropriate balance between firm burden and reducing risks of harm. So, in our final rules for the Supplementary Regime, we have maintained the requirement for payments firms to complete the return monthly. We have not taken a different approach to smaller payments firms, as this would significantly reduce our ability to identify risks of harm. We will provide support to payments firms in the 9-month implementation period and beyond on how to complete the return. We have also thoroughly reviewed the pilot data and feedback, which has helped us to make the return simpler for payments firms to complete. This includes, for, example: • Amending the return to reflect the new, higher-level comparison of the relevant funds that should be held in relevant funds bank accounts, or as relevant assets in relevant assets accounts (the ‘D+1 segregation requirement’) against the balances of those accounts (the ‘D+1 segregation resource’), as outlined in paragraph 3.11. • Requiring payments firms to confirm they have conducted at least one internal and external safeguarding reconciliation each reconciliation day, rather than requiring them to report the exact number carried out each day. • Adding explanatory text on how payments firms should complete the return if they are safeguarding using an unlimited insurance policy or comparable guarantee. • Adding guidance on the exchange rate that should be used for conversions. We have made other minor changes to the return to improve clarity and consistency. These include adding footnotes and tweaks to wording and do not materially change the data that payments firms will be expected to submit. We do not think it is appropriate to combine the safeguarding return with other reports such as financial resilience reporting or operational and security risk reporting. These types of reports are intended to support different objectives and to be submitted at different frequencies. However, we have sought to minimise duplication, so have removed questions on safeguarding from returns for APIs, SPIs, EMIs and SEMIs. We have also made consequential changes to the guidance for amended returns.

24 We believe that the data points collected through the return provide the necessary information to facilitate oversight of payments firms’ safeguarding practices, without being disproportionately burdensome. We have not added the suggested additional questions, such as on the balance of frozen funds. However, we have added a question to enable us to identify which payments firms are using a non-standard method of reconciliation. We have also amended the return, so additional detail is provided on relevant assets, to enable us to determine which assets are held with which custodians. We have also amended the return to identify firms that are exempt from the audit requirement in accordance with SUP 3A.1.1R(2). We have clarified that, for EMIs and credit unions providing unrelated payment services, the provisions of CASS 15.12 shall be read as if they apply separately to the institution’s unrelated payment services asset pool and to its electronic money asset pool. We have amended the return to require these firms to answer questions on unrelated payment services separately. We welcome stakeholders’ interest in how we will use, analyse and provide feedback on the data we receive from the return. We have considered our operational model for managing the returns and making sure we use the information productively. We will use the data in a range of ways, including for trend analysis, benchmarking across peer groups, policy evaluation and thematic deep dives. We plan to actively use the data from the return to inform our supervisory engagement. In our view, the reporting will increase the value of supervisory engagement, as it will help us to engage proactively and in a more targeted manner, particularly by identifying payments firms at risk in a stress event.

25 Chapter 5 Feedback on strengthening elements of safeguarding practices and our response Segregation of relevant funds 5.1 We consulted on rules to require payments firms to: • Exercise due skill, care and diligence when appointing third parties that: – provide accounts where relevant funds or assets are either received or deposited – manage relevant assets or – provide insurance or comparable guarantees. • Periodically review their use of these third parties. • Consider whether to diversify their use of these third parties. • Consider how to ensure relevant funds not held in designated safeguarding accounts are clearly identifiable, with the word ‘safeguarding’ used in the account name when possible. • Request acknowledgement letters which put the bank or custodian on notice that they are holding relevant funds or assets and how they should be treated. • Promptly allocate relevant funds to individual consumers. 5.2 We asked respondents for feedback on the following question: Question 8: Do you agree with our proposals to make prescriptive rules on the segregation of relevant funds in both the interim and end state. If not, please explain why. Feedback 5.3 Several respondents asked for further guidance on operational issues that may be encountered if safeguarding at multiple banks. For example, we could explain the different ways in which reconciliation information is provided or fees are charged. 5.4 A few respondents asked us for guidance on how frequently they should undertake periodic reviews of whether to diversify use of third parties, and to consider the resource requirements, time, and cost related to such reviews. 5.5 One respondent asked us to confirm whether our rules would continue to allow payments firms to hold relevant funds that they receive in return for issued e-money in a separate safeguarding account from relevant funds that they receive in relation to unrelated payment services.

26 Our response We have introduced rules on diversification of third parties without change. Payments firms will be required to consider whether diversification of third parties is appropriate and make changes whenever they conclude it is appropriate to do so. The appropriate frequency will depend on the type of firm and third party in question. We have also included guidance as outlined in the consultation paper on what payments firms should have regard to when considering whether diversification (or further diversification) is appropriate. We have not provided more detailed guidance because of the large number of different business models in the sector. Payments firms must continue to hold relevant funds they receive in exchange for issued e-money in a separate safeguarding account from relevant funds that they receive for unrelated payment services. We have moved the guidance in our Approach Document on this to the Handbook. Chapter 3 sets out the changes we have made to our rules and guidance on reconciliations. This addresses operational issues such as reliance on third party data and carrying out reconciliations on bank holidays. Investing relevant funds in secure, liquid assets 5.6 In our consultation, we proposed that payments firms would continue to be able to invest relevant funds in the same range of secure, liquid assets. 5.7 We asked respondents for feedback on the following question: Question 11: Do you agree that firms should be able to invest in the same range of secure, liquid assets as they can now in the interim state? Feedback 5.8 Many respondents agreed they should be able to invest relevant funds in the same range of secure, liquid assets as currently permitted. Some respondents requested clarification on the regulatory requirements for assets eligible for safeguarding investments, such as undertakings for collective investment in transferable securities and money market funds, under the relevant regulations of the PSRs and the EMRs. They also suggested harmonising the relevant regulations so that other assets such as tokenised assets and Euro-denominated European government bonds could be considered secure and liquid for the purposes of safeguarding.

27 Our response We have introduced rules in the Supplementary Regime setting out how payments firms can safeguard relevant funds by investing in secure, liquid assets without change. While we have some discretion to expand the range of approved secure, liquid assets, we maintain a low risk tolerance towards broadening the types of assets considered secure and liquid. We believe the current range of assets strikes the right balance between allowing payments firms to invest relevant funds and ensuring those investments are safe, liquid, and accessible in the event of mass redemption requests or an insolvency event. However, following the implementation of the Supplementary Regime, we may consider whether any changes are necessary, for instance as part of the Post-Repeal Regime or in line with policy developments in other related areas. Insurance and comparable guarantees 5.9 We consulted on replacing existing guidance with new rules and guidance as follows: • There must be no condition or restriction on the prompt paying out of the insurance or guarantee, except certification of an insolvency event. • Payments firms must decide whether to extend an insurance policy/comparable guarantee at least 3 months before it expires. • If a payments firm does not have arrangements in place to extend its cover, and the policy/guarantee term has less than 3 months remaining, it must prepare to safeguard all its relevant funds using the segregation method. • If a payments firm is unable to safeguard all its relevant funds using segregation, it should consider its financial position. This includes considering whether it is appropriate to place the payments firm into administration so a claim can be made under the policy or guarantee before the cover lapses. The payments firm should keep us informed at all stages so we can take any appropriate action, such as applying to the court to appoint an insolvency practitioner. • Payments firms must assess whether there would be any increase in operational risk from using an insurance policy or comparable guarantee. This should include considering whether restrictions on access to funds held outside a safeguarding account could adversely impact the institution’s short-term liquidity. 5.10 We asked respondents for feedback on the following question: Question 14: Do you agree with our proposals to maintain the use of insurance policies and comparable guarantees for safeguarding in both the interim and end state?

28 Feedback 5.11 Most respondents agreed with our proposals to maintain the use of insurance policies and comparable guarantees for the Supplementary Regime. Many respondents highlighted that there are a limited number of providers offering insurance policies or comparable guarantees for safeguarding relevant funds. The lack of providers limits competition and makes it difficult for payments firms to secure affordable cover, making this method of safeguarding unattainable for some firms. 5.12 Many respondents raised concerns about whether they could be required to secure a new insurance policy 3 months before their current policy expires, considering it unrealistic. They said insurers typically only provide quotes 4 to 6 weeks before renewal. Respondents said if this requirement were implemented, it would create a disconnect between regulatory expectations and market practices, leaving payments firms struggling to comply. Some respondents suggested increasing the lead period while others suggested reducing it. Our response We cannot mandate that such policies be offered or at what cost. That is a business decision for each provider. Payments firms are not required to renew their insurance policy or guarantee 3 months before it expires. The purpose of the 3-month lead time is to prevent a cliff-edge scenario where customer funds are not adequately protected. This could arise where an insurance policy or guarantee does not renew, and the payments firm is not prepared to switch smoothly to the segregation method of safeguarding. As such, payments firms will be required to take the following actions no later than 3 months before their insurance policy or guarantee expires: • A firm must decide whether it intends to continue using the insurance or guarantee method and notify us of this intention. • If a firm does not have a replacement or renewal in place, it must submit a plan to us saying how it will move to the segregation method if the insurance policy or guarantee is not replaced or renewed. • If a firm cannot safeguard all relevant funds through segregation, it should consider its financial position, including whether it is appropriate to place the firm into a process under the PESAR or the Insolvency Act 1986 so that a claim can be made under the policy or comparable guarantee before the cover lapses. Some respondents suggested increasing the lead period while others suggested reducing it. We are maintaining the 3-month lead period. We consider it a proportionate way to address the risks of customer funds not being adequately protected when an insurance policy or guarantee ends.

29 Question 15: Do you agree that the use of insurance policies and guarantees leads to the risks identified above? Are there other risks of which you are aware? Feedback 5.13 Most respondents agreed with the risks we identified. Some suggested additional risks that can arise from the use of insurance or guarantees. Firstly, there could be potential discrepancies between payments firms’ safeguarding procedures and the terms of their insurance policies. These could lead to delays or failures in payout, leaving consumers without timely access to their funds. Secondly, payments firms relying heavily on insurance may also face working capital issues if a policy expires and cannot be renewed, increasing financial instability. 5.14 Several suggestions were made to further mitigate these risks. These included: • Extending the lead period for payments firms to switch to alternative safeguarding arrangements if their policy does not renew. • Exploring the possibility for insurers to offer multi-year policies. • Considering alternative methods for faster reimbursement, such as allowing interim payments based on estimates with final reconciliation or enabling partial payments with multiple claims during the payout process. • Considering FSCS coverage for payments firms. Our response We have introduced the proposed rules in the Supplementary Regime without substantial change. The first additional risk highlighted by respondents is about potential disputed payouts. In CASS 15.5.4(R) we outline conditions an insurance policy or guarantee must comply with to be used as a method of safeguarding. Specifically, CASS 15.5.4R(2) requires that there must not be any condition or restriction on paying out other than the certification of the insolvency event. This mitigates against the additional risk mentioned above. The second risk is of a potential insurance or guarantee cliff edge scenario, which could result in a payments firm experiencing liquidity issues. Payments firms are required under CASS 15.5.7 to notify us at least 2 months before they intend to use the insurance or guarantee method for the first time, if there are changes to the cover and if there is a change in provider. CASS 15.5.8 outlines the information to be included in the notification provided to us, including an assessment of whether the use of insurance or guarantee will lead to an increase in operational risks, as specified in CASS 15.5.8R(5). This assessment should consider liquidity considerations, as outlined in CASS 15.5.9G. Further, paragraph 5.12 clarifies and outlines what payments firms are required to do no later than 3 months before their insurance or guarantee expires. Overall, we

30 believe that the notification requirements, assessments, and the actions firms must take within 3 months of their current insurance policy or guarantee expiring will help mitigate the risk mentioned above. Respondents provided several helpful suggestions on how to further mitigate risks associated with the use of insurance and guarantees. FSCS coverage is out of scope of the changes we consulted on. Our rules do not prevent partial payouts or multi-year policies. These are matters for the commercial arrangements between the payments firm and their insurer or guarantor. However, we do require that insurance policy or guarantee payments are made promptly. When safeguarding starts and ends 5.15 A lack of clarity on when the safeguarding obligation starts and ends can result in payments firms holding incorrect amounts of funds in their safeguarding accounts. Although our proposals to address this issue related to the Post-Repeal Regime, we signalled that we would consider what additional guidance we could give in the Approach Document alongside the Supplementary Regime. Question 18: Do you agree with our proposals to clarify when the safeguarding requirement starts and ends? If not, please explain why. Feedback 5.16 Several respondents asked for more clarity on: • Funds received by other payment service providers (PSPs) outside of the UK as part of the chain for the receipt of funds by a UK safeguarding institution and the reverse when paying out. • When spent e-money should no longer be safeguarded. There was a strong view that the obligation should end when the card payment is authorised. However, some respondents reported that some payments firms safeguard until the funds are paid to the card scheme. There was another view that the funds should be safeguarded until it is estimated that the acquirer of the merchant has received the funds. • The treatment of funds received to purchase foreign currency when linked to a payment. • When payments firms move relevant funds between safeguarding accounts, whether the funds are required to stay on the balance of the debiting safeguarding account until received by the crediting safeguarding PSP. • When the obligation to safeguard ends in relation to unclaimed residual relevant funds held by a payments firm that has stopped providing payment services or issuing e-money.

31 Our response We will consider this feedback if and when we progress the implementation of the Post-Repeal Regime. We will also bring forward some guidance from the Post-Repeal Regime in the Approach Document. For an inbound transaction, we will clarify existing guidance in the Approach Document to explain that the obligation to safeguard relevant funds starts as soon as the funds are received by the institution. It will receive funds as soon as it has an entitlement to them. For example, this could be when they are credited to an account in the institution’s name at a bank or other institution. For an institution accepting cash, for example in the provision of money remittance services, the funds will be received as soon as the cash is handed over. We will also clarify guidance in the Approach Document around payments being made before the funds received to make the payment have been safeguarded. The institution should have organisational arrangements in place to ensure it does not use relevant funds it is required to segregate to settle such payments. We will provide new guidance in the Approach Document about funds received for foreign exchange transactions. The guidance will say that where a foreign exchange transaction is carried out independently of any payment services, those funds do not have to be safeguarded. Where funds are treated in this way, we would expect to see evidence such as an instruction to return the funds to the customer. In our consultation, we explained that EMIs are required to safeguard unclaimed relevant funds for at least 6 years, and that we are not intending to change this requirement in the Post-Repeal Regime. Paragraph 4.51 of the Approach Document refers to the cancellation of a payments firm’s authorisation or registration when any liabilities to customers have been paid or covered by arrangements explained to us.

32 Chapter 6 Feedback on the Supplementary Regime’s implementation and transitional arrangements and our response Implementation period 6.1 We asked respondents for feedback on the following question: Question 19: Do you agree that the implementation arrangements give payments firms sufficient time to prepare for the interim and end state rules coming into force? Feedback 6.2 The main concern raised by most respondents was that the 6-month implementation period was insufficient for payments firms to prepare for the new rules coming into force. Many suggested extending the implementation period to between 9 and 12 months. They cited the need to reassess third-party arrangements, which could be a lengthy process, and the need for payments firms to improve their internal processes. They said these changes require substantial operational, technological, legal and financial adjustments to comply with the new rules. Our response We are providing a 9-month implementation period from the publication of the Supplementary Regime rules before they come into force. This strikes the appropriate balance between giving payments firms additional time to adjust their internal processes and external relationships to comply with the rules, without overly delaying the introduction of important consumer protections. The extension of the implementation period will also enable us to coordinate with the FRC on the introduction of a new audit standard that payments firms and auditors will need to adhere to when conducting a safeguarding audit.

33 Transitional arrangements 6.3 We asked respondents for feedback on the following questions: Question 20: Do you agree that the transitional provisions are appropriate. Feedback 6.4 Most respondents considered the transitional provisions appropriate for the Supplementary Regime. Our response We will maintain the transitional provisions for the Supplementary Regime. Question 21: Do you consider that any other transitional provisions are needed? Feedback 6.5 Many respondents requested that we consider additional transitional provisions. This included considering a phased implementation of the Supplementary Regime, hosting workshops throughout the implementation period, and addressing what firms should do about third-party arrangements and acknowledgement letters during the transition period. Our response We will engage with industry throughout the implementation period to ensure a clear understanding of the new requirements, provide clarity where possible, and understand any initial impacts. We have extended the implementation period for the Supplementary Regime, giving payments firms additional time to comply with the new requirements as outlined in paragraph 6.2. Additionally, we have extended the deadline for submitting the first audit under the new rules. We have also amended or clarified rules and/or provided further guidance to clarify the safeguarding requirements and help payments firms understand what is expected of them. We have provided for additional transitional provisions to facilitate implementation: • Payments firms will not have to record why they chose to use third parties appointed before the end of the implementation period.

34 • Payments firms will be able to continue to rely on acknowledgment letters obtained before the end of the implementation period in the form set out in the Approach Document. However, they will be subject to our rules on reviewing and replacing acknowledgement letters.

35 Chapter 7 Feedback on the Post-Repeal Regime 7.1 Much of the large amount of feedback we received on the Post-Repeal Regime raised concerns about the impact of imposing a statutory trust and receiving relevant funds directly into a designated safeguarding bank account. We will consider the feedback alongside our review of the effectiveness of the Supplementary Regime, and whether we should progress with the Post-Repeal Regime. The timing, nature and feasibility of transitioning to the Post-Repeal Regime would ultimately depend on the Treasury’s approach to revoking the PSRs and the EMRs. Receiving funds directly into a relevant funds bank account 7.2 Our proposed Post-Repeal Regime would require payments firms to receive relevant funds into a designated safeguarding account with an approved bank or the Bank of England (referred to as a ‘relevant funds bank account’ in the draft rules). This is to make sure they are adequately segregated from other funds. This would not apply to funds received through an acquirer or an account used to participate in a payment system. 7.3 In addition, the Post-Repeal Regime would require principal payments firms either to receive relevant funds directly into their designated safeguarding account, instead of via their agents and distributors or to segregate an estimated amount of the relevant funds received by their agents and distributors. This would address risks arising from a lack of oversight of agents and distributors and reduce the complexity of distribution where payments firms have a high number of agents and distributors. We asked respondents the following questions: Question 9: Do you agree with our proposals to require relevant funds to be received directly into a designated safeguarding account subject to specified exceptions? If not, please explain why. Question 10: Do you agree that funds received through agents or distributors should either be paid directly into the principal firm’s designated safeguarding account, or protected through agent and distributor segregation? If not, please explain why. Feedback 7.4 Many respondents raised concerns about the potentially significant costs of replacing numerous non-bank payment accounts and standard bank accounts with relevant funds bank accounts, and about the availability of such accounts. They also highlighted that this conversion may require payments firms to decouple their UK operations from their global infrastructure, potentially increasing risks, complexity and costs.

36 7.5 One respondent was concerned that the proposal for relevant funds to be received directly into a relevant funds bank account would significantly disrupt existing payment flows and business models, particularly for payments firms operating globally and handling cross-border payments, multi-currency flows, and merchant prefunding. The respondent stated that this requirement would be operationally and commercially unworkable for these firms. This is because it would increase liquidity requirements and potentially introduce or increase operational risk. Investing in secure, liquid assets 7.6 In the Post-Repeal Regime, we proposed continuing to allow payments firms to invest in secure, liquid assets, with relevant funds and the assets purchased with them included in a statutory trust. Payments firms holding these assets would have to comply with CASS 6 custody rules. We proposed to review and consult separately on the permitted range of assets, and on additional guidance about liquidity management and procedures. Question 12: Do you agree that firms should be able to invest relevant funds in secure, liquid assets in the end state? Feedback 7.7 Many respondents raised concerns about the potential need to get additional regulatory permissions to manage investments, considering it overly burdensome. They believed the current regulatory framework already imposes significant compliance requirements, and adding more permissions could increase operational complexity and costs. Some respondents said the need for additional permissions could hinder new entrants to the market, impacting competition. Further, some respondents emphasised that if payments firms get the necessary permissions to manage investments, we should make sure there is a clear risk management framework to accompany investments in secure liquid assets. They suggested that this framework should include clear guidelines on liquidity management, credit risk policy, and foreign exchange risk management to ensure payments firms can effectively manage the risks associated with their investments and ultimately protect consumers. Question 13: Do you agree that payments firms should be able to hold the assets they invest in, or should they always be held by a custodian? If you disagree that payment firms should be able to hold the assets they invest in, please explain why. Feedback 7.8 Many respondents agreed that payments firms should be allowed to hold their assets directly, provided they have the necessary permissions and comply with applicable requirements such as CASS 6. However, some respondents expressed concerns about the potential additional costs they would incur to get these permissions, as well as the possibility of conflicting requirements under different custody rules. Some respondents

37 noted that requiring only custodians to hold the assets in which a payments firm invests complicates the process, especially during asset liquidation. It also may not provide additional security given some existing ambiguities and complexities in the requirements. Additionally, some respondents highlighted difficulties in finding custodians willing to work with payments firms, particularly due to low asset volumes. They suggested that custodians should be EU-wide rather than limited to FCA￾regulated entities. Some respondents emphasised the need for clear identification of ownership records to mitigate risks during insolvency situations. They advocated for a structured approach to asset management. Insurance and comparable guarantees 7.9 In our consultation, we explained that we intended to maintain the option for payments firms to safeguard relevant funds through insurance or comparable guarantee. However, we indicated that we would continue to monitor this option, including its risk to consumers and markets. 7.10 To make sure that consumers are fully protected when a payments firm uses the insurance or comparable guarantee method, we proposed that the rights under and proceeds of the insurance policy or comparable guarantee would be included in a statutory trust. Question 14: Do you agree with our proposals to maintain the use of insurance policies and comparable guarantees for safeguarding in both the interim and end state? Feedback 7.11 Most respondents agreed with our proposals to maintain the use of insurance policies and comparable guarantees for the Post-Repeal Regime, although some raised concerns about the risk of delays in payouts by insurers. 7.12 Some respondents said payments firms relying exclusively on the insurance or comparable guarantee method may face challenges in securing coverage that exceeds, at all times, the amount being protected. The main concern was that it would be difficult for payments firms to determine the required coverage throughout the year due to seasonal fluctuations in the funds they must protect. Additionally, some respondents raised concerns about the clarity of key terms such as ‘relevant funds’ and ‘safeguarding resource’. They believed these contributed to confusion regarding the scope of payments firms’ safeguarding obligations and the required insurance or comparable guarantee cover.

38 Holding funds under a statutory trust 7.13 Our proposed Post-Repeal Regime would introduce a statutory trust over relevant funds, relevant assets and insurance policies/guarantees used for safeguarding to address legal uncertainty following a payments firm failing. Question 15: Do you agree that a statutory trust is the best replacement for the safeguarding regime in the EMRs and PSRs? If not, please explain why. Question 16: Do you agree with the proposed terms of the trust, including the payments firm’s interest after all valid claims and costs have been met? If not, please explain why. Feedback 7.14 Some respondents raised concerns about whether our proposals would fundamentally change the legal status of e-money. 7.15 More respondents were concerned with practical implications. For example, the willingness of banks to provide trust accounts; the potential need for additional FSMA 2000 authorisation where payments firms invest relevant funds in secure liquid assets; and the ability of payments firms to retain interest earned. 7.16 One respondent was concerned that the imposition of a statutory trust meant that payments firms would be subject to new fiduciary duties for relevant funds. They were concerned that this would alter their liability and risk profiles and mean upskilling of directors and payments firms to fully understand these duties. Implementation and transitional arrangements 7.17 In our consultation, we proposed the following implementation and transitional arrangements for the Post-Repeal Regime: • A 12-month implementation period following the publication of the rules before they come into force. • The amendments to the CASS rules would not apply to a payments firm if a primary pooling event happened before the rules came into force. • The imposition of the statutory trust would apply to funds and assets held at the time the rules came into effect. This approach was considered both proportionate and necessary to protect consumers. Otherwise, those funds and assets would not be subject to any safeguarding regime if and when the revocation of the current regime under the PSRs and EMRs is commenced.

39 Question 19: Do you agree that the implementation arrangements give payments firms sufficient time to prepare for the interim and end-state rules coming into force? If not, please explain why. Question 20: Do you agree that the transitional provisions are appropriate? If not, please explain why. Question 21: Do you consider that any other transitional provisions are needed? If so, please explain why. Feedback 7.18 The main concern of most respondents was that the 12-month implementation period would not be long enough for payments firms to prepare for the new rules. Many suggested extending the implementation period to 18 months. They said the requirements of a statutory trust and having all relevant funds paid directly to a designated safeguarding account would require fundamental changes to their business models.

40 Chapter 8 Feedback on the cost benefit analysis and our response 8.1 This chapter summarises the consultation feedback to our cost benefit analysis (CBA). Respondents generally answered both questions 22 and 23 together, so we consider them together below with more detail in Annex 2. 8.2 While some respondents supported the CBA and its analysis, many respondents were more critical. Their concerns fell broadly into 4 categories, which we subsequently discuss in more detail: • Estimated costs in the CBA are too low. • There is a disproportionate impact on smaller payments firms that is not adequately considered. • Quantification of benefits was overstated. • Competition impacts were not fully assessed and/or recognised. Estimated costs are too low 8.3 Many respondents felt that many of the estimated costs were too low and understated the impact of the changes. We take these concerns in turn by cost group, splitting between Supplementary and Post-Repeal Regimes. Supplementary Regime • Audits: Many respondents felt that the costs of audits had been significantly underestimated, particularly for small payments firms. Along with the price of the audit itself, firms said we had not considered the costs of getting to audit standard and the ongoing costs during the assurance process. • Reconciliations: Respondents felt we had underestimated the cost of performing reconciliations, primarily the cost of performing them on weekends and the additional staff required on those days. Merchant acquirers also noted there may be significant costs from moving to client-level reconciliations. • Resolution packs: Some respondents felt that the estimated 2-day timeframe to produce a resolution pack was too short, that they would require external review, and that they would face ongoing costs in keeping it updated. • Use of third parties: A few respondents felt that undertaking due diligence on third parties and diversification requirements would require greater effort than we had estimated.

41 Post-Repeal Regime • Legal and consulting costs: Some respondents said we had not considered the cost of external legal and consulting advice to ensure that they correctly meet and implement our proposed rules. • Statutory trust: Respondents noted that where they are operating bank accounts in different jurisdictions, they may face additional costs if the trust is not recognised in that jurisdiction. • Secure, liquid assets: One respondent noted that we had not considered the cost of authorisation. • Safeguarding before D+1: Many respondents felt we had materially understated the costs of changing how relevant funds are safeguarded from receipt. They said this would require a complete overhaul of many operating models and require extensive interactions with external legal, consulting, and audit firms. Payments firms also noted that issues with accessing designated safeguarding accounts (DSAs) could potentially cause firms to exit the market and that the CBA did not adequately consider this. • Access to DSAs: Respondents noted that payment firms currently have difficulty getting these accounts and this is likely to be exacerbated by the increased restrictions proposed in the Post-Repeal Regime. Our response We have considered respondents’ feedback on costs and respond to each of them in turn. Where appropriate, we restate costs below. Supplementary Regime • Audits: We have taken on board respondents’ feedback. We have undertaken substantial engagement with the Institute of Chartered Accountants in England and Wales and audit firms to better understand the cost payments firms may face. We have now re-estimated these costs on this basis. We have also introduced a threshold. If a payments firm did not safeguard over £100,000 of relevant funds at any point in the previous 53 weeks, it will not be required to arrange a safeguarding audit. We previously estimated audit costs to payments firms of £49m and now estimate total costs of £53.3m. We discuss these in more detail below. • Reconciliations: We have considered respondents’ concerns about the costs and challenges of performing reconciliations on weekends and bank holidays. The final rules do not require reconciliations to be carried out on these days, or days when relevant foreign markets are closed. Our Approach Document currently requires reconciliations to be carried out on business days, including weekends, in certain circumstances. As we have assumed that payments firms are already in compliance with the Approach Document in our CBA, the changes we have made to our final policy will lead to reduced costs compared to those stated in our consultation. We were not able to robustly quantify this benefit to firms, so we did not do so to avoid overstating these benefits. We do note that this means that the benefits in our net present value (NPV) are likely understated with respect

42 to consumer benefits, however, we do not expect this to materially reduce the benefits arising from improvements in firm practice. This is because firms will still need to keep their records up to date, which will mitigate the risk. • Resolution packs: We have carefully considered the representations on these costs but consider that respondents may have overestimated the amount of work needed to implement and maintain resolution packs. As noted earlier, our experience of CASS firms is that resolution packs are not onerous to implement and maintain. The contents of the packs are primarily links to other documents that will need to be produced to meet other provisions in the safeguarding rules, the costs of which have already been incurred. So, we consider the costs in our original CBA reflect the level of work needed to produce and update these packs. • Use of third parties: While some respondents felt we underestimated these costs, they did not provide evidence of the uplift that may be required. It was also unclear whether respondents’ concerns were about the Supplementary or Post-Repeal Regime. Therefore, we have not restated these costs. Post-Repeal Regime 8.4 Respondents felt we underestimated costs for the Post-Repeal Regime and the challenges around DSA. We will revisit the costs and benefits, taking into account stakeholders’ feedback, if and when we progress the Post-Repeal Regime. Outsized impact on smaller firms 8.5 Some smaller payments firms felt the costs of both the Supplementary and Post￾Repeal Regimes would have an outsized impact on their business. In particular, some respondents felt that we needed to fully consider whether smaller payments firms would be able to operate following our intervention. 8.6 Respondents also said audit costs would be higher than the CBA estimated for small payments firms. Our response Our CBA considered the cost to payments firms by size and noted that there may be implications for some firms’ ability to operate. However, it is difficult to understand which, and the number of, firms that may be affected. We have undertaken internal analysis using regulatory returns to understand the impact of our proposals on firm profitability and revenue. This analysis found limited impact on the number of profitable payments firms, although there are a relatively high number of firms that are already unprofitable that will also be affected. We note that there are many factors which contribute to a payments firm’s viability beyond their simple financial position, such as wider market conditions and management. Aside from audits, for which we have now implemented a threshold exemption, respondents did not generally note which specific costs had

43 been underestimated. A small number said diversification costs would be higher, as we had assumed that they would not be required to diversify given their smaller holdings of funds. We maintain that payments firms need only to consider diversification risk and diversify if appropriate, and this may not require them to make any changes. Quantification of benefits 8.7 Some respondents felt we had overstated the benefits of our proposals. In particular: • That all payments firms will comply with our proposed rules: Respondents felt our assumption on this was unlikely to be accurate, which would have implications for our estimated benefits and the effectiveness of our proposals. If payments firms do not comply with our rules, they may not have adequately safeguarded customer funds, leading to shortfalls or delays in returning these funds. • Opportunity cost of not being able to access funds: Some respondents felt that including interest as the opportunity cost (what customers would do with those funds if they were not tied up) of being unable to access funds was not valid. This is because EMIs do not pay interest and other payment firms are unlikely to hold funds for sufficient periods of time. • Faster return of funds: Some respondents thought we had not evidenced that the average reduction of time to return funds would reduce from 2.3 years to 1.3 years. They also thought the stated benefits may have overlaps with benefits from the PESAR and was too long for customers to wait in any case. Our response We know the 100% compliance assumption in our CBA may not necessarily be accurate and have provided updated sensitivity analysis to account for this. This analysis finds that compliance among failed payments firms may need to be 53% for our proposals to break even, based on the anticipated shortfalls and delays in returning funds. We expect that our proposals will help to address non-compliance in the industry through increasing oversight and introducing audit requirements for more firms. In 2016 we introduced an FRC audit standard for CASS firms. There was initially a large increase in adverse audits to 142 (13%) but this has fallen significantly to 64 (6%) in 2024. While we understand that payments firms may not pay interest, this benefit was illustrative of what customers may have forgone by being unable to access their funds. It is not related to the interest paid on funds while held in a payment account, but rather on where customers might have put that money if they had access to it. Therefore, we consider it a valid benefit to include. In any case, it is a relatively small portion of the overall benefits, estimated at £3.6m present value (PV) over the 10-year appraisal period.

44 While we would like distribution to be much faster, disorderly insolvencies are an inherently difficult process and take time to resolve. We based our assumption on insolvencies we have seen in CASS firms, which operate a similar regime to our proposals. We will reconsider our analysis of the benefits of the Post-Repeal Regime if and when we progress its implementation.  Competition impacts 8.8 Some respondents felt we had not properly assessed the impact on competition in the market. They suggested the costs of compliance could cause payments firms to stop operating and reduce overall competition in the market. This would lead to higher prices for consumers using other firms’ services or advantages for retail banks. We acknowledged this risk in our CBA but do not consider it reasonably practicable to estimate these changes due to the range of factors involved. We will continue to monitor competition in the market following the implementation of the Supplementary Regime. 8.9 While it may result in some payments firms facing greater difficulty in operating, it provides a stable environment for firms to operate in and will increase trust in the system. This may allow payments firms to compete more effectively with other providers of payment services, such as banks. 8.10 The National Payments Vision sets out that the regulatory framework for payments firms should ‘support growth and competitiveness while maintaining financial stability, market integrity and consumer protection’. Our proposals aim to ensure these objectives are met by increasing the amount of funds that are returned and the speed with which they are returned. These extend to businesses’ funds which can support activity in the wider economy. Updated costs Summary of costs – Supplementary Regime 8.11 We have re-estimated costs to payments firms for 2 of our proposals in the supplementary regime – audits and the monthly safeguarding return. In the preceding section, we gave our response on estimates which stakeholders provided feedback on, but that we have decided not to revise. 8.12 We have estimated updated costs to firms of our audit proposals of £33.2-£75.9m with a central estimate of £53.3m, compared to our original estimate of £48m. This considers new evidence on the costs, providers and drivers. We set out in detail the methodology in Annex 2.

45 8.13 We have also updated costs related to completing the monthly safeguarding return to £2.3m from £1.2m. This is driven by additional questions for firms providing unrelated payment services. These calculations are also set out in Annex 2. 8.14 Overall, we expect total updated costs to payments firms over 10 years of £52.1-95.7m, with a central estimate of £73.2m (PV). Compared to the costs estimate in the CBA, this is between a reduction of £12.5m and increase of £30.1m, with a central estimate of £7.6m. The ranges capture uncertainty in our estimated audit costs. We expect benefits to remain unchanged in the Supplementary Regime at £137.5m (PV), leading to a positive NPV of £64.3m (central). For our proposals to break even in the central scenario, we would require compliance among failed payments firms in our baseline to reach 53%. 8.15 While we think this is likely to be achieved, even if it is not, we expect additional unquantified benefits to outweigh any realistic NPV. These unquantified benefits include: • The benefits that would arise if a large payments firm was to fail. • The benefits from reduced reconciliation requirements. • The benefits from more appropriate standards leading to increased trust in the sector. Table 1: Summary of updated costs in Supplementary Regime - central Costs Costs in CP24/20 Updated Costs Firms Audit £48m £53.3m Firms Monthly safeguarding return £1.2m £2.3m Total £55.6m

46 Chapter 9 Feedback on Equality Act considerations and our response 9.1 In our consultation, we asked the following question regarding Equality Act considerations: Question 24: What are your views on whether our proposals will materially impact any of the groups with protected characteristics under the Equality Act 2010? Feedback 9.2 Many respondents agreed the proposals increase consumer protection for everyone, regardless of background or status. There was broad consensus that the proposals do not disproportionately impact individuals with protected characteristics under the Equality Act 2010. 9.3 Some respondents gave feedback on the potential regulatory burden on smaller payments firms, especially those owned or led by women, ethnic minorities and individuals with disabilities, due to potential limited resources to comply with the new proposals. These respondents were also concerned that increased compliance requirements could lead to market consolidation and reduced competition, as smaller payments firms might exit the market due to higher costs. Some respondents suggested the new safeguarding requirements could mean that larger payments firms might pass on these compliance costs on to consumers, potentially worsening financial exclusion for economically disadvantaged people. Our response We have considered the equality and diversity issues that may arise from the proposals in this PS. Overall, we do not consider that the rules materially impact any of the groups with protected characteristics under the Equality Act 2010 (in Northern Ireland, the Equality Act is not enacted but other anti￾discrimination legislation applies). Our rules will likely have an impact on smaller payments firms which may be more likely to provide services to diaspora communities in the UK (for example money remittance services) or be led by people with protected characteristics. However, we expect our rules will protect consumers from heightened risks in current safeguarding models. This includes vulnerable consumers who are at most risk of suffering harm if their funds are not adequately safeguarded. Appropriate standards and a consistent

47 approach to safeguarding requirements will also support competition within the wider payments and e-money sector. More detailed rules will help level the playing field among payments firms, by removing inconsistencies in their approaches and giving greater clarity on the requirements.

48 Chapter 10 Changes to our Payments Services and Electronic Money Approach Document 10.1 We have published the amendments we intend to make to our Approach Document when the final rules come into effect. This includes the following: • Consequential changes to avoid inconsistency with, or duplication of, the rules and guidance in the Supplementary Regime. • Clarificatory changes on the guidance around when the safeguarding obligation starts and ends as set out in Chapter 5 above. • We will bring forward from the Post-Repeal Regime some additional guidance on when the safeguarding obligation starts and ends, as set out in Chapter 5 above. 10.2 These changes will come into effect alongside the Supplementary Regime on 7 May 2026.

49 Annex 1 List of respondents We are obliged to include a list of the names of respondents to our consultation who have consented to the publication of their name. That list of respondents for CP24/20 is as follows: Aoi Yohanes Alexnder Suriyanti API Compliance Limited Association of Professional Compliance Consultants Association of UK Payments and Fintech Companies BC Remittance Ltd BCRemit Capital on Tap Coinbase Payments Ltd Fox Williams LLP Nicholas Wilson PSP Lab LLP Ripple Markets UK VFX Financial PLC Willie Houston JR WorldRemit Limited

50 Annex 2 Cost benefit analysis detailed methodology

1. This annex sets out the detailed methodology of the updated costs for annual audits and the monthly safeguarding return. Annual audits
2. Our previous CBA assumed that a safeguarding audit conducted by a qualified auditor would cost £12,000 per year for a small payments firm, £100,000 per year for a medium payments firm, and £200,000 per year for a large payments firm. However, we also assumed that payments firms that required a statutory audit (EMIs and medium or large firms by Companies Act 2006 definitions) would already be using qualified auditors for their safeguarding audit. We therefore estimated no large payments firms and only 19 medium payments firms would face additional audit costs, as measured by our standardised cost model (SCM) definitions. In total, this led to costs to industry of £5.6m per annum, with a total of £48m over the 10-year appraisal period (PV). Many respondents said these costs were significantly lower than those they would actually face.
3. To address this feedback, we have updated our analysis in 3 ways. First, we have engaged extensively with auditors to better understand the costs payments firms may face and what determines those costs. Following this engagement, we understand that the costs of audits are related more closely to a payments firm’s complexity than its size. While these can be related, that is not always the case. Complexity can be determined by, for example, complexity of business model, number of systems and controls, jurisdictions of operation, and maturity of the payments firm’s approach to audits. Given these variables, we instead attempt to stratify payments firms into different cost brackets based on complexity and whether they are already using a qualified auditor. We then apply the costs, in ranges, they may face based on our engagement with auditors. These are set out in Table 6 below.
4. Second, as stated above, we previously assumed that all firms that completed a safeguarding audit used a qualified auditor. However, feedback indicated that many firms use compliance consultants to complete this audit. We have therefore included compliance consultants, and the move from them, in our modelling. This will increase the costs for payments firms that we assume are already completing an audit in-line with our Approach Document.
5. Third, we have taken account of the new £100k threshold for being required to arrange an audit. This means fewer payments firms will have to start arranging safeguarding audits. It also means some currently arranging safeguarding audits will no longer have to. We estimate that 118 payments firms will fall under this threshold.

51 6. Following these updates, we estimate total costs to industry over the 10-year appraisal period of £33.2–75.9m, with a central estimate of £53.3m (PV). This analysis is detailed below. Firm population 7. Our proposals will affect all EMIs, SEMIs, APIs, SPIs that choose to safeguard, and Credit Unions that issue e-money that safeguard customer funds. We do not include SPIs that choose to safeguard, as they opt-in to these rules voluntarily, and we are not aware of any Credit Unions that issue e-money. We exclude the 142 payments firms that did not report any relevant funds and will not be required to undertake an audit, so we do not expect these firms to incur any additional costs. 8. For the remaining 506 firms, we estimate complexity through a combination of available data from regulatory returns across several proxies for factors which contribute to complexity. We set out the proxies considered and the metrics they are measuring in Table 2. Table 2: Proxies considered to measure a firm’s complexity Proxy Metric Provide e-money and unrelated payment services Number of business lines Number of permissions Number of business lines Amount of relevant funds Size of firm Methods of safeguarding Systems and controls Transaction value Size of firm Transaction volume Size of firm Income Size of firm Number of agents Complexity of business model Amount of capital Size of firm Overseas safeguarding account International footprint Number of days authorised Maturity of firm 9. We rank payment firms by percentile in respect of each proxy to establish their relative standing within the population. We then average that rank across all proxies. We split payments firms into groups based on these ranks and assign them a level of complexity. Money remitters are considered ‘simple’ firms as they tend to operate relatively straightforward business models. 10. We have considered 3 different specifications of the complexity model to account for difficulties in measurement:

52 • Model 1 – Simple average across all proxies. There is some uncertainty on the validity of some proxies, as discussed in model 2, so this is not our preferred model. • Model 2 (preferred) – Does not include overseas safeguarding account or number of days authorised proxies. We have removed these as there are concerns over their accuracy as a proxy. An overseas account does not necessarily imply that the payments firms operate in that country and time authorised may not mean a payments firm has better audit controls. Due to these concerns, we prefer model 2 to model 1. • Model 3 – Narrower model considering only unrelated payment services, transaction volume, transaction value, relevant funds and income. This model is mostly related to size and is intended to be simpler, but it does not capture as many factors that may influence complexity. 11. Table 3 sets out the breakdown of payments firms on these models by complexity. The models produce broadly similar breakdowns of payments firms, with those with fewer variables tending to skew towards higher complexities. When including estimated costs, the differences are not significant between models, with model 1 being the lowest cost and model 3 the highest, estimated at £9.2m and £11m annually, respectively. Table 3: Breakdown of firms by complexity Complexity Percentile ranks Model 1 Model 2 Model 3 Simple 0-40% 255 275 268 Average 41-70% 226 190 179 Complex 71-90% 25 41 50 Very complex 91-100% 0 0 9 12. We have maintained our assumption that payments firms currently comply with the Approach Document. This means we expect payments firms that are required to obtain a statutory audit (EMIs, and PIs that are medium or large firms by the Companies Act 2006 definition) to also have a safeguarding audit. So we split the above population by EMIs, and PIs with more than £10.2m income, to determine which payments firms are likely carrying out any type of audit. This is 328 of the 506 payments firms in scope, including more of the payments firms with greater complexity, as set out in Table 4.

53 Table 4: Breakdown of firms by complexity and whether in scope of the Approach Document audit expectation (Model 2) Complexity Approach Document audit expectation No Approach Document audit expectation Simple 85 190 Average 157 33 Complex 41 0 Very complex 0 0 Total 283 223 13. However, we note that some payments firms required to have a statutory audit may be using compliance consultants to carry out their safeguarding audit and will consequently face higher costs under the Supplementary Regime. We have engaged with compliance consultants to understand the quantity and costs of safeguarding audits they carry out. 14. Based on this engagement and internal expertise, we assume these firms complete 90 audits per year in aggregate with an average cost of £15k. Assuming the firms they audit are required to complete a statutory audit, we proportionately spread the audits completed by compliance consultants across the 283 payments firms expected to arrange safeguarding audits under the Approach Document. We then apply the increased cost of using qualified auditors to these firms. Thresholds 15. To address concerns about proportionality we have introduced a threshold. If a firm does not safeguard over £100,000 of relevant funds at any point in the previous 53 weeks, it will not be required to arrange a safeguarding audit. 16. We considered many audit thresholds, some of which are set out in Table 5. We selected a threshold of £100k as a balance between risk and costs. Since 2019, we know of only one disorderly insolvency of a payments firm safeguarding under £100k with a shortfall in client funds (of £20k). So, we think that there is a relatively low risk of a high number of payments firms under this threshold entering disorderly insolvency and leading to significant shortfalls. 17. The sector has a lot of smaller payments firms that individually hold relatively small amounts of customer funds but collectively make up a significant portion of the total number of payments firms. This means that the threshold will exempt almost a quarter of payments firms holding funds but leave only £3.2m of customer funds unaudited, out of a total of exceeding £27bn. At higher thresholds, the amount and concentration of funds rises significantly, leading to a much greater risk of poor safeguarding practices putting customer funds at risk. This means that we expect the threshold will have a negligible impact on the estimated benefits.

54 Table 5: Considered audit exemption thresholds Threshold Total firms holding funds Proportion of firms holding funds Relevant funds £100,000 118 23% £3.2m £500,000 180 36% £18.3m £1,000,000 209 41% £38.2m £3,000,000 263 52% £143.9m 18. Thresholds will both limit the number of new payments firms required to audit and exempt some firms that currently audit under the Approach Document guidance. Of the 118 payments firms we expect will be below the £100k threshold, 49 would previously have been expected to audit. We assume these firms will make a saving equivalent to their estimated cost of audit. Costs of audits 19. We have based the costs of audits on our engagement with auditors. These costs are informed by both large auditors, who generally charge higher costs than other auditors, and smaller auditors. We also draw on our experiences in CASS and the lower bound of costs reported in the 2023 Baringa CASS insight survey. Table 6: Audit costs and firm complexity Complexity Large auditors Other auditors Simple £30-60k £10-18k Average £60-150k £20-30k Complex £150-250k £75-125k Very complex £250-500k £125-250k 20. We have apportioned the number of payments firms we expect to use different types of auditors based on the auditors CASS firms use. To do this, we breakdown CASS firms by Companies Act 2006 income brackets and read this across to payments firms. Table 7: Breakdown of auditors used by firm size Firm size Large auditors Other auditors Small 20% 80% Medium 56% 44% Large 91% 9%

55 21. We applied the cost ranges from Table 6 to the firm breakdowns in Table 4 and, adjusted for the increased costs of moving from compliance consultants to qualified auditors and reduced costs of firms below the threshold. This leads to annual costs to business of £3.9-8.8m, with a central estimate of £6.2m. Over the 10-year appraisal period, this leads to total costs of £33.2–75.9m, with a central estimate of £53.3m (PV). 22. Some respondents also said payments firms may face costs in making themselves 'audit-ready' and in engaging with auditors during the process. We consider that costs related to being audit-ready relate to the costs of complying with the Supplementary Regime, which is already accounted for. There may be some costs in giving auditors necessary documents and responding to their questions. This will depend on how simple it is for auditors to understand their systems and payments firms’ experience in engaging with them. We could not reliably quantify these costs with the information provided and, in any case, would expect them to be low for a firm compliant with our rules. 23. There was also concern that qualified auditors may not have the capacity to conduct audits for this many payments firms, leading to increased costs from the rise in demand. Our engagement with auditors suggested there will be sufficient capacity. We have also extended the period of time for submission of the first audit of payments firms under the Supplementary Regime to address this concern. We believe this will limit the likelihood of costs rising in response. Monthly safeguarding return 24. Payments firms that also provide unrelated payment services alongside their e-money business will be required to report information for each of these services. This will mean they will need to answer around 75% of the questions on the return twice. So, we assume that this will result in a 75% increase in the time it takes to complete the return. Applying this 75% increase in time to complete compared to the 3 hours estimated in our last CBA gives an estimated 5.25 hours per month. 25. Updating our previous analysis, we assume it will take 1 compliance professional 5.25 hours to complete the return, without board and executive sign-off required. As before, we use assumptions from our SCM on compliance professional salaries to estimate the annual cost to payments firms of completing the return. For an individual payments firm this translates to revised annual costs of approximately: • Small firm: £3,060 • Medium firm: £3,700 • Large firm: £4,000 26. There are 73 payments firms that offer both e-money and unrelated payment services, of which 13 are small, 55 are medium, and 5 are large, as sized by our SCM. So, we estimate an annual increase in cost of £264k, with a total over the 10-year appraisal period of £2.3m (PV).

56 Risks and uncertainty 27. Establishing costs and benefits before the intervention takes place is inherently uncertain and our analysis is on certain assumptions to estimate these impacts. Audits 28. As stated above, our analysis is reliant on key assumptions: • Most payments firms required to complete a statutory audit currently also use a qualified auditor for their safeguarding audit. • That auditors have sufficient capacity to undertake the required audits. 29. We have conducted breakeven analysis (the point at which these assumptions would lead to a negative NPV) to understand the margin of error for these assumptions. The NPV would be negative if: • If the cost of small auditors were the same as the upper range of the estimated costs of large auditors, or • If all 234 payments firms required to audit were using compliance consultants rather than qualified auditors. 30. We consider this is a reasonable margin of error within which our assumptions could be wrong, and the NPV would still be positive.

57 Annex 3 Abbreviations used in this paper Abbreviation Description API Authorised Payment Institution Approach Document Payment Services and Electronic Money- Our Approach CASS Client Asset Sourcebook CBA Cost Benefit Analysis The Duty Consumer Duty CP Consultation Paper CP24/20 CP24/20: Changes to the safeguarding regime for payments and e-money firms DSA Designated Safeguarding Account EMI E-money institution EMRs Electronic Money Regulations 2011 FCA Financial Conduct Authority FRC Financial Reporting Council FSCS Financial Services Compensation Scheme FSMA 2000 Financial Services and Markets Act 2000 FX Foreign Exchange IPs Insolvency Practitioners NPV Net Present Value Payment Firms Payment institutions, e-money institutions, and credit unions that issue e-money PI Payment Institutions

58 Abbreviation Description PS Policy Statement PSEAR Payments and Electronic Money Institution Insolvency Regulations 2021 PSPs Payment Service Providers PSRs Payment Services Regulations 2017 PV Present Value SCM Standardised Cost Model SEMI Small E-money Institutions SPIs Small Payment Institutions The Treasury His Majesty’s Treasury UK United Kingdom

Appendix 1 Made rules (legal instrument)

FCA 2025/38 PAYMENTS AND ELECTRONIC MONEY (SAFEGUARDING) INSTRUMENT 2025 Powers exercised A. The Financial Conduct Authority (“the FCA”) makes this instrument in the exercise of the powers and related provisions in or under: (1) the following sections of the Financial Services and Markets Act 2000 (“the Act”), including as applied by Schedule 3 to the Electronic Money Regulations 2011 (SI 2011/99) and Schedule 6 to the Payment Services Regulations 2017 (SI 2017/752): (a) section 137A (The FCA’s general rules); (b) section 137T (General supplementary powers); (c) section 138C (Evidential provisions); (d) section 139A (Power of the FCA to give guidance); and (e) section 340 (Appointment); (2) regulations 49 (Reporting requirements) and 60 (Guidance) of the Electronic Money Regulations 2011 (SI 2011/99); (3) regulations 109 (Reporting requirements) and 120 (Guidance) of the Payment Services Regulations 2017 (SI 2017/752); and (4) the rule and guidance making powers listed in Schedule 4 (Powers exercised) to the General Provisions of the FCA’s Handbook. B. The rule-making provisions listed above are specified for the purposes of section 138G(2) (Rule-making instruments) of the Act, including that provision as applied by the Electronic Money Regulations 2011 and the Payment Services Regulations 2017. Commencement C. This instrument comes into force on 7 May 2026. Amendments to the Handbook D. The modules of the FCA’s Handbook of rules and guidance listed in column (1) below are amended in accordance with the Annexes to this instrument listed in column (2). (1) (2) Glossary of definitions Annex A General Provisions (GEN) Annex B Client Assets sourcebook (CASS) Annex C Supervision manual (SUP) Annex D

FCA 2025/38 Page 2 of 116 Citation E. This instrument may be cited as the Payments and Electronic Money (Safeguarding) Instrument 2025. By order of the Board 31 July 2025

FCA 2025/38 Page 3 of 116 Annex A Amendments to the Glossary of definitions In this Annex, underlining indicates new text and striking through indicates deleted text, unless stated otherwise. Insert the following new definitions in the appropriate alphabetical position. All text is new and is not underlined. authorised custodian (in accordance with regulation 21(7) of the Electronic Money Regulations and regulation 23(18) of the Payment Services Regulations) a person authorised for the purposes of the Act to safeguard and administer investments. D+1 segregation requirement the total amount of relevant funds that should be held by a safeguarding institution in accordance with regulation 21(2) of the Electronic Money Regulations or regulation 23(6) of the Payment Services Regulations. D+1 segregation resource the sum of items A and C of a safeguarding institution’s safeguarding resource (see CASS 15.8.26R). designated system (in accordance with regulation 2(1) of the Payment Services Regulations) has the meaning given in regulation 2(1) of the Financial Markets and Insolvency (Settlement Finality) Regulations 1999 (SI 1999/2979). electronic money asset pool an asset pool relating to the issuance of electronic money and the provision of related payment services. electronic money distributor (in accordance with the definition of ‘distributor’ in regulation 2(1) of the Electronic Money Regulations) a person who distributes or redeems electronic money on behalf of an electronic money institution but who does not provide payment services on its behalf. external safeguarding reconciliation the reconciliation described in CASS 15.8.47R. funds (in CASS 15, SUP 3A and SUP 16.14A) (in accordance with regulation 2(1) of the Payment Services Regulations) banknotes and coins, scriptural money and electronic money. individual safeguarding balance the total amount of all funds the safeguarding institution should be safeguarding for a particular client (see CASS 15.8.31R). insolvency event (in accordance with regulation 22(3) of the Electronic Money Regulations and regulation 23(18) of the Payment Services

FCA 2025/38 Page 4 of 116 Regulations) any of the following procedures in relation to a safeguarding institution: (a) the making of a winding-up order; (b) the passing of a resolution for voluntary winding-up; (c) the entry of the institution into administration; (d) the appointment of a receiver or manager of the institution’s property; (e) the approval of a proposed voluntary arrangement (being a composition in satisfaction of debts or a scheme of arrangement); (f) the making of a bankruptcy order; (g) in Scotland, the award of sequestration; (h) the making of any deed of arrangement for the benefit of creditors or, in Scotland, the execution of a trust deed for creditors; (i) the conclusion of any composition contract with creditors; (j) the making of an insolvency administration order or, in Scotland, sequestration, in respect of the estate of a deceased person; (k) the entry of the institution into special administration under the PEMII Regulations; or (l) the entry of the institution into special administration under the IBSA Regulations. insurance or guarantee method the method of safeguarding relevant funds described in regulation 22 of the Electronic Money Regulations or regulation 23(12) and (13) of the Payment Services Regulations. internal safeguarding reconciliation the reconciliation described in CASS 15.8.10R. non-standard method of internal safeguarding reconciliation the method of internal safeguarding reconciliation described in CASS 15.8.36R to CASS 15.8.38R PEMII Regulations the Payment and Electronic Money Institution Insolvency Regulations 2021 (SI 2021/716). reconciliation day a business day that is not:

FCA 2025/38 Page 5 of 116 (a) a Saturday or Sunday, Christmas Day, Good Friday or a bank holiday in any part of the United Kingdom; or (b) where a reconciliation requires anything to be done by reference to a market outside the United Kingdom, any day on which that market is not normally open for business. relevant assets assets held by a safeguarding institution for the purposes of regulation 21(2)(b) of the Electronic Money Regulations or regulation 23(6)(b) of the Payment Services Regulations. relevant assets account an account held at an authorised custodian which holds relevant assets for the purposes of regulation 21(2)(b) of the Electronic Money Regulations or regulation 23(6)(b) of the Payment Services Regulations. relevant funds in accordance with regulation 20(1) of the Electronic Money Regulations and regulation 23(1) of the Payment Services Regulations: (a) funds received in exchange for electronic money that has been issued; (b) sums received from, or for the benefit of, a payment service user for the execution of a payment transaction; and (c) sums received from a payment service provider for the execution of a payment transaction on behalf of a payment service user. relevant funds bank account an account held at an approved bank or the Bank of England which: (a) holds relevant funds for the purposes of regulation 21(2)(a) of the Electronic Money Regulations or regulation 23(6)(a) of the Payment Services Regulations; or (b) is an account of the type described in regulation 21(4A) of the Electronic Money Regulations or regulation 23(9) of the Payment Services Regulations (Bank of England settlement accounts). relevant funds regime the relevant funds rules, regulations 20 to 24 of the Electronic Money Regulations and regulation 23 of the Payment Services Regulations. relevant funds rules CASS 15. relevant institution a person required to appoint an auditor under SUP 3A as specified in SUP 3A.1.1R(1)(a). safeguarding account acknowledgement letter a letter in the form of the template in CASS 15 Annex 1.

FCA 2025/38 Page 6 of 116 safeguarding institution persons required to safeguard relevant funds under regulation 20 of the Electronic Money Regulations or regulation 23 of the Payment Services Regulations (including persons that opt-in to those requirements). safeguarding requirement the total amount a safeguarding institution is required to safeguard (see CASS 15.8.29G and CASS 15.8.30R). safeguarding resource the total amount safeguarded by a safeguarding institution (see CASS 15.8.26R). safeguarding return a return containing the information specified in SUP 16 Annex 29BR. segregation method the method of safeguarding relevant funds described in regulation 21 of the Electronic Money Regulations or regulation 23(5) to (11) of the Payment Services Regulations. standard method of internal safeguarding reconciliation the method of internal safeguarding reconciliation described in CASS 15.8.26R to CASS 15.8.35R. unique identifier (in accordance with regulation 2(1) of the Payment Services Regulations) a combination of letters, numbers or symbols specified to the payment service user by the payment service provider and to be provided by the payment service user in relation to a payment transaction in order to identify unambiguously one or both of: (a) another payment service user who is a party to the payment transaction; (b) the other payment service user’s payment account. unrelated payment services asset pool an asset pool relating to the provision of payment services that are not related to the issuance of electronic money. Amend the following definitions as shown. acknowledgement letter (1) (in CASS 7) a client bank account acknowledgement letter (a letter in the form of the template in CASS 7 Annex 2R), a client transaction account acknowledgement letter (a letter in the form of the template in CASS 7 Annex 3R) or an authorised central counterparty acknowledgement letter (a letter in the form of the template in CASS 7 Annex 4R). (2) (in CASS 10A, CASS 15 and SUP 16 Annex 29BR) a safeguarding account acknowledgement letter (a letter in the form of the template in CASS 15 Annex 1).

FCA 2025/38 Page 7 of 116 acknowledgement letter fixed text … (3) … (4) (in CASS 15) the text in the acknowledgement letter in CASS 15 Annex 1 that is not in square brackets. acknowledgement letter variable text … (3) … (4) (in CASS 15) the text in the acknowledgement letter in CASS 15 Annex 1 that is in square brackets. approved bank (1) (except in COLL and CASS 15) (in relation to a bank account opened by a firm firm): … (2) (in COLL) any person falling within (a–c) and a credit institution established in an EEA State and duly authorised by the relevant Home State regulator. (3) (in CASS 15) (in accordance with the definition of ‘authorised credit institution’ in regulation 21(7) and (8) of the Electronic Money Regulations and regulation 23(18) and (19) of the Payment Services Regulations): (a) a person authorised for the purposes of the Act to carry on the activity of accepting deposits; (b) the central bank of a state that is a member of the OECD (‘an OECD state’); (c) a credit institution that is supervised by the central bank or other banking regulator of an OECD state; or (d) a credit institution that: (i) is subject to regulation by the banking regulator of a state that is not an OECD state; (ii) is required by the law of the country or territory in which it is based to provide audited accounts; (iii) has minimum net assets of £5m (or its equivalent in any other currency at the relevant time);

FCA 2025/38 Page 8 of 116 (iv) has a surplus of revenue over expenditure for the last 2 financial years; and (v) has an annual report which is not materially qualified, that is not part of the same group as the safeguarding institution. asset pool (1) (in RCB) (as defined in Regulation 1(2) of the RCB Regulations) an asset pool within the meaning of Regulation 3 of the RCB Regulations. (2) (in CASS 15) (in accordance with regulation 24(4) of the Electronic Money Regulations and regulation 23(18) of the Payment Services Regulations): (a) any relevant funds segregated in accordance with the segregation method; (b) any relevant funds held in a relevant funds bank account; (c) any funds that are received into a relevant funds bank account held at the Bank of England upon settlement in respect of transfer orders that have been entered into a designated system on behalf of payment service users, whether settlement occurs before or after the insolvency event; (d) any relevant assets held in a relevant assets account; and (e) the proceeds of an insurance policy or guarantee held for the purpose of the insurance or guarantee method. business day (1) (except in CASS 10A, CASS 15, SUP 3A, SUP 16.14A, DISP 1.6.2A and DISP 2.8) (in relation to anything done or to be done in (including to be submitted to a place in) any part of the United Kingdom): … … (3) (in CASS 10A, CASS 15, SUP 3A, SUP 16.14A, DISP 1.6.2A and DISP 2.8) (in accordance with regulation 2(1) of the Payment Services Regulations) any day on which the relevant payment service provider is open for business as required for the execution of a payment transaction. CASS resolution pack those documents and records which are specified in CASS 10.2 and CASS 10.3 or, in relation to safeguarding institutions, in CASS 10A.2 and CASS 10A.3.

FCA 2025/38 Page 9 of 116 [Editor’s note: The definition of ‘director’ takes into account the changes introduced by the Prospectus Instrument 2025 (FCA 2025/30), which comes into force on 19 January 2026.] director (1) (except in COLL, DTR, UKLR, PRM and MAR 5-A) (in relation to any of the following (whether constituted in the United Kingdom or under the law of a country or territory outside it)): … (c) (in SYSC, APER, COCON, MIPRU 2 (Responsibility for insurance distribution and MCD credit intermediation activity), CASS 10A (Payment services and electronic money: resolution pack), CASS 15 (Payment services and electronic money: relevant funds), SUP 3A (Payment services and electronic money), SUP 10A (FCA Approved persons in Appointed Representatives) and SUP 10C (FCA senior managers regime for approved persons in SMCR firms) a partnership; (d) (in SYSC, CASS 10A (Payment services and electronic money: resolution pack), CASS 15 (Payment services and electronic money: relevant funds), SUP 3A (Payment services and electronic money), SUP 10A (FCA Approved persons in Appointed Representatives) and SUP 10C (FCA senior managers regime for approved persons in SMCR firms) a sole trader; … … fund (except in CASS 15, SUP 3A and SUP 16 Annex 29BR) an AIF or a collective investment scheme. governing body the board of directors, committee of management or other governing body of a firm, safeguarding institution, relevant institution or recognised body, including, in relation to a sole trader, the sole trader. group (1) (except as specified in this definition) as defined in section 421 of the Act (Group) (in relation to a person (“A”)) A and any person who is: … … (3B) … (3C) (in CASS 10A and CASS 15) (in accordance with regulation 2(1) of the Payment Services Regulations) a group of:

FCA 2025/38 Page 10 of 116 (a) undertakings linked to each other by a relationship referred to in Article 22(1), (2) or (7) of Directive 2013/34/EU of the European Parliament and of the Council of 26th June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC; or (b) undertakings as defined in Articles 4 to 7 of Commission Delegated Regulation (EU) No. 241/2014 of 7th January 2014 supplementing Regulation (EU) 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards for Own Funds requirements for institutions, which are linked to each other by a relationship referred to in Article 113(6) of the UK CRR. internal controls the whole system of controls, financial or otherwise, established by the management of a firm or safeguarding institution in order to: (a) carry on the business of the firm or institution in an orderly and efficient manner; … (c) safeguard the assets of the firm or institution and other assets for which the firm is responsible; and (d) secure as far as possible the completeness and accuracy of the firm’s or institution’s records (including those necessary to ensure continuous compliance with the requirements or standards under the regulatory system relating to the adequacy of the firm’s or institution’s financial resources).; and (e) (in CASS 15 and SUP 3A) minimise the risk of the loss or diminution of relevant funds or relevant assets through fraud, misuse, negligence or poor administration. material outsourcing (1) (except in relation to a Solvency II firm and in SUP 3A) outsourcing services of such importance that weakness, or failure, of the services would cast serious doubt upon the firm’s continuing satisfaction of the threshold conditions or compliance with the Principles. (2) … (3) (in SUP 3A) the outsourcing of an operational function that satisfies the criteria in regulation 25(3) of the Payment Services

FCA 2025/38 Page 11 of 116 Regulations or regulation 26(3) of the Electronic Money Regulations. mixed remittance a remittance that is part client money or relevant funds and part other money or funds. regulatory system (1) … (2) in PRIN and in, BCOBS, CASS 15 and SUP 3A in addition to (1), the arrangements for regulating payment service providers and electronic money issuers in or under the Payment Services Regulations and Electronic Money Regulations, including conditions of authorisation or registration set out in those regulations, the Principles and other rules, codes and guidance, including any relevant provisions of an onshored regulation. requirement a requirement included in: (a) a firm’s Part 4A permission under section 55L(3) of the Act (Imposition of requirements by the FCA), section 55M(3) of the Act (Imposition of Requirements by the PRA) or section 55O of the Act (Imposition of requirements on acquisition of control).; or (b) a safeguarding institution’s authorisation or registration under Part 2 of the Electronic Money Regulations or Part 2 of the Payment Services Regulations. senior manager an individual other than a director: (a) who is employed by: (i) a firm or safeguarding institution; or (ii) a body corporate within a group of which the firm or safeguarding institution is a member; (b) to whom the governing body of the firm or safeguarding institution, or a member of the governing body of the firm or safeguarding institution, has given responsibility, either alone or jointly with others, for management and supervision; … shortfall … (3) … (4) (in relation to relevant funds) the amount by which the safeguarding resource is lower than the safeguarding requirement.

FCA 2025/38 Page 12 of 116 skilled person a person appointed to make a report required by section 166 (Reports by skilled persons) or section 166A (Appointment of skilled person to collect and update information) of the Act Act, including as applied by the Payment Services Regulations or the Electronic Money Regulations, for provision to the appropriate regulator and who must be a person: …

FCA 2025/38 Page 13 of 116 Annex B Amendments to the General Provisions (GEN) In this Annex, underlining indicates new text. 2 Interpreting the Handbook … 2.2 Interpreting the Handbook … Purpose 2.2.36 G … (9) In relation to persons with temporary EMI authorisation, temporary PI authorisation and temporary RAISP authorisation, the specified directions, rules and guidance in FEES 4A, 7C and 13A apply to them. In addition, in relation to those persons, rules and guidance in DISP, SUP, CASS, PRIN and BCOBS apply to them as they apply to electronic money institutions, payment institutions and registered account information service providers that are authorised or registered in the UK. … …

FCA 2025/38 Page 14 of 116 Annex C Amendments to the Client Assets sourcebook (CASS) In this Annex, underlining indicates new text and striking through indicates deleted text, unless stated otherwise. 1 Application and general provisions 1.1 Application and purpose Application 1.1.1 R CASS applies to a firm, electronic money institution or payment institution as specified in the remainder of this chapter. … 1.2 General application: who? what? General application: who? … 1.2.2 R … 1.2.2A R This chapter, CASS 10A and CASS 15 apply to an electronic money institution, a payment institution or a credit union with respect to: (1) the issuance of electronic money; and (2) the provision of payment services. … Investments and money held under different regimes 1.2.11 R … (3) … (4) A firm must not keep funds in respect of which CASS 15 applies in a client bank account held for the purpose of any other chapter of CASS. … 1.3 General application: where? 1.3.1 G … 1.3.1A G The territorial scope of CASS 15 is set out in CASS 15.1.3R.

FCA 2025/38 Page 15 of 116 … 1.5 Application: electronic media and E-Commerce Application to electronic media … 1.5.3 G … 1.5.3A G In this section, references to a firm should be read as including a safeguarding institution. … Insert the following new chapter, CASS 10A, after CASS 10 (CASS resolution pack). All the text is new and is not underlined. 10A Payment services and electronic money: resolution pack 10A.1 Application, purpose and general provisions Application 10A.1.1 R This chapter applies to a safeguarding institution when it receives or holds relevant funds in accordance with CASS 15. Purpose 10A.1.2 G The purpose of the CASS resolution pack is to ensure that a safeguarding institution maintains and is able to retrieve information that would: (1) in the event of its insolvency, assist an insolvency practitioner in achieving a timely return of relevant funds held by the safeguarding institution to its clients; (2) in the event of a firm’s resolution, assist the Bank of England or FSCS; and (3) in either case, assist the FCA. General provisions 10A.1.3 R A safeguarding institution must maintain and be able to retrieve, in the manner described in this chapter, a CASS resolution pack. 10A.1.4 G A safeguarding institution is required to maintain a CASS resolution pack at all times when CASS 10A.1.1R applies to it. 10A.1.5 G (1) The rules in this chapter specify the types of documents and records that must be maintained in a safeguarding institution’s

FCA 2025/38 Page 16 of 116 CASS resolution pack and the retrieval period for the pack. The safeguarding institution should maintain the component documents of the CASS resolution pack in order for them to be retrieved in accordance with CASS 10A.1.7R and should not use the retrieval period to start producing these documents. (2) The contents of the documents that constitute the CASS resolution pack will change from time to time (for example, because reconciliations must be included in the pack). (3) A safeguarding institution is only required to retrieve the CASS resolution pack in the circumstances prescribed in CASS 10A.1.7R. 10A.1.6 R For the purpose of this chapter, a safeguarding institution will be treated as satisfying a rule in this chapter requiring it to include a document in its CASS resolution pack if a member of that safeguarding institution’s group includes that document in its own CASS resolution pack, provided that: (1) that group member is subject to the same rule; and (2) the safeguarding institution is still able to comply with CASS 10A.1.7R. 10A.1.7 R In relation to each document in its CASS resolution pack, a safeguarding institution must: (1) put in place adequate arrangements to ensure that an administrator, receiver, trustee, liquidator or analogous officer appointed in respect of it, or any material part of its property, is able to retrieve each document as soon as practicable and in any event within 48 hours of that officer’s appointment; and (2) ensure that it is able to retrieve each document as soon as practicable, and in any event within 48 hours, where it has taken a decision to do so or as a result of an FCA or Bank of England request. 10A.1.8 R Where documents are held by members of a safeguarding institution’s group in accordance with CASS 10A.1.6R, the safeguarding institution must have adequate arrangements in place with its group members which allow for delivery of the documents within the timeframe referred to in CASS 10A.1.7R. 10A.1.9 E (1) For the purpose of CASS 10A.1.7R, the following documents and records should be retrievable immediately: (a) the document(s) identifying the institutions referred to in CASS 10A.2.1R(2) and CASS 10A.2.1R(4);

FCA 2025/38 Page 17 of 116 (b) any acknowledgement letters referred to in CASS 10A.2.1R(3); (c) a copy of each policy or guarantee referred to in CASS 10A.2.1R(5); (d) the document identifying individuals pursuant to CASS 10A.2.1R(10); and (e) the most recent internal safeguarding reconciliation and external safeguarding reconciliation records referred to in CASS 10A.3.1R(1)(c). (2) Where a safeguarding institution is reliant on the continued operation of certain systems for the provision of component documents in its CASS resolution pack, it should have arrangements in place to ensure that these systems will remain operational and accessible to it after its insolvency. (3) Contravention of (1) or (2) may be relied upon as tending to establish contravention of CASS 10A.1.7R. 10A.1.10 G Where a safeguarding institution anticipates that it might be the subject of an insolvency order, it is likely to have sought advice from an external adviser. The safeguarding institution should make the CASS resolution pack available promptly, on request, to such an adviser. 10A.1.11 R (1) A safeguarding institution must ensure that it reviews the content of its CASS resolution pack on an ongoing basis to ensure that it remains accurate. (2) In relation to any change of circumstances that has the effect of rendering inaccurate, in any material respect, the content of a document specified in CASS 10A.2.1R, a safeguarding institution must ensure that any inaccuracy is corrected promptly and, in any event, no more than 5 business days after the change of circumstances arose. 10A.1.12 G For the purpose of CASS 10A.1.11R(2), an example of a change that would render a document inaccurate in a material respect is a change of institution identified pursuant to CASS 10A.2.1R(2). 10A.1.13 G A safeguarding institution may hold in electronic form any document in its CASS resolution pack provided that it continues to be able to comply with CASS 10A.1.7R and CASS 10A.1.11R in respect of that document. 10A.1.14 R A safeguarding institution must ensure that its governing body receives a report in respect of compliance with the rules in this chapter at least annually.

FCA 2025/38 Page 18 of 116 10A.1.15 R A safeguarding institution must notify the FCA in writing immediately if it has not complied with, or is unable to comply with, CASS 10A.1.3R. 10A.2 Core content requirements 10A.2.1 R A safeguarding institution must include within its CASS resolution pack: (1) a master document containing information sufficient to retrieve each document in the institution’s CASS resolution pack; (2) a document which identifies the institutions the safeguarding institution has appointed (including through an agent or electronic money distributor): (a) for the receipt or holding of relevant funds; and (b) for the holding of relevant assets; (3) for each institution identified in (2), a copy of each executed agreement, including any side letters or other agreements used to clarify or modify the terms of the executed agreement, between that institution and the safeguarding institution that relates to the holding of relevant funds or relevant assets including any acknowledgement letters sent or received pursuant to CASS 15.7; (4) a document which identifies the institutions the safeguarding institution has appointed to provide insurance or a guarantee in accordance with regulation 22 of the Electronic Money Regulations or regulation 23(12) of the Payment Services Regulations; (5) for each institution identified in (4), a copy of each executed policy or guarantee, including any side letters or other agreements used to clarify or modify the terms of the executed policy or guarantee; (6) a document which identifies each agent or electronic money distributor of the safeguarding institution; (7) a document which: (a) identifies each member of the safeguarding institution’s group involved in operational functions related to the relevant funds regime; and (b) for each group member identified in (a), the type of entity (such as branch, subsidiary or nominee company) the group member is, its jurisdiction of incorporation if applicable, and a description of its related operational functions;

FCA 2025/38 Page 19 of 116 (8) a document which: (a) identifies each third party which the safeguarding institution uses for the performance of operational functions related to the relevant funds regime; (b) describes how to gain access to relevant information held by that third party; and (c) describes how to affect a transfer of any relevant funds or relevant assets held by the safeguarding institution, but controlled by that third party; (9) a copy of the safeguarding institution’s procedures for the management, recording and transfer of the relevant funds and relevant assets that it holds; and (10) a document which identifies: (a) each senior manager and director and any other individual and the nature of their responsibility within the safeguarding institution who is critical or important to the performance of operational functions related to any of the safeguarding obligations imposed on the institution by the relevant funds regime; and (b) the individual to whom responsibility for operational oversight has been allocated under CASS 15.2.4R. 10A.2.2 G For the purpose of CASS 10A.2.1R(10)(a), examples of individuals within the safeguarding institution who are critical or important to the performance of operational functions include: (1) those necessary to carry out internal safeguarding reconciliations, external safeguarding reconciliations and record checks; and (2) those in charge of client documentation for business involving relevant funds and relevant assets. 10A.2.3 R For the purpose of CASS 10A.2.1R(2), a safeguarding institution must ensure that the document records: (1) the full name of the individual institution in question; (2) the postal address, email address and telephone number of that institution; and (3) the numbers of all accounts opened by that safeguarding institution with that institution. 10A.3 Existing records forming part of the CASS resolution pack

FCA 2025/38 Page 20 of 116 10A.3.1 R A safeguarding institution must include, as applicable, within its CASS resolution pack: (1) the records required under: (a) CASS 15.4.11R (Appointment of a third party to manage relevant assets) and CASS 15.6.7 (Selection and appointment of third parties); (b) CASS 15.8.3R and CASS 15.8.8R (Records and accounts); and (c) CASS 15.8.9R (Records and accounts); (2) the policies and procedures referred to in CASS 15.8.1R (Policies and procedures); and (3) the standard terms and conditions incorporated into its contracts with clients. 10A.3.2 G CASS 10.3.1R does not change the record keeping requirements of the rules referred to therein. Insert the following new chapter, CASS 15, after CASS 14 (Temporary permissions regime – client assets rules). All the text is new and is not underlined. 15 Payment services and electronic money: relevant funds 15.1 Purpose and application General purpose 15.1.1 G Regulation 20 of the Electronic Money Regulations and regulation 23 of the Payment Services Regulations require safeguarding institutions to safeguard relevant funds. The rules and guidance in this chapter supplement those requirements. Who? 15.1.2 R This chapter applies to the following persons that receive or hold relevant funds: (1) authorised payment institutions; (2) small payment institutions that voluntarily safeguard under regulation 23 of the Payment Services Regulations; (3) electronic money institutions; and (4) credit unions that issue electronic money.

FCA 2025/38 Page 21 of 116 What? Where? 15.1.3 R This chapter applies with respect to the provision of payment services or issuance of electronic money that is within the scope of the Payment Services Regulations or Electronic Money Regulations. 15.1.4 G PERG 15 provides guidance on the territorial scope of the Payment Services Regulations. Funds received by safeguarding institutions that relate to transactions that are not in scope of the Payment Services Regulations or Electronic Money Regulations do not need to be safeguarded and, where the safeguarding institution uses the segregation method, such funds must be kept separate from relevant funds. 15.1.5 G One of the effects of CASS 15.1.3R is that CASS 15 does not apply where payment services are being provided to both the payer and the payee from outside of the UK (eg, a transfer between an account operated by a PSP from a branch in Japan to an account operated by another PSP from a branch in Hong Kong). Funds received for these transactions should not be mixed with relevant funds, even if funds are routed through a correspondent PSP in the UK. 15.1.6 G (1) Electronic money institutions and credit unions may execute payment transactions that are not related to the issuance of electronic money. They must safeguard relevant funds relating to such transactions separately to relevant funds relating to the issuance of electronic money, and should apply the provisions of CASS 15 accordingly. (2) Paragraph (1) will be relevant where the safeguarding institution provides payment services that are independent from its electronic money products. The requirement to separately safeguard relevant funds will not apply where the safeguarding institution simply transfers funds from an electronic money account, such as where a customer uses electronic money to pay a bill. Opt in to the relevant funds regime 15.1.7 R If a small payment institution makes an election pursuant to regulation 23(16) of the Payment Services Regulations to voluntarily safeguard, the rules and guidance in this chapter will apply to the small payment institution as if it were an authorised payment institution. 15.1.8 R If a small electronic money institution or a credit union makes an election pursuant to regulation 23(16) of the Payment Services Regulations, as applied by regulation 20(6) of the Electronic Money Regulations, to voluntarily safeguard, the rules and guidance in this chapter will apply to the small electronic money institution or credit union as if it were an authorised electronic money institution. 15.2 Organisational requirements Protection of relevant funds

FCA 2025/38 Page 22 of 116 15.2.1 R A safeguarding institution must, when holding relevant funds, maintain adequate arrangements to safeguard the client’s rights and prevent the use of relevant funds for its own account. 15.2.2 G An effect of CASS 15.2.1R is that a safeguarding institution should consider how to clearly identify relevant funds that are not held in a relevant funds bank account. That includes those segregated in accordance with regulation 21(1) of the Electronic Money Regulations or regulation 23(5) of the Payment Services Regulations but not yet placed in a relevant funds bank account. The word ‘safeguarding’ should be included in account names wherever possible. 15.2.3 R A safeguarding institution that is also a firm subject to other chapters of CASS must ensure it has adequate policies and procedures in place to identify and determine under which activity it is holding funds. Requirement to have adequate oversight 15.2.4 R A safeguarding institution must allocate to a single director or senior manager of sufficient skill and authority responsibility for: (1) oversight of the institution’s operational compliance with the relevant funds regime; and (2) reporting to the institution’s governing body in respect of that oversight. Allocation of relevant funds receipts 15.2.5 R (1) A safeguarding institution must allocate any relevant funds it receives to an individual client: (a) promptly and in a way that enables it to meet its obligations under the Payment Services Regulations and, where relevant, its obligations under the Electronic Money Regulations; and (b) in any case, no later than the end of the business day following the day of receipt (or where, after the receipt of funds, it has identified that the funds, or some of them, are relevant funds under CASS 15.2.9R, no later than the end of the business day following that identification). (2) Pending a safeguarding institution’s allocation of a relevant funds receipt to an individual client under (1), it must record the received relevant funds in its books and records as ‘unallocated relevant funds’. 15.2.6 G CASS 15.2.1R requires a safeguarding institution to promptly identify the client to whom a relevant funds receipt relates. Once identified, the receipt of relevant funds must be recorded and allocated to the client in the safeguarding institution’s accounts. Where the crediting of these accounts

FCA 2025/38 Page 23 of 116 amounts to the crediting of a payment account, it must be carried out within the time periods required by the Payment Services Regulations. 15.2.7 G Where the safeguarding institution receives relevant funds on behalf of a payee who does not have a payment account with the safeguarding institution, the relevant funds may need to be allocated immediately so that they can be made available to the payee immediately after they have been credited to the safeguarding institution’s account in accordance with regulation 87 of the Payment Services Regulations. 15.2.8 G Where the receipt of relevant funds relates to the issuance of electronic money, the relevant funds may need to be allocated without delay so that the safeguarding institution can comply with its obligation to issue electronic money without delay under regulation 39 of the Electronic Money Regulations. Unidentified receipts of funds 15.2.9 R If a safeguarding institution receives funds (whether in a relevant funds bank account or another account) which it is unable to immediately identify as relevant funds or other funds, it must: (1) take all necessary steps to identify the funds as either relevant funds or other funds; and (2) record the funds in its books and records as ‘unidentified relevant funds’ while it performs the necessary steps under (1). 15.2.10 G CASS 15.2.5R and CASS 15.2.9R recognise that it might not always be possible to identify whether funds are relevant funds and, if they are, the client to which they relate. Where a safeguarding institution is able to identify that the funds have been received from a client to execute a payment transaction or in exchange for electronic money but is unable to identify the client entitled to the funds it has received (for example, because they do not have the correct unique identifier), the funds must still be treated as relevant funds and recorded as ‘unallocated relevant funds’. 15.2.11 G If a safeguarding institution is unable to identify funds that it has received as either relevant funds or other funds, it should consider whether it would be appropriate to return the funds to the person who sent them (or, if that is not possible, to the source from where it was received – for example, the bank). 15.2.12 G A safeguarding institution should have regard to its obligations under the Electronic Money Regulations and Payment Services Regulations when considering whether to return funds under CASS 15.2.11G. 15.2.13 G Where a payment service user provides an incorrect unique identifier, the safeguarding institution will also need to consider the steps it is required to take under regulation 90 of the Payment Services Regulations.

FCA 2025/38 Page 24 of 116 15.3 The segregation method 15.3.1 G (1) The segregation method is the method of safeguarding relevant funds described in regulation 21 of the Electronic Money Regulations or regulations 23(5) to (11) of the Payment Services Regulations. (2) An effect of regulation 20(6) of the Electronic Money Regulations is that where an electronic money institution or credit union receives relevant funds for the execution of payment transactions that are not related to the issuance of electronic money, it must keep those funds segregated from relevant funds relating to the issuance of electronic money. Mixed remittance 15.3.2 R A safeguarding institution that receives mixed remittances must maintain a written policy for the purpose of demonstrating its approach to complying with regulation 20(3) of the Electronic Money Regulations and regulation 23(2) of the Payment Services Regulations. Segregation in a different currency 15.3.3 R A safeguarding institution that segregates relevant funds in a different currency from that in which they were received or in which the safeguarding institution is liable to the relevant client must ensure that the amount held is adjusted each day on which it performs an internal safeguarding reconciliation to an amount at least equal to the original currency amount (or currency in which the safeguarding institution has its liability to its clients, if different), calculated at the previous day’s closing spot exchange rate. 15.4 Segregation: secure, liquid assets 15.4.1 G (1) Regulation 21(2)(b) of the Electronic Money Regulations provides that safeguarding institutions may invest relevant funds received in exchange for electronic money in secure, liquid, low-risk assets. Assets are liquid if approved as such by the FCA. (2) Regulation 23(6)(b) of the Payment Services Regulations provides that safeguarding institutions may invest relevant funds received for the execution of payment transactions unrelated to the issuance of electronic money in such secure, liquid assets as the FCA may approve. 15.4.2 G Subject to CASS 15.4.3G, the FCA has approved the following assets for the purposes of regulation 21(2)(b) of the Electronic Money Regulations and regulation 23(6)(b) of the Payment Services Regulations: (1) items that fall into one of the categories set out in Article 114 of the UK CRR for which the specific risk capital charge is no higher than 0%; or

FCA 2025/38 Page 25 of 116 (2) units in a UCITS which invests solely in the assets in (1). 15.4.3 G The FCA may, in exceptional circumstances, determine that an asset falling within CASS 15.4.2G is not secure and liquid. 15.4.4 R Where a safeguarding institution wishes to seek approval of assets that do not fall within CASS 15.4.2G, it must submit an application in writing to the FCA that demonstrates: (1) how the consumer protection objective of safeguarding will be met by investing in the assets in question; and (2) how liquidity risks will be managed. 15.4.5 R A safeguarding institution must take reasonable steps to ensure that investment in relevant assets conforms with the general principles and conditions in CASS 15.4.6R and CASS 15.4.7R. 15.4.6 R The general principles which must be followed are: (1) there must be a suitable spread of investments; (2) investments must be made in accordance with an appropriate liquidity strategy; (3) the investments must be in accordance with an appropriate credit risk policy; (4) any foreign exchange risks must be prudently managed; and (5) the policies and procedures for complying with the general principles in (1) to (4) must be reviewed at least annually. 15.4.7 R The general conditions which must be satisfied in the segregation of relevant assets are: (1) subject to (2), any redemption of an investment must be by payment into a relevant funds bank account of the safeguarding institution; and (2) where a safeguarding institution appoints a third party to manage the relevant assets, the mandate should provide for the proceeds from the sale of any relevant assets to be promptly reinvested in other relevant assets or paid into the safeguarding institution’s relevant funds bank account. Appointment of a third party to manage relevant assets 15.4.8 R A safeguarding institution may only appoint a third party to manage relevant assets if the third party is a firm with permission to carry out the regulated activity of managing investments.

FCA 2025/38 Page 26 of 116 15.4.9 R A safeguarding institution that appoints a third party to manage relevant assets must: (1) exercise all due skill, care and diligence in the selection, appointment, and periodic review of the third party and the arrangements for managing the relevant assets; (2) ensure that the mandate given to the third party prevents the third party from making investment decisions that are inconsistent with the Electronic Money Regulations, the Payment Services Regulations or the requirements in this chapter; and (3) ensure that the arrangements with the third party require the third party to provide the safeguarding institution with information on the number of relevant assets held. Such information should be provided or made available at least every business day and relate to the close of business on the previous business day. 15.4.10 R When a safeguarding institution makes the selection, the appointment and conducts the periodic review of the third party it must take into account the expertise and market reputation of the third party with a view to ensuring the protection of clients’ rights. 15.4.11 R (1) A safeguarding institution must make a record of: (a) the grounds upon which it satisfies itself as to the appropriateness of its selection and appointment of a third party under CASS 15.4.8R and CASS 15.4.9R; and (b) each periodic review of its selection and appointment of a third party under CASS 15.4.8R, its considerations and conclusions. (2) A record under (1) must be made on the date the selection is made or the review completed (as the case may be). 15.4.12 R A safeguarding institution that appoints a third party pursuant to CASS 15.4.8R remains responsible for ensuring that the relevant funds are only invested in accordance with the relevant funds regime. 15.4.13 G A safeguarding institution is not required to appoint a third party to manage relevant assets but, if it does, it must comply with CASS 15.4.8R. 15.5 The insurance or guarantee method Application 15.5.1 R This section applies when a safeguarding institution elects to protect some or all relevant funds using the insurance or guarantee method. Using an insurance policy

FCA 2025/38 Page 27 of 116 15.5.2 R A safeguarding institution can protect relevant funds through an insurance policy if the policy complies with the conditions in CASS 15.5.4R. Using a guarantee 15.5.3 R A safeguarding institution can protect relevant funds through a guarantee if the guarantee complies with the conditions in CASS 15.5.4R. General conditions: insurance policy and guarantee 15.5.4 R The conditions are: (1) the proceeds of the insurance policy or guarantee must be payable upon an insolvency event of the safeguarding institution; (2) there must be no condition or restriction on the prompt paying out of the insurance or guarantee, other than the certification of the insolvency event; (3) a certification requirement for the purposes of (2) must be no more onerous than is practically necessary; (4) the terms of the insurance policy or guarantee must provide for the proceeds of the insurance policy or guarantee to be promptly paid into a relevant funds bank account of the safeguarding institution; and (5) the terms of the insurance policy or guarantee must not permit or enable the provider to cancel the policy or guarantee prior to its expiry, unless: (a) such cancellation is due to the non-payment of the premium; and (b) the provider has given the safeguarding institution and the FCA at least 3 months’ notice of its decision to cancel the policy or guarantee. 15.5.5 G (1) An effect of CASS 15.5.4R is that the insurance policy or guarantee must pay out the full amount of any claim regardless of why the insolvency event occurs. This includes, but is not limited to, where the insolvency event is caused by: (a) any fraud or negligence on the part of the safeguarding institution or any of its directors, employees or agents; or (b) something outside the control of the safeguarding institution. (2) CASS 15.5.4R also means that there must be no level below which the insurance policy or guarantee does not pay out.

FCA 2025/38 Page 28 of 116 (3) CASS 15.5.4R(4) requires the proceeds of an insurance policy or guarantee to be payable into a relevant funds bank account. In practice, this means that the safeguarding institution will need to maintain such an account at least for the full term of the insurance policy or guarantee. 15.5.6 G A safeguarding institution may use more than one insurance policy or guarantee, or a combination of insurance policies and guarantees. However, the effect of the condition in CASS 15.5.4R(2) is that the terms of each insurance policy or guarantee must not enable the insurer or guarantor to refuse to pay out, in whole or in part, on the basis that relevant funds are covered by another insurer or guarantor. Notification 15.5.7 R A safeguarding institution must notify the FCA at least 2 months before it intends to: (1) rely on the insurance or guarantee method for the first time; (2) change the amount of cover provided by its insurance policies or guarantees; or (3) change its insurer or guarantor. 15.5.8 R The notification under CASS 15.5.7R must set out: (1) the person providing the insurance policy or guarantee; (2) how the insurance policy or guarantee complies with the conditions in CASS 15.5.4R; (3) when the insurance policy or guarantee expires, and if it renews automatically; (4) whether the safeguarding institution has alternative arrangements in place instead of renewal; (5) an assessment by the safeguarding institution as to whether the use of the insurance or guarantee method or the change to the safeguarding arrangements will lead to any increase in operational risk; (6) an explanation of how the assessment in (5) was carried out; and (7) a statement as to how the safeguarding institution will mitigate any increased operational risk. 15.5.9 G The assessment referred to in CASS 15.5.8R(5) should consider operational risks such as:

FCA 2025/38 Page 29 of 116 (1) the insurance policy or guarantee not being extended or renewed, and the safeguarding institution not: (a) being able to find an alternative insurer or guarantor; or (b) having sufficient liquid assets to safeguard using the segregation method on the expiry of the insurance policy or guarantee; and (2) adverse impacts on the institution’s short-term liquidity caused by restrictions on accessing funds that would otherwise be available if they were protected using the segregation method, contrary to regulation 6(5) of the Electronic Money Regulations and regulation 6(6) of the Payment Services Regulations. Expiration of the insurance policy or guarantee 15.5.10 R A safeguarding institution must: (1) decide whether it intends to continue to use the insurance or guarantee method in good time and at least 3 months before the expiry of its existing insurance policy or guarantee; and (2) notify the FCA of its decision. 15.5.11 G If a safeguarding institution decides to continue to use the insurance or guarantee method, but there are changes to the insurer or guarantor, or to the amount of the cover, it will also need to comply with CASS 15.5.7R. 15.5.12 G A safeguarding institution should decide whether to continue using the insurance or guarantee method in good time before the expiry of the policy or guarantee. In practice, this means that a decision should be made while there is sufficient time to enable the safeguarding institution to make alternative arrangements to meet its obligations to customers. The greater the amount of cover provided by the insurance or guarantee method, the sooner a decision should be made. The safeguarding institution should keep the FCA informed at all stages in accordance with Principle 11. 15.5.13 R CASS 15.5.14R applies where a safeguarding institution: (1) has less than 3 months remaining on an insurance policy or guarantee taken out for the purposes of safeguarding by the insurance or guarantee method; and (2) does not have a replacement for, or renewal of, the insurance policy or guarantee in place. 15.5.14 R The safeguarding institution must: (1) make a plan as to how it will use the segregation method to safeguard the funds that would have been protected by the insurance policy or

FCA 2025/38 Page 30 of 116 guarantee if that policy or guarantee had been renewed or replaced; and (2) provide the FCA with the plan referred to in (1). 15.5.15 G If the safeguarding institution is a small payment institution, small electronic money institution or a credit union that voluntarily safeguards under regulation 23 of the Payment Services Regulations (including as applied by regulation 20(6) of the Electronic Money Regulations) it may, alternatively, cancel its election to safeguard. 15.5.16 G (1) If a safeguarding institution is unable to use the segregation method to protect funds that were previously covered by an insurance policy or guarantee, it should consider its financial position and take any appropriate steps (such as placing itself into administration) in good time before the lapse of the policy or guarantee so that a claim can be made. (2) Where a safeguarding institution is required to safeguard, it is a condition of its authorisation or registration that it takes adequate measures for the purpose of doing so. If it does not have adequate measures in place to protect relevant funds in good time before the expiry of an insurance policy or guarantee, the FCA may consider whether it is appropriate to use its supervision powers to protect the interests of clients, including, but not limited to, its powers to apply to court to appoint an insolvency practitioner. 15.6 Selection and appointment of third parties 15.6.1 R (1) A safeguarding institution must exercise all due skill, care and diligence: (a) in the selection, appointment, and periodic review of third parties that provide: (i) accounts where relevant funds are received, deposited or otherwise held; (ii) accounts where relevant assets are deposited or otherwise held; or (iii) insurance or a guarantee for the purpose of the insurance or guarantee method; and (b) in the arrangements for the holding or protection of relevant funds or relevant assets. (2) The safeguarding institution must consider the need for diversification as part of its due diligence under (1).

FCA 2025/38 Page 31 of 116 15.6.2 G Safeguarding institutions should ensure that their consideration of a third party focuses on the specific legal entity in question and not simply that person’s group as a whole. 15.6.3 R When a safeguarding institution makes the selection, the appointment and conducts the periodic review of a third party, it must take into account: (1) the expertise and market reputation of the third party with a view to ensuring the protection of clients’ rights; and (2) any legal or regulatory requirements or market practices relating to the holding of relevant funds or relevant assets or the provision of insurance or a guarantee that could adversely affect clients’ rights. 15.6.4 G In complying with CASS 15.6.3R, a safeguarding institution should consider, as appropriate, together with any other relevant matters: (1) the capital of the third party; (2) the amount of relevant funds or relevant assets placed, insured or guaranteed as a proportion of the third party’s capital and (where relevant) deposits; (3) the extent to which relevant funds or relevant assets that the safeguarding institution deposits or holds with any third party would be protected under a deposit protection scheme or other compensation scheme; (4) the creditworthiness of the third party; (5) to the extent that the information is available, the level of risk in the investment and loan activities undertaken by the third party and affiliated companies; and (6) the arrangements referred to in CASS 15.2.1R (Protection of relevant funds). 15.6.5 R A safeguarding institution must: (1) periodically review whether it is appropriate to diversify (or further diversify) the third parties with which it deposits, holds, invests, insures or guarantees some or all of the relevant funds it is required to safeguard; and (2) whenever it concludes that it is appropriate to do so, make adjustments accordingly to the third parties it uses and to the amounts of relevant funds or relevant assets deposited or held with them or covered by them.

FCA 2025/38 Page 32 of 116 15.6.6 G In complying with the requirement in CASS 15.6.5R to periodically review whether diversification (or further diversification) is appropriate, a safeguarding institution should have regard to: (1) whether it would be appropriate to deposit relevant funds in relevant funds bank accounts opened at a number of different approved banks; (2) whether it would be appropriate to limit the amount of relevant funds or relevant assets the safeguarding institution holds with third parties that are in the same group as each other; (3) whether risks arising from the safeguarding institution’s business model create any need for diversification (or further diversification); (4) the market conditions at the time of the review; (5) the outcome of any due diligence carried out in accordance with CASS 15.6.1R; and (6) the arrangements referred to in CASS 15.2.1R (Protection of relevant funds). 15.6.7 R (1) A safeguarding institution must make a record of: (a) the grounds upon which it satisfies itself as to the appropriateness of its selection and appointment of a third party under CASS 15.6.1R; (b) each periodic review of its selection and appointment of a third party under CASS 15.6.1R, its considerations and conclusions; and (c) each periodic review that it conducts under CASS 15.6.5R, its considerations and conclusions. (2) A record under (1) must be made on the date the selection is made or the review completed (as the case may be). 15.7 Acknowledgement letters 15.7.1 G The main purposes of an acknowledgement letter are: (1) to put third parties on notice of a safeguarding institution’s client’s interests in relevant funds or relevant assets that have been deposited or invested with them; (2) to ensure that a relevant funds bank account or relevant assets account has been opened in accordance and in compliance with the relevant funds regime, and is distinguished from any account containing funds or assets that are not relevant funds or relevant assets; and

FCA 2025/38 Page 33 of 116 (3) to ensure that a third party understands and agrees that it will not have any recourse or right against funds or assets standing to the credit of a relevant funds bank account or relevant assets account in respect of any liability of the safeguarding institution to the third party (or a person connected to the third party), except to the extent provided for by the Electronic Money Regulations or the Payment Services Regulations, as the case may be. Requirement for, and content of, safeguarding account acknowledgement letters 15.7.2 R CASS 15.7.3R does not apply to the type of relevant funds bank account specified in regulation 21(4A) of the Electronic Money Regulations or regulation 23(9) of the Payment Services Regulations (Bank of England settlement accounts). 15.7.3 R For each relevant funds bank account, a safeguarding institution must complete and sign a safeguarding account acknowledgement letter clearly identifying the relevant funds bank account and send it to the approved bank with which the relevant funds bank account is, or will be, opened, requesting the bank to acknowledge and agree to the terms of the letter by countersigning it and returning it to the safeguarding institution. 15.7.4 R For each relevant assets account, a safeguarding institution must complete and sign a safeguarding account acknowledgement letter clearly identifying the relevant assets account and send it to the firm with which the relevant assets account is, or will be, opened, requesting the firm to acknowledge and agree to the terms of the letter by countersigning it. Safeguarding account acknowledgement letters template 15.7.5 R In drafting acknowledgement letters under CASS 15.7, a safeguarding institution must use the template in CASS 15 Annex 1. 15.7.6 R When completing an acknowledgement letter, a safeguarding institution: (1) must not amend any of the acknowledgement letter fixed text; (2) subject to (3), must ensure the acknowledgement letter variable text is removed, included or amended as appropriate; and (3) must not amend any of the acknowledgement letter variable text in a way that would alter or otherwise change the meaning of the acknowledgement letter fixed text. 15.7.7 G CASS 15 Annex 2 contains guidance on using the template for acknowledgement letters, including guidance on when and how safeguarding institutions should amend the acknowledgement letter variable text that is in square brackets. Countersignature of safeguarding account acknowledgement letters

FCA 2025/38 Page 34 of 116 15.7.8 R (1) If, on countersigning and returning the acknowledgement letter to a safeguarding institution, the relevant person has also made amendments to: (a) any of the acknowledgement letter fixed text; or (b) any of the acknowledgement letter variable text in a way that would alter or otherwise change the meaning of the acknowledgement letter fixed text, the acknowledgement letter will have been inappropriately redrafted and no longer comply with CASS 15.7.6R. (2) Amendments made to the acknowledgement letter variable text in the acknowledgement letter returned to a safeguarding institution by the relevant person will not have the result that the letter has been inappropriately redrafted if those amendments: (a) do not affect the meaning of the acknowledgement letter fixed text; (b) have been specifically agreed with the safeguarding institution; and (c) do not cause the acknowledgement letter to be inaccurate. 15.7.9 R A safeguarding institution must use reasonable endeavours to ensure that any individual that has countersigned an acknowledgement letter that has been returned to the safeguarding institution was authorised to countersign the letter on behalf of the relevant person. 15.7.10 R A safeguarding institution must retain each countersigned acknowledgement letter it receives from the date of receipt until the expiry of a period of 5 years starting on the date on which the last account to which the acknowledgement letter relates is closed. 15.7.11 R A safeguarding institution must also retain any other documentation or evidence it believes is necessary to demonstrate that it has complied with each of the applicable requirements in this section (such as any evidence it has obtained to ensure that the individual that has countersigned an acknowledgement letter that has been returned to the safeguarding institution was authorised to countersign the letter on behalf of the relevant person). Review and replacement of safeguarding account acknowledgement letters 15.7.12 R A safeguarding institution must periodically (at least annually, and whenever it becomes aware that something referred to in an acknowledgement letter has changed) review each of its countersigned acknowledgement letters to ensure that they remain accurate.

FCA 2025/38 Page 35 of 116 15.7.13 R Whenever a safeguarding institution finds a countersigned acknowledgement letter contains an inaccuracy, the safeguarding institution must promptly draw up a replacement acknowledgement letter and request that the new acknowledgement letter is duly countersigned and returned by the relevant person. 15.7.14 G Under CASS 15.7.13R, a safeguarding institution should draw up a replacement acknowledgement letter whenever: (1) there has been a change in any of the parties’ names or addresses or a change in any of the details of the relevant account(s) as set out in the letter; or (2) it becomes aware of an error or misspelling in the letter. 15.7.15 R If a safeguarding institution’s relevant funds bank account or relevant assets account is transferred to another person, the safeguarding institution must promptly draw up a new acknowledgement letter under CASS 15.7 and request that the new acknowledgement letter is duly countersigned and returned by the relevant person. 15.8 Records, accounts and reconciliations Policies and procedures 15.8.1 R A safeguarding institution must establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the safeguarding institution (including in relation to any services provided through an agent or electronic money distributor) with the relevant funds regime. 15.8.2 G In complying with the requirement in CASS 15.8.1R, a safeguarding institution should establish and maintain policies and procedures that include (but are not limited to): (1) the frequency and method of the reconciliations the safeguarding institution is required to carry out under this section; (2) the resolution of reconciliation discrepancies under this section; and (3) the frequency at which the safeguarding institution is required to review its arrangements in compliance with this chapter. Records and accounts 15.8.3 R (1) A safeguarding institution must keep such records and accounts as are necessary to enable it, at any time and without delay, to distinguish between relevant funds and other funds. (2) Where an electronic money institution or credit union provides payment services that are unrelated to the issuance of electronic

FCA 2025/38 Page 36 of 116 money, the provisions of CASS 15.8 shall be read as if they apply separately to the institution’s unrelated payment services asset pool and to its electronic money asset pool. 15.8.4 G An effect of CASS 15.8.3R(1) is that a safeguarding institution that provides services that are not payment services or the issuance of electronic money must ensure it has adequate policies and procedures in place to identify and determine when it is holding relevant funds and when it is holding or in receipt of funds relating to its other activities. 15.8.5 G The effect of CASS 15.8.3R(2) includes that: (1) the safeguarding institution will need to carry out a separate reconciliation of its unrelated payment services asset pool and of its electronic money asset pool; and (2) an electronic money institution or credit union must ensure it has adequate policies and procedures to distinguish between relevant funds received or held for the provision of payment services unrelated to the issuance of electronic money and relevant funds it receives in exchange for electronic money. 15.8.6 R A safeguarding institution must maintain its records and accounts in a way that ensures their accuracy and, in particular, their correspondence to the relevant funds held for clients. 15.8.7 G (1) The requirements in CASS 15.8.3R and CASS 15.8.6R are for a safeguarding institution to keep internal records and accounts of relevant funds. Therefore, any records falling under those requirements should be maintained by the safeguarding institution and are separate to any records the safeguarding institution may obtain from any third parties, such as those with which it may have deposited relevant funds. (2) A safeguarding institution may use data that is received from third parties for the purpose of creating and maintaining such records where no other method could reasonably be employed (for example, where funds are applied automatically to client balances via application programming interfaces). (3) A safeguarding institution’s records must cover all relevant funds held by an institution, including those not held in relevant funds bank accounts. 15.8.8 R (1) A safeguarding institution must maintain records so that it is able to determine the total amount of relevant funds it should be holding for each of its clients promptly and at any time. (2) A safeguarding institution must ensure that its records are sufficient to show and explain its transactions and commitments for its relevant funds.

FCA 2025/38 Page 37 of 116 (3) Unless otherwise stated, a safeguarding institution must ensure that any record made under this chapter is retained for a period of 5 years starting from the later of: (a) the date it was created; or (b) if it has been modified since the date it was created, the date it was most recently modified. 15.8.9 R For each internal safeguarding reconciliation and external safeguarding reconciliation the safeguarding institution conducts, it must ensure that it records: (1) the time and date it carried out the relevant process; (2) the actions it took in carrying out the relevant process; (3) the outcome of its calculation of its safeguarding requirement and, where relevant, safeguarding resource; and (4) where relevant, the outcome of its comparison of its D+1 segregation requirement and D+1 segregation resource. Internal safeguarding reconciliations 15.8.10 R An internal safeguarding reconciliation requires a safeguarding institution to carry out a reconciliation of its internal records and accounts: (1) to check whether: (a) its safeguarding resource was equal to its safeguarding requirement, as at the reconciliation point (see CASS 15.8.21R); and (b) the amount of relevant funds and relevant assets it is required to hold in relevant funds bank accounts and relevant assets accounts is held in such accounts (see CASS 15.8.35R); and (2) to promptly identify and resolve any discrepancies in accordance with CASS 15.8.50R and CASS 15.8.51R. 15.8.11 R A safeguarding institution that uses the insurance or guarantee method to protect relevant funds (whether alone or in combination with the segregation method) and does so using an insurance policy or guarantee that is unlimited in the amount of cover it provides: (1) does not need to carry out an internal safeguarding reconciliation; but (2) must carry out a daily calculation of its safeguarding requirement and record:

FCA 2025/38 Page 38 of 116 (a) the date it carried out the calculation; (b) the actions the safeguarding institution took in carrying out the calculation; and (c) the outcome of its calculation. 15.8.12 G Where an electronic money institution or credit union provides payment services that are unrelated to the issuance of electronic money, the provisions of CASS 15.8 apply to the safeguarding institution’s unrelated payment services asset pool and electronic money asset pool separately, in line with CASS 15.8.3R(2). 15.8.13 R A safeguarding institution is not required to carry out the reconciliation described in CASS 15.8.10R(1)(b) (the comparison in CASS 15.8.35R) if all of its relevant funds: (1) are held in a relevant funds bank account; or (2) were, before the last internal safeguarding reconciliation, invested in relevant assets. 15.8.14 G The purpose of CASS 15.8.10R(1)(b) is to check that the right amount of relevant funds has been paid into a relevant funds bank account or invested in relevant assets. If all relevant funds are received into a relevant funds bank account or were invested in relevant assets before the last reconciliation, this step is not required. 15.8.15 R In carrying out an internal safeguarding reconciliation, a safeguarding institution must use the values contained in its internal records and ledgers (eg, the payment accounts it operates, its cash book or other internal accounting records) rather than the values contained in the records it has obtained from banks and other third parties with which it has placed relevant funds or relevant assets (eg, bank statements). 15.8.16 G In accordance with CASS 15.8.7G(2), CASS 15.8.15R does not prevent a safeguarding institution from using data obtained from third parties to create and maintain its internal records where no other method could reasonably be employed. 15.8.17 G An internal safeguarding reconciliation should: (1) be one of the steps a safeguarding institution takes to arrange adequate protection for relevant funds when the safeguarding institution is responsible for them; (2) be one of the steps a safeguarding institution takes to satisfy its obligations under regulation 27 of the Electronic Money Regulations or regulation 31 of the Payment Services Regulations (as the case may be) and CASS 15.2 (Organisational requirements: relevant funds) to ensure the accuracy of the safeguarding institution’s records; and

FCA 2025/38 Page 39 of 116 (3) check whether the amount of relevant funds recorded in the safeguarding institution’s records as being safeguarded meets the safeguarding institution’s obligations to its clients under the relevant funds regime. Frequency of internal safeguarding reconciliations 15.8.18 R CASS 15.8.19R to CASS 15.8.23R do not apply to a safeguarding institution that has entered special administration under the PEMII Regulations. 15.8.19 R Subject to CASS 15.8.11R and CASS 15.8.23R, a safeguarding institution must perform an internal safeguarding reconciliation as frequently as necessary and no less than once each reconciliation day. 15.8.20 G CASS 15.8.19R requires a minimum of one internal safeguarding reconciliation to be performed each reconciliation day. It does not prevent a safeguarding institution from deciding it is appropriate to perform internal safeguarding reconciliations on business days that are not reconciliation days due to the nature, volume and complexity of its business. 15.8.21 R (1) A safeguarding institution must select reconciliation point(s) for every day on which it performs internal safeguarding reconciliations. (2) The reconciliation point(s) must be at the same time(s) for every day on which the safeguarding institution carries out internal safeguarding reconciliations. (3) Each internal safeguarding reconciliation must be based on the records of the safeguarding institution as at the corresponding reconciliation point. 15.8.22 R A safeguarding institution must record, as part of the policies and procedures required by CASS 15.8.1R: (1) the reconciliation point(s) referred to in CASS 15.8.21R; and (2) the frequency with which it performs internal safeguarding reconciliations. 15.8.23 R (1) Following an insolvency event, the safeguarding institution must: (a) perform an internal safeguarding reconciliation that relates to the time of the insolvency event as soon as reasonably practicable after the insolvency event; and (b) perform further internal safeguarding reconciliations as regularly as required under (2), based on the records of the safeguarding institution as at the close of business on the

FCA 2025/38 Page 40 of 116 business day before the day on which the reconciliation takes place. (2) A safeguarding institution must determine when and how often to perform an internal safeguarding reconciliation under (1)(b) so as to ensure that: (a) the safeguarding institution remains in compliance with CASS 15.8.3R to CASS 15.8.9R (Records and accounts); and (b) the correct amounts of relevant funds are returned to clients. 15.8.24 G (1) The reference point for the internal safeguarding reconciliation under CASS 15.8.23R(1)(a) should be the precise point in time at which the insolvency event occurred. (2) When a safeguarding institution decides whether it is necessary at any particular point in time to perform an internal safeguarding reconciliation under CASS 15.8.23R(1)(b), it should have particular regard to the need to maintain its books and accounts in order to ensure that its asset pools are correctly composed and maintained. (3) Depending on the circumstances of the safeguarding institution and the scale, frequency and nature of activity after an insolvency event that affects relevant funds, a safeguarding institution may conclude that it is necessary to perform internal safeguarding reconciliations each business day for a period of time after the insolvency event. Internal safeguarding reconciliation: process 15.8.25 R In carrying out its internal safeguarding reconciliation a safeguarding institution may: (1) follow the standard method of internal safeguarding reconciliation set out in CASS 15.8.26R to CASS 15.8.35R; or (2) if it complies with the requirements in CASS 15.8.37R and CASS 15.8.38R follow a non-standard method of internal safeguarding reconciliation. Standard method of internal safeguarding reconciliation: safeguarding resource 15.8.26 R The safeguarding resource is the sum of: (1) the aggregate balance of funds held in the safeguarding institution’s relevant funds bank accounts (less any funds that are not relevant funds held in an account of the type described in regulation 21(4A) of the Electronic Money Regulations or regulation 23(9) of the Payment Services Regulations (Bank of England settlement accounts)) (‘item A’);

FCA 2025/38 Page 41 of 116 (2) the aggregate balance of relevant funds that have been segregated but not placed in a relevant funds bank account or invested in relevant assets (‘item B’); (3) the aggregate value of relevant assets held in the safeguarding institution’s relevant assets accounts based on the safeguarding institution’s records as at the close of business on the previous business day (‘item C’); and (4) the aggregate value of relevant funds that the safeguarding institution has protected using the insurance or guarantee method (‘item D’). 15.8.27 G Item B should include all relevant funds that have been segregated but are not held in a relevant funds bank account – for example, funds held as cash, funds held by agents and funds held in a segregated account that is not a relevant funds bank account. 15.8.28 R In determining item C, a safeguarding institution must ensure that any valuation of the relevant assets is performed impartially and with all due skill, care and diligence. Standard method of internal safeguarding reconciliation: safeguarding requirement 15.8.29 G The safeguarding requirement is the total amount a safeguarding institution is required to safeguard. 15.8.30 R The safeguarding requirement is the sum of: (1) individual safeguarding balances calculated in accordance with CASS 15.8.31R, ignoring any negative balances; and (2) any amounts received but unallocated to an individual client under CASS 15.2.5R (Allocation of relevant funds receipts). Standard method of internal safeguarding reconciliation: individual safeguarding balance 15.8.31 R A safeguarding institution must calculate a client’s individual safeguarding balance in a way which captures the total amount of all funds the safeguarding institution should be safeguarding for that client. 15.8.32 G A safeguarding institution may calculate either: (1) one individual safeguarding balance for each client, based on the totality of all the payment services or electronic money products provided to that client; or (2) multiple individual safeguarding balances for each client, based on the individual payment services or electronic money products provided to that client.

FCA 2025/38 Page 42 of 116 15.8.33 R When calculating an individual safeguarding balance for each client, a safeguarding institution must: (1) include: (a) all relevant funds received by the safeguarding institution for the client; and (b) any amounts credited to the client’s account by the safeguarding institution (for example, interest due and payable to a client on a payment account); and (2) deduct: (a) any payments executed for the client (provided the funds have been paid to the payee or the payee’s payment service provider); (b) any electronic money that has been redeemed; and (c) any sums due and payable by the client to the safeguarding institution (eg, any fees and charges which are due and, under the framework contract, may be deducted from the funds held by the safeguarding institution). 15.8.34 G For the purpose of CASS 15.8.33R(2)(c), a safeguarding institution must not take into account any payment or sums due and payable by the client to the extent those payments or sums create a negative balance on an account operated by the safeguarding institution for the client. Standard method of internal safeguarding reconciliation: D+1 comparison 15.8.35 R In accordance with CASS 15.8.10R(1)(b), and subject to CASS 15.8.13R, a safeguarding institution must: (1) compare its: (a) D+1 segregation requirement; and (b) D+1 segregation resource; and (2) promptly identify and resolve any discrepancies in accordance with CASS 15.8.51R. Non-standard method of internal safeguarding reconciliation 15.8.36 R A non-standard method of internal safeguarding reconciliation is a method of internal safeguarding reconciliation which does not meet the requirements of the standard method of internal safeguarding reconciliation.

FCA 2025/38 Page 43 of 116 15.8.37 R (1) Before using a non-standard method of internal safeguarding reconciliation, a safeguarding institution must: (a) establish and document in writing its reasons for concluding that the method of internal safeguarding reconciliation it proposes to use will check whether: (i) the amount of relevant funds recorded in the safeguarding institution’s records as being safeguarded meets the safeguarding institution’s obligation to its clients under the relevant funds regime; and (ii) the amount of relevant funds recorded in the safeguarding institution’s records as being held in a relevant funds bank account or invested in relevant assets and held in a relevant assets account meets the safeguarding institution’s obligation to its clients under the relevant funds regime; and (b) obtain a written report prepared by an independent auditor of the safeguarding institution in line with a reasonable assurance engagement and stating the matters set out in (2). (2) The written report in (1)(b) must state whether, in the auditor’s opinion: (a) the method of internal safeguarding reconciliation which the safeguarding institution will use is suitably designed to enable it to check whether: (i) the amount of relevant funds recorded in the safeguarding institution’s records as being safeguarded meets the safeguarding institution’s obligation to its clients under the relevant funds regime; and (ii) the amount of relevant funds recorded in the safeguarding institution’s records as being held in a relevant funds bank account or invested in relevant assets and held in a relevant assets account meets the safeguarding institution’s obligation to its clients under the relevant funds regime; and (b) the safeguarding institution’s systems and controls are suitably designed to enable it to carry out the method of internal safeguarding reconciliation the safeguarding institution will use. (3) A safeguarding institution using a non-standard method of internal safeguarding reconciliation must not materially change its method of undertaking internal safeguarding reconciliations unless:

FCA 2025/38 Page 44 of 116 (a) the safeguarding institution has established and documented in writing its reasons for concluding that the changed methodology will meet the requirements in (1)(a); and (b) an auditor of the safeguarding institution has prepared a report that complies with the requirements in (1)(b) and (2) in respect of the safeguarding institution’s proposed changes. 15.8.38 R A safeguarding institution must take reasonable steps to ensure that the auditor it appoints to prepare the report in CASS 15.8.37R(1)(b) has the required skills, resources and experience to perform their functions under the regulatory system and: (1) is eligible for appointment as an auditor under Chapters 1, 2 and 6 of Part 42 of the Companies Act 2006; (2) if appointed under an obligation in another enactment, is eligible for appointment as an auditor under that enactment; or (3) in the case of an overseas relevant institution, is eligible for appointment as an auditor under any applicable equivalent laws of that country or territory. External safeguarding reconciliations 15.8.39 R A safeguarding institution must conduct reconciliations between its internal records and accounts and those of: (1) the banks with which the safeguarding institution holds a relevant funds bank account; (2) the persons with which the safeguarding institution holds any other account in which relevant funds are held; and (3) the authorised custodians with which the safeguarding institution holds a relevant assets account, and any third party that manages relevant assets on behalf of the safeguarding institution. 15.8.40 G (1) The purpose of an external safeguarding reconciliation is to ensure the accuracy of a safeguarding institution’s internal records and accounts against those of any third parties that hold relevant funds or hold or manage relevant assets. (2) The records used for external safeguarding reconciliations should, so far as possible, relate to the same point in time as the reconciliation point(s) used for internal safeguarding reconciliations (see CASS 15.8.21R). (3) If the records and accounts used for external safeguarding reconciliations cannot be aligned with the reconciliation point(s) referred to in (2), the policies and procedures referred to in CASS

FCA 2025/38 Page 45 of 116 15.8.1R should set out how the safeguarding institution will ensure its external safeguarding reconciliations achieve the purpose in (1). Frequency of external safeguarding reconciliations 15.8.41 R CASS 15.8.42R does not apply to a safeguarding institution following an insolvency event. 15.8.42 R A safeguarding institution must perform an external safeguarding reconciliation: (1) as frequently as necessary and no less than once each reconciliation day; and (2) as soon as reasonably practicable after the date to which the external safeguarding reconciliation relates. Frequency of external safeguarding reconciliations after an insolvency event 15.8.43 R CASS 15.8.44R to CASS 15.8.46R do not apply to a safeguarding institution that has entered special administration under the PEMII Regulations. 15.8.44 R Following an insolvency event, a safeguarding institution must perform an external safeguarding reconciliation that relates to the time of the insolvency event as soon as reasonably practicable after the insolvency event, based on the next available statements or other forms of confirmation after the insolvency event from: (1) the banks with which the safeguarding institution holds a relevant funds bank account; (2) the persons with which the safeguarding institution holds any other account in which relevant funds are held; and (3) the authorised custodians with which the safeguarding institution holds a relevant assets account, and any third party that manages relevant assets on behalf of the safeguarding institution. 15.8.45 G The reference point for the external safeguarding reconciliation under CASS 15.8.44R should be the precise point in time at which the insolvency event occurred. 15.8.46 R When determining the frequency with which it will undertake further external safeguarding reconciliations after an insolvency event, a safeguarding institution must have regard to: (1) the frequency, number and value of transactions which the safeguarding institution undertakes in respect of relevant funds; (2) the risks to which the relevant funds are exposed, such as the nature, volume and complexity of the safeguarding institution’s activities

FCA 2025/38 Page 46 of 116 and where and with whom the relevant funds are held or invested; and (3) the need to be able to verify that: (a) relevant funds within an asset pool have not been incorrectly distributed, transferred or dissipated; and (b) the proceeds of any payments and transactions that settle after the insolvency event and which involve relevant funds have been received correctly. External safeguarding reconciliations: method 15.8.47 R An external safeguarding reconciliation requires a safeguarding institution to: (1) compare: (a) the balance, currency by currency, as recorded by the safeguarding institution, with the balance on that account as set out in the most recent statement or other form of confirmation issued by the person with which those accounts are held, for: (i) each relevant funds bank account; and (ii) any other account in which relevant funds are held; and (b) the quantity of relevant assets, investment by investment, as recorded by the safeguarding institution for each account held with an authorised custodian, with the quantity set out in the most recent statement or other form of confirmation issued by the authorised custodian; and (2) promptly identify and resolve any discrepancies between those balances in accordance with CASS 15.8.56R and CASS 15.8.57R. 15.8.48 G The reconciliation described in CASS 15.8.47R(1)(b) requires a safeguarding institution to reconcile the quantity of relevant assets, rather than the value of those assets. The relevant assets should be compared by asset type. For example, the safeguarding institution should compare its records of the number of units in a particular UCITS against the number of units as set out in the statements provided by the custodian of the units or issuer (as the case may be). 15.8.49 G Insurance policies and guarantees are not subject to the external safeguarding reconciliation. However, safeguarding institutions using the insurance or guarantee method are reminded of their obligations in CASS 15.5 and the need to ensure that any insurance policy or guarantee provides appropriate cover at all times.

FCA 2025/38 Page 47 of 116 Reconciliation discrepancies 15.8.50 R When a discrepancy arises between a safeguarding institution’s safeguarding resource and its safeguarding requirement, the safeguarding institution must determine the reason for the discrepancy and, subject to CASS 15.8.52R, ensure that: (1) any shortfall is paid into a relevant funds bank account or invested in relevant assets as soon as possible and, in any case, by the end of the day on which the reconciliation is performed; or (2) any excess is withdrawn from an account holding relevant funds or relevant assets. 15.8.51 R (1) If a safeguarding institution’s D+1 segregation resource is lower than its D+1 segregation requirement, the safeguarding institution must: (a) determine the reason for the discrepancy; and (b) subject to CASS 15.8.52R, ensure that sufficient relevant funds are paid into a relevant funds bank account or invested in relevant assets to address the difference as soon as possible and, in any case, by the end of the day on which the reconciliation is performed. (2) If it is not possible to use relevant funds to comply with (1), the safeguarding institution must use its own funds to do so, even if this leads to a discrepancy between its safeguarding requirement and safeguarding resource. 15.8.52 R Following an insolvency event, a safeguarding institution is not required to make a payment, investment or withdrawal under CASS 15.8.50R or CASS 15.8.51R insofar as the legal procedure for the insolvency event restricts it from doing so. 15.8.53 G CASS 15.8.50R and CASS 15.8.51R set out some of the steps that a safeguarding institution must carry out to ensure that it is segregating the right amount of relevant funds, and that it is holding the right amount of relevant funds in relevant funds bank accounts or as relevant assets. Where discrepancies are identified, safeguarding institutions are required to make payments, investments or withdrawals to remedy those discrepancies. 15.8.54 G CASS 15.8.51R(2) makes provision for a safeguarding institution that has a deficiency in its D+1 segregation resource but is unable to access relevant funds to remedy it. Such lack of access could be, for example, because of a delay in the release of relevant funds by a third party. In such circumstances, the safeguarding institution must top-up the shortfall from its own funds, even where this leads to a surplus in the safeguarding resource. The discrepancy will be resolved by subsequent reconciliations.

FCA 2025/38 Page 48 of 116 15.8.55 G Where the discrepancy identified under CASS 15.8.50R or CASS 15.8.51R has arisen as a result of a breach of the requirements in this chapter, the safeguarding institution should ensure it takes sufficient steps to avoid a reoccurrence of that breach. 15.8.56 R If any discrepancy is identified by an external safeguarding reconciliation, the safeguarding institution must investigate the reason for the discrepancy and take all reasonable steps to resolve it without undue delay, unless the discrepancy arises solely as a result of timing differences between the accounting systems of the party providing the statement or confirmation and that of the safeguarding institution. 15.8.57 R If a safeguarding institution is unable to immediately resolve a discrepancy identified by an external safeguarding reconciliation, and one record or set of records examined by the safeguarding institution during its external safeguarding reconciliation indicates that there is a need to have a greater amount of relevant funds or relevant assets than is the case, the safeguarding institution must assume, until the matter is finally resolved, that that record or set of records is accurate and, subject to CASS 15.8.58R, pay its own funds into a relevant funds bank account or invest them in relevant assets. 15.8.58 R Following an insolvency event, a safeguarding institution is not required to pay its own funds into a relevant funds bank account or invest them in relevant assets under CASS 15.8.57R insofar as the legal procedure for the insolvency event restricts it from doing so. 15.8.59 G (1) CASS 15.8.52R and CASS 15.8.58R recognise that, following an insolvency event, a safeguarding institution is required to investigate discrepancies, but the extent to which it is able to resolve discrepancies may be limited by insolvency law, for example. (2) CASS 15.8.52R and CASS 15.8.58R would not prevent any transfers being made in accordance with regulations 13 or 14 of the PEMII Regulations. Notification requirements 15.8.60 R A safeguarding institution must inform the FCA in writing without delay if: (1) its internal records and accounts of relevant funds are materially out of date, inaccurate or invalid so that the safeguarding institution is no longer able to comply with the requirements in CASS 15.8.3R, CASS 15.8.6R or CASS 15.8.8R(1); (2) it will be unable to, or materially fails to, conduct an internal safeguarding reconciliation in compliance with CASS 15.8.10R and CASS 15.8.19R; (3) it will be unable to, or materially fails to, pay any shortfall into a relevant funds bank account or invest it in relevant assets, or

FCA 2025/38 Page 49 of 116 withdraw any excess from an account holding relevant funds or relevant assets so that the safeguarding institution is unable to comply with CASS 15.8.50R or CASS 15.8.51R after having carried out an internal safeguarding reconciliation; (4) it will be unable to, or materially fails to, conduct an external safeguarding reconciliation in compliance with CASS 15.8.39R and CASS 15.8.42R; (5) it will be unable to, or materially fails to, identify and resolve any discrepancies under CASS 15.8.56R and CASS 15.8.57R after having carried out an external safeguarding reconciliation; or (6) it becomes aware that, at any time in the preceding 12 months, the amount of relevant funds safeguarded was materially different from the total aggregate amount of relevant funds the safeguarding institution was required to safeguard under the Electronic Money Regulations or the Payment Services Regulations. 15.8.61 G Safeguarding institutions are reminded that the auditor of the safeguarding institution must confirm in the report submitted to the FCA under SUP 3A.9 (Duties of auditors: notification and safeguarding report) whether the safeguarding institution has maintained systems adequate to enable it to comply with the relevant funds regime. 15 Annex 1 Safeguarding account acknowledgement letter template 15 Annex 1.1 R [Editor’s Note: The use of italics in the following safeguarding account acknowledgement letter template indicate text to be completed in the template and are not indicative of terms in the Glossary of Definitions.] [Letterhead of safeguarding institution, including full name and address of safeguarding institution] [name and address of approved bank or authorised custodian] [date] Safeguarding Account Acknowledgement Letter (pursuant to the rules of the Financial Conduct Authority) We refer to the following [account[s]] which [name of safeguarding institution], regulated by the Financial Conduct Authority (Firm Reference Number [FRN]), (‘us’, ‘we’ or ‘our’) [has opened or will open] [and/or] [has deposited or will deposit] with [name of approved bank or authorised custodian] (‘you’ or ‘your’):

FCA 2025/38 Page 50 of 116 [insert the account title[s], the account unique identifier[s] (eg, sort code and account number, deposit number or reference code) and (if applicable) any abbreviated name of the account[s] as reflected in the firm’s systems] ([collectively,] the ‘Safeguarding Account[s]’). For [each of] the Safeguarding Account[s] identified above you acknowledge that we have notified you that: (1) we are under an obligation to keep [money] [or] [assets] we hold to meet the claims of our clients separate from other [money] [or] [assets]; (2) we have opened, or will open, the Safeguarding Account for the purpose of depositing [money] [or] [assets] with you to meet the claims of our clients; and (3) we hold all [money] [or] [assets] standing to the credit of the Safeguarding Account to meet the claims of our clients. For [each of] the Safeguarding Account[s] above you agree that: (4) you do not have any interest in, or recourse or right against [money] [or] [assets] in the Safeguarding Account in respect of any sum owed to you, or owed to any third party, on any other account (including an account we use for our own [money] [or] [assets]) except as permitted by [regulation 24(1) of the Electronic Money Regulations 2011] [or] [regulation 23(14) of the Payment Services Regulations 2017]. This means, for example, that you do not have any right to combine the Safeguarding Account[s] with any other account and any right of set-off or counterclaim against [money/assets] in the Safeguarding Account, except following an insolvency event (as defined in [regulation 22 of the Electronic Money Regulations 2011] [or] [regulation 23 of the Payment Services Regulations]), and: (a) to the extent that the right of set-off or counterclaim relates to your fees and expenses in relation to the operation of the Safeguarding Account; or (b) if all the claims of our clients have been paid; (5) you will title, or have titled, the Safeguarding Account as stated above and that this title is different to the title of any other account containing [money] [or] [assets] belonging to us or to any third party; and (6) you are required to release on demand all [money] [or] [assets] standing to the credit of the Safeguarding Account upon proper notice and instruction from us or a liquidator, receiver, administrator, or trustee (or similar person) appointed for us in bankruptcy (or similar procedure), in any relevant jurisdiction, except:

FCA 2025/38 Page 51 of 116 (a) to the extent that you are exercising a right of set-off or security right as permitted by [regulation 24(1) of the Electronic Money Regulations 2011] [or] [regulation 23(14) of the Payment Services Regulations 2017]; or (b) until the fixed term expires, any amounts held under a fixed term deposit arrangement which cannot be terminated before the expiry of the fixed term, provided that you have a contractual right to retain such [money] [or] [assets] under (a) or (b) and that this right is notwithstanding paragraphs (1) to (3) above and without breach of your agreement to paragraph (4) above. We acknowledge that: (7) you are not responsible for ensuring compliance by us with our own obligations in respect of the Safeguarding Account[s]. You and we agree that: (8) the terms of this letter will remain binding upon the parties, their successors and assigns, and, for clarity, regardless of any change in any of the parties’ names; (9) this letter supersedes and replaces any previous agreement between the parties in connection with the Safeguarding Account[s], to the extent that such previous agreement is inconsistent with this letter; (10) if there is any conflict between this letter and any other agreement between the parties over the Safeguarding Account[s], this letter will prevail; (11) no variation to the terms of this letter shall be effective unless it is in writing, signed by the parties and permitted under the rules of the Financial Conduct Authority; (12) this letter is governed by the laws of [insert appropriate jurisdiction] [safeguarding institutions may optionally use this space to insert additional wording to record an intention to exclude any rules of private international law that could lead to the application of the substantive law of another jurisdiction]; and (13) the courts of [insert same jurisdiction as previous] have non-exclusive jurisdiction to settle any dispute or claim from or in connection with this letter or its subject matter or formation (including non-contractual disputes or claims). Please sign and return the enclosed copy of this letter as soon as possible.

FCA 2025/38 Page 52 of 116 For and on behalf of [name of safeguarding institution] x___________________________ Authorised Signatory Print Name: Title: ACKNOWLEDGED AND AGREED: For and on behalf of [name of bank/custodian] x___________________________ Authorised Signatory Print Name: Title: Contact Information: [insert signatory’s phone number and email address] Date: 15 Annex 2 Guidance notes for acknowledgement letters Introduction 15 Annex 2.1 G This annex contains guidance on the use of the template acknowledgement letter in CASS 15 Annex 1. General 15 Annex 2.2 G Under CASS 15.7.3R and CASS 15.7.4R, safeguarding institutions are required to request duly signed and countersigned acknowledgement letters for their relevant funds bank accounts and relevant assets accounts. 15 Annex 2.3 G For each account a safeguarding institution is required to complete, sign and send to the approved bank or authorised custodian (‘the counterparty’) an acknowledgement letter identifying that account in the form set out in CASS 15 Annex 1 (Safeguarding account acknowledgement letter template). 15 Annex 2.4 G When completing an acknowledgement letter using the appropriate template, a safeguarding institution is reminded that it must not amend any of the text which is not in square brackets (acknowledgement letter fixed text). A safeguarding institution should also not amend the non-italicised text that is

FCA 2025/38 Page 53 of 116 in square brackets. It may remove or include square bracketed text from the letter, or replace bracketed and italicised text with the required information, in either case as appropriate. The notes below give further guidance on this. Clear identification of relevant accounts 15 Annex 2.5 G A safeguarding institution is reminded that for each relevant funds bank account or relevant assets account it needs to request an acknowledgement letter. As a result, it is important that it is clear to which account or accounts each acknowledgement letter relates. As a result, the template in CASS 15 Annex 1 requires that the acknowledgement letter includes the full title and at least one unique identifier, such as a sort code and account number, deposit number or reference code, for each account. 15 Annex 2.6 G The title and unique identifiers included in an acknowledgement letter for an account should be the same as those reflected in both the records of the safeguarding institution and the relevant counterparty, as appropriate, for that account. Where a counterparty’s systems are not able to reflect the full title of an account, that title may be abbreviated to accommodate that system, provided that: (1) the account may continue to be appropriately identified in line with the requirements of CASS 15 (for example, ‘account’ may be shortened to ‘acct’ etc); and (2) when completing an acknowledgement letter, such letter must include both the long and short versions of the account title 15 Annex 2.7 G A safeguarding institution should ensure that all relevant account information is contained in the space provided in the body of the acknowledgement letter. Nothing should be appended to an acknowledgement letter. 15 Annex 2.8 G In the space provided in the template letter for setting out the account title and unique identifiers for each relevant account, a safeguarding institution may include the required information in the format of the following table: [Editor’s Note: The use of italics in the following table indicate text to be completed in the template and are not indicative of terms in the Glossary of Definitions.] Full account title Unique identifier Title reflected in [name of counterparty] systems [Safeguarding Institution Relevant Funds Bank Account/Relevant Assets Account] [00-00-00 12345678] [SI Relevant Funds A/C]

FCA 2025/38 Page 54 of 116 15 Annex 2.9 G Where an acknowledgement letter is intended to cover a range of accounts, some of which may not exist as at the date the acknowledgement letter is countersigned by the counterparty, a safeguarding institution should set out in the space provided in the body of the acknowledgement letter that it is intended to apply to all present and future accounts which: (1) are titled in a specified way; and (2) which possess a common unique identifier or which may be clearly identified by a range of unique identifiers (eg, all accounts numbered between XXXX1111 and ZZZZ9999). For example, in the space provided in the template letter in CASS 15 Annex 1 which allows a safeguarding institution to include the account title and a unique identifier for each relevant account, a safeguarding institution should include a statement to the following effect: [Editor’s Note: The use of italics in the following table indicate text to be completed in the template and are not indicative of terms in the Glossary of Definitions.] ‘Any account open at present or to be opened in the future which contains the term [‘relevant funds’] [insert appropriate abbreviation of the term ‘relevant funds’ as agreed and to be reflected in the approved bank’s systems] in its title and which may be identified with [the following [insert common unique identifier]] [an account number from and including [XXXX1111] to and including [ZZZZ9999]] [clearly identify range of unique identifiers].’ Signatures and countersignatures 15 Annex 2.10 G A safeguarding institution should ensure that each acknowledgement letter is signed and countersigned by all relevant parties and individuals (including where more than one signatory is required). 15 Annex 2.11 G An acknowledgement letter that is signed or countersigned electronically should not, for that reason alone, result in a breach of the rules in CASS 15.7. However, where electronic signatures are used, a safeguarding institution should consider whether, taking into account the governing law and choice of competent jurisdiction, it needs to ensure that the electronic signature and the certification by any person of such signature would be admissible as evidence in any legal proceedings in the relevant jurisdiction in relation to any question as to the authenticity or integrity of the signature or any associated communication. Completing a safeguarding account acknowledgement letter

FCA 2025/38 Page 55 of 116 15 Annex 2.12 G A safeguarding institution should use at least the same level of care and diligence when completing an acknowledgement letter as it would in managing its own commercial agreements. 15 Annex 2.13 G A safeguarding institution should ensure that each acknowledgement letter is legible (eg, any handwritten details should be easy to read), produced on the safeguarding institution’s own letter-headed paper, dated and addressed to the correct legal entity (eg, where the counterparty belongs to a group of companies). 15 Annex 2.14 G A safeguarding institution should also ensure each acknowledgement letter includes all the required information (such as account names and numbers, the parties’ full names, addresses and contact information, and each signatory’s printed name and title). 15 Annex 2.15 G A safeguarding institution should similarly ensure that no square brackets remain in the text of each acknowledgement letter (eg, after having removed or included square bracketed text, as appropriate, or having replaced square bracketed and italicised text with the required information as indicated in the template in CASS 15 Annex 1) and that each page of the letter is numbered. 15 Annex 2.16 G A safeguarding institution should complete an acknowledgement letter so that no part of the letter can be easily altered (eg, the letter should be signed in ink rather than pencil). 15 Annex 2.17 G In respect of the acknowledgement letter’s governing law and choice of competent jurisdiction (see paragraphs (12) and (13) of the template acknowledgement letter in CASS 15 Annex 1), a safeguarding institution should agree with the counterparty and reflect in the letter that the laws of a particular jurisdiction will govern the acknowledgement letter and that the courts of that same jurisdiction will have jurisdiction to settle any disputes arising out of, or in connection with, the acknowledgement letter, its subject matter or formation. 15 Annex 2.18 G If a safeguarding institution does not, in any acknowledgement letter, utilise the governing law and choice of competent jurisdiction that is the same as either or both: (1) the laws of the jurisdiction under which either the safeguarding institution or the counterparty are organised; or (2) as is found in the underlying agreement/s (eg, banking services agreement) with the relevant counterparty, the institution should consider whether it is at risk of breaching CASS 15.6.1R or CASS 15.6.3R. Authorised signatories

FCA 2025/38 Page 56 of 116 15 Annex 2.19 G A safeguarding institution is required under CASS 15.7.9 to use reasonable endeavours to ensure that any individual that has countersigned an acknowledgement letter returned to the safeguarding institution was authorised to countersign the letter on behalf of the relevant counterparty. 15 Annex 2.20 G If an individual that has countersigned an acknowledgement letter does not provide the safeguarding institution with sufficient evidence of their authority to do so, the safeguarding institution is expected to make appropriate enquiries to satisfy itself of that individual’s authority. 15 Annex 2.21 G Evidence of an individual’s authority to countersign an acknowledgement letter may include a copy of the counterparty’s list of authorised signatories, a duly executed power of attorney, use of a company seal or bank stamp, and/or material verifying the title or position of the individual countersigning the acknowledgement letter. 15 Annex 2.22 G A safeguarding institution should ensure it obtains at least the same level of assurance over the authority of an individual to countersign the acknowledgement letter as the safeguarding institution would seek when managing its own commercial arrangements. Third party administrators 15 Annex 2.23 G If a safeguarding institution uses a third party administrator (TPA) to carry out the administrative tasks of drafting, sending and processing an acknowledgement letter, the text ‘[Signed by [Name of Third Party Administrator] on behalf of [safeguarding institution]]’ should be inserted to confirm that the acknowledgement letter was signed by the TPA on behalf of the safeguarding institution. 15 Annex 2.24 G In these circumstances, the safeguarding institution should first provide the TPA with the requisite authority (such as a power of attorney) before the TPA will be able to sign the acknowledgement letter on the safeguarding institution’s behalf. A safeguarding institution should also ensure that the acknowledgement letter continues to be drafted on letter-headed paper belonging to the safeguarding institution. Naming 15 Annex 2.25 G A safeguarding institution must ensure that each of its accounts is designated in accordance with regulation 21(3)(a) of the Electronic Money Regulations and regulation 23(7)(a) of the Payment Services Regulations. 15 Annex 2.26 G All references to the term ‘Relevant Funds Bank Account[s]’or ‘Relevant Assets Account[s]’ in an acknowledgement letter should also be made consistently in either the singular or plural, as appropriate. Amend the following as shown. TP 1 Transitional Provisions

FCA 2025/38 Page 57 of 116 TP 1.1 (1) (2) Material to which the transitional provision applies (3) (4) Transitional provision (5) Transitional provision: dates in force (6) Handbook provision: coming into force … (16) … … … … … (17) The changes to the Glossary in Annex A and to CASS in Annex C of the Payment Services and Electronic Money (Safeguarding) Instrument 2025 R If an insolvency event happens before the rules in column 2 come into force, the changes listed in column 2 do not apply to the safeguarding institution. Indefinitely 7 May 2026 (18) CASS 15.4.9R(1) and CASS 15.6.1R(1) R If a safeguarding institution has an appointment referred to in the rules in column (2) in place when those rules come into force, it must carry out a review of that appointment within 3 months of those rules coming into force. Indefinitely 7 May 2026 (19) CASS 15.5.2R and CASS 15.5.3R R The rules listed in column 2 do not apply to an insurance policy or guarantee obtained in accordance with regulation 22 of the Electronic Money Regulations and/or regulation 23 of the Payment Services Regulations, as Indefinitely 7 May 2026

FCA 2025/38 Page 58 of 116 applicable, before those rules come into force. Those rules do apply to any renewal or extension of the policy or guarantee. (20) CASS 15.4.11R(1)(a) and CASS 15.6.7R(1)(a) R The rules listed in column 2 do not apply to appointments made before they come into force. Indefinitely 7 May 2026 (21) CASS 15.7.2R to CASS 15.7.11 R The rules listed in column 2 do not apply to an account for which a safeguarding institution has an acknowledgement letter in the form set out in Annex 6 of the document titled ‘Payment Services and Electronic Money – Our Approach’ dated November 2024 (version 6) when they come into force. Indefinitely 7 May 2026 (22) CASS 15.7.12R to CASS 15.7.15R R The rules listed in column 2 apply to acknowledgement letters referred to in row (21) as they apply to acknowledgement letters referred to in CASS 15.7. Indefinitely 7 May 2026 Sch 1 Record keeping requirements …

FCA 2025/38 Page 59 of 116 Sch 1.3 G Handbook reference Subject of record Contents of record When record must be made Retention period … CASS 10.1.3R … … … … CASS 10A.1.3R A safeguarding institution’s CASS resolution pack The records set out in CASS 10A.2 and CASS 10A.3 When CASS 10A comes into force Not specified (see default provision CASS 15.8.8R(3)) … CASS 13.11.13R … … … … CASS 15.2.5R(2) Unallocated relevant funds Balance of unallocated relevant funds Pending allocation of relevant funds to individual clients Until relevant funds allocated to individual clients CASS 15.2.9R(2) Unidentified relevant funds Balance of unidentified relevant funds When a safeguarding institution is unable to identify whether funds are relevant funds Until funds identified as either relevant funds or other funds CASS 15.4.11R(1) Use of third party to manage relevant assets Grounds upon which the safeguarding institution chose the third party, and periodic reviews of appointment and selection When selection made or review completed Not specified (see default provision CASS 15.8.8R(3)) CASS 15.6.7R(1) Use of third parties for safeguarding purposes Grounds upon which the safeguarding institution chose the third party, and periodic When selection made or review completed Not specified (see default provision CASS 15.8.8R(3))

FCA 2025/38 Page 60 of 116 reviews of appointment and selection CASS 15.7.10R Acknowledgement letters Countersigned acknowledgement letters When received Five years from when the last account the letter relates to is closed CASS 15.7.11R Requirements relating to acknowledgement letters Documentation or evidence to demonstrate compliance with requirements When identified Not specified (see default provision CASS 15.8.8R(3)) CASS 15.8.3R(1) Relevant funds and other funds Such records and accounts as are necessary to enable a safeguarding institution to distinguish between relevant funds and other funds Maintain up to date records Not specified (see default provision CASS 15.8.8R(3)) CASS 15.8.8R(1) Relevant funds Such records as are sufficient to allow a safeguarding institution to determine the total amount of relevant funds it should be holding for each of its clients Maintain up to date records Not specified (see default provision CASS 15.8.8R(3)) CASS 15.8.8R(3) Default record keeping requirement for CASS 15 Refer to the rule concerned Refer to the rule concerned Five years from the later of: (1) the date it was created; or (2) the date it was most recently modified.

FCA 2025/38 Page 61 of 116 CASS 15.8.9R Internal safeguarding reconciliation and external safeguarding reconciliation The time and date it carried out the relevant process; the actions it took in carrying out the relevant process; the outcome of its calculation of its safeguarding requirement and, where relevant, safeguarding resource; and, where relevant, the outcome of its comparison of its D+1 segregation requirement and D+1 segregation resource When reconciliation carried out Not specified (see default provision CASS 15.8.8R(3)) CASS 15.8.11R(2) Daily calculation of safeguarding requirement for a safeguarding institution that uses an insurance policy or guarantee providing unlimited cover Date of calculation, actions that the safeguarding institution took and the outcome of the calculation Daily Not specified (see default provision CASS 15.8.8R(3)) CASS 15.8.22R(1) Reconciliation points The reconciliation point(s) that will be used for internal safeguarding reconciliations When selected Not specified (see default provision CASS 15.8.8R(3)) CASS 15.8.22R(2) Internal safeguarding reconciliations The frequency of internal safeguarding reconciliations When determined Not specified (see default provision CASS 15.8.8R(3)) CASS 15.8.37R(1)(a) Non-standard method of internal safeguarding reconciliation Reasons for concluding the method of internal safeguarding reconciliation

FCA 2025/38 Page 62 of 116 satisfies the requirements

FCA 2025/38 Page 63 of 116 Annex D Amendments to the Supervision manual (SUP) In this Annex, underlining indicates new text and striking through indicates deleted text, unless otherwise stated. Insert the following new section, SUP 3A, after SUP 3 (Auditors). All the text is new and is not underlined. 3A Payment services and electronic money 3A.1 Application 3A.1.1 R (1) Subject to (3) and (4), this chapter applies to: (a) relevant institutions, which means the following, unless they are exempt in accordance with (2): (i) authorised payment institutions that are authorised to carry out payment services other than payment initiation services or account information services; and (ii) electronic money institutions; and (b) the external auditors of relevant institutions appointed in accordance with SUP 3A.3. (2) An institution is exempt if it has not been required to safeguard more than £100,000 of relevant funds under the relevant funds regime at any time for a period of at least 53 weeks. (3) SUP 3A.1.3G and SUP 3A.1.4G apply to safeguarding institutions that are not relevant institutions. (4) SUP 3A.8.10G applies to statutory auditors of safeguarding institutions (as defined in regulation 25(6) of the Electronic Money Regulations and regulation 24(6) of the Payment Services Regulations). 3A.1.2 G This chapter applies to relevant institutions whether they safeguard relevant funds through the segregation method, the insurance or guarantee method or both. 3A.1.3 G Safeguarding institutions that are not subject to this chapter are still required to have in place adequate arrangements to safeguard relevant funds under CASS 15.2.1R and minimise the risk of their loss or diminution under regulation 24(3) of the Electronic Money Regulations and regulation 23(17) of the Payment Services Regulations. Voluntarily arranging an audit in accordance with this chapter may help ensure they meet these obligations.

FCA 2025/38 Page 64 of 116 3A.1.4 G It is the responsibility of a safeguarding institution’s senior management to determine, on a continuing basis, whether the safeguarding institution is exempt in accordance with SUP 3A.1.1R(2) and to appoint an auditor if management determines the institution is no longer exempt. 3A.2 Purpose Purpose: general 3A.2.1 G This chapter sets out rules and guidance on the role that auditors play in the FCA’s monitoring of relevant institutions’ compliance with the requirements and standards in the relevant funds regime. 3A.2.2 G The Payment Services Regulations and the Electronic Money Regulations, together with other legislation, such as the Companies Acts 2006, provide the statutory framework for relevant institutions’ and auditors’ obligations. Rights and duties of auditors 3A.2.3 G (1) The rights and duties of auditors are set out in SUP 3A.8 (Rights and duties of auditors) and SUP 3A.9 (Duties of auditors: notification and safeguarding report). SUP 3A.8.10G refers to statutory auditors’ duty to report certain matters to the FCA under regulation 24 of the Payment Services Regulations and regulation 25 of the Electronic Money Regulations. (2) An auditor should bear these rights and duties in mind when carrying out safeguarding report work, including whether anything should be notified to the FCA immediately. 3A.3 Appointment of auditors Purpose 3A.3.1 G This section requires a relevant institution to appoint an auditor and supply the FCA with information about its auditor. The FCA requires such information to ensure that the relevant institution has an auditor. Appointment by institutions 3A.3.2 R A relevant institution must: (1) appoint an external auditor; (2) notify the FCA, without delay, when it is aware that a vacancy in the office of auditor will arise or has arisen, giving the reason for the vacancy. This notification must be submitted by electronic means made available by the FCA; (3) appoint an auditor to fill any vacancy in the office of auditor which has arisen;

FCA 2025/38 Page 65 of 116 (4) ensure that the replacement auditor can take up office at the time the vacancy arises or as soon as reasonably practicable after that; and (5) notify the FCA of the appointment of an auditor, the name and business address of the auditor appointed and the date from which the appointment has effect. This notification must be submitted by electronic means made available by the FCA. 3A.3.3 G SUP 3A.3.2R applies to every relevant institution. That includes a relevant institution which is under an obligation to appoint an auditor under, for example, the Companies Act 2006. The auditor appointed under SUP 3A.3.2R does not have to be (but may be) the same auditor as is appointed to fulfil such an obligation. SUP 3A.3.2R is made under section 137A of the Act (The FCA’s general rules), as applied by the Payment Services Regulations and the Electronic Money Regulations, in relation to such institutions. It is made under section 340(1) (Appointment), as applied by the Payment Services Regulations and the Electronic Money Regulations, in relation to other institutions. Appointment by the FCA 3A.3.4 R (1) This rule does not apply to a relevant institution that is under an obligation to appoint an auditor imposed by an enactment other than the Act. (2) If a relevant institution fails to appoint an auditor within 28 days of being required to do so, the FCA may appoint an auditor for it on the following terms: (a) the auditor is to be remunerated by the institution on the basis agreed between the auditor and institution or, in the absence of agreement, on a reasonable basis; and (b) the auditor is to hold office until they resign, or the institution appoints another auditor. 3A.3.5 G SUP 3A.3.4R allows, but does not require, the FCA to appoint an auditor if the relevant institution fails to do so within the 28-day period. When it considers whether to use this power, the FCA will take into account the likely delay until the institution can make an appointment and the urgency of any pending duties of the appointed auditor. 3A.3.6 R A relevant institution must comply with, and is bound by, the terms on which an auditor is appointed by the FCA under SUP 3A.3.4R. 3A.4 Auditors’ qualifications Purpose 3A.4.1 G The FCA is concerned to ensure that the auditor of a relevant institution has the necessary skill and experience to audit the business of the institution to

FCA 2025/38 Page 66 of 116 which they have been appointed. This section sets out the FCA’s rules and guidance aimed at achieving this. Qualifications 3A.4.2 R Before a relevant institution appoints an auditor, it must take reasonable steps to ensure that the auditor has the required skill, resources and experience to perform their functions under the regulatory system and that the auditor: (1) is eligible for appointment as an auditor under Chapters 1, 2 and 6 of Part 42 of the Companies Act 2006; (2) if appointed under an obligation in another enactment, is eligible for appointment as an auditor under that enactment; or (3) in the case of an overseas relevant institution, is eligible for appointment as an auditor under any applicable equivalent laws of that country or territory. 3A.4.3 G An auditor which a relevant institution proposes to appoint should have skills, resources and experience commensurate with the nature, scale and complexity of the relevant institution’s business and the requirements and standards under the regulatory system to which it is subject. A relevant institution should have regard to whether its proposed auditor has expertise in the relevant requirements and standards (which may involve access to UK expertise) and possesses or has access to appropriate specialist skill. The relevant institution should seek confirmation of this from the auditor concerned as appropriate. Disqualified auditors 3A.4.4 R A relevant institution must not appoint as auditor a person who is disqualified under Part 22 of the Act (Auditors and Actuaries), including as applied by the Payment Services Regulations or Electronic Money Regulations, from acting as an auditor either for that institution or for a relevant class of institution or firm. 3A.4.5 G If it appears to the FCA that an auditor of a relevant institution has failed to comply with a duty imposed on them, it may take disciplinary measures, including disqualification of the auditor, under section 345 of the Act as applied by the Payment Services Regulations and the Electronic Money Regulations. A list of persons who are disqualified may be found on the FCA’s website (www.fca.org.uk). Requests for information by the FCA 3A.4.6 R A relevant institution must take reasonable steps to ensure that an auditor, which it is planning to appoint or has appointed, provides information to the FCA about the auditor’s qualifications, skills, experience and independence in accordance with the reasonable requests of the FCA.

FCA 2025/38 Page 67 of 116 3A.4.7 G To enable it to assess the ability of an auditor to audit a relevant institution, the FCA may seek information about the auditor’s relevant experience and skill. The FCA will normally seek information in writing from an auditor who has not previously audited a relevant institution. The relevant institution should instruct the auditor to provide a full reply (and should not appoint an auditor who does not reply to the FCA). The FCA may also seek further information on a continuing basis from the auditor of a relevant institution (see also the auditor’s duty to cooperate under SUP 3A.8.2R). 3A.5 Auditors’ independence Purpose 3A.5.1 G To carry out their duties properly, an auditor needs to be independent of the institution they are auditing so they are not subject to conflicts of interest. Many relevant institutions are also subject to requirements under the Companies Act 2006 on auditors’ independence. Independence 3A.5.2 R A relevant institution must take reasonable steps to ensure that the auditor which it appoints is independent of the institution. 3A.5.3 R If a relevant institution becomes aware at any time that its auditor is not independent of the institution, it must take reasonable steps to ensure that it has an auditor independent of the institution. The relevant institution must notify the FCA if independence is not achieved within a reasonable time. 3A.5.4 G The FCA will regard an auditor as independent if their appointment or retention does not breach the ethical guidance in current issue from the auditor’s recognised supervisory body on the appointment of an auditor in circumstances which could give rise to conflicts of interest. 3A.6 Relevant institutions’ cooperation with their auditors 3A.6.1 R A relevant institution must cooperate with its auditor in the discharge of the auditor’s duties under this chapter. Auditor’s access to accounting records 3A.6.2 G In complying with SUP 3A.6.1R, a relevant institution should give a right of access at all times to the institution’s accounting and other records, in whatever form they are held, and documents relating to its business. A relevant institution should allow its auditor to copy documents or other material on the premises of the institution and to remove copies or hold them elsewhere, or give its auditor such copies on request. 3A.6.3 G Section 341 of the Act (Access to books etc.), as applied by the Payment Services Regulations and the Electronic Money Regulations, provides that an auditor of a relevant institution appointed under SUP 3A.3:

FCA 2025/38 Page 68 of 116 (1) has a right of access at all times to the relevant institution’s books, accounts and vouchers; and (2) is entitled to require from the relevant institution’s officers such information and explanations as they reasonably consider necessary for the performance of their duties as auditor. 3A.6.4 G Sections 499 and 500 of the Companies Act 2006 give similar rights to auditors of companies. 3A.6.5 G Section 413 (Protected items) of the Act, as applied by the Payment Services Regulations and the Electronic Money Regulations, under which no person may be required to produce, disclose or permit the inspection of protected items, is relevant to SUP 3A.6.1R and SUP 3A.6.3G. Access and cooperation: agents, distributors, operational outsourcing, employees 3A.6.6 G In complying with SUP 3A.6.1R, a relevant institution should take reasonable steps to ensure that each of its agents and distributors gives the institution’s auditor the same rights of access to the books, accounts and vouchers of the agent or distributor and entitlement to information and explanations from the agent’s or distributor’s officers as are given in respect of the relevant institution by section 341 of the Act, as applied by the Payment Services Regulations and the Electronic Money Regulations. 3A.6.7 G In complying with SUP 3A.6.1R, a relevant institution should take reasonable steps to ensure that each of its suppliers under a material outsourcing arrangement gives the institution’s auditor the same rights of access to the books, accounts and vouchers of the institution held by the supplier, and entitlement to information and explanations from the supplier’s officers as are given in respect of the relevant institution by section 341 of the Act, as applied by the Payment Services Regulations and the Electronic Money Regulations. 3A.6.8 G In complying with SUP 3A.6.1R, a relevant institution should take reasonable steps to ensure that all its employees cooperate with its auditor in the discharge of its auditor’s duties under this chapter. Provision of false or misleading information to auditors 3A.6.9 G Relevant institutions and their officers, managers and controllers are reminded that, under section 346 of the Act (Provision of false or misleading information to auditor or actuary), as applied by the Payment Services Regulations and the Electronic Money Regulations, knowingly or recklessly giving false information to an auditor appointed under SUP 3A.3 constitutes an offence in certain circumstances, which could render them liable to prosecution. This applies even when an auditor is also appointed under an obligation in another enactment. 3A.7 Notification of matters raised by auditor

FCA 2025/38 Page 69 of 116 Notification 3A.7.1 G A relevant institution should consider whether it should notify the FCA under Principle 11 if it receives a written communication from its auditor commenting on internal controls. 3A.8 Rights and duties of auditors Purpose 3A.8.1 G The auditor of a relevant institution has various rights and duties that enable or require them to obtain information from the institution and pass information to the FCA in specified circumstances. This section imposes or gives guidance on those rights and duties. Cooperation with the FCA 3A.8.2 R An auditor of a relevant institution must cooperate with the FCA in the discharge of its functions under the Payment Services Regulations and the Electronic Money Regulations. 3A.8.3 G The FCA may ask the auditor to attend meetings and to supply it with information about the institution. In complying with SUP 3A.8.2R, the auditor should attend such meetings as the FCA requests and supply it with any information the FCA may reasonably request about the relevant institution to enable the FCA to discharge its functions under the Payment Services Regulations and the Electronic Money Regulations. 3A.8.4 R An auditor of a relevant institution must give any skilled person appointed by the institution or the FCA all assistance that person reasonably requires (see section 166(7) of the Act (Reports by skilled persons), as applied by the Payment Services Regulations and the Electronic Money Regulations). Auditor’s independence 3A.8.5 R An auditor of a relevant institution must be independent of the institution in performing their duties in respect of that institution. 3A.8.6 R An auditor of a relevant institution must take reasonable steps to satisfy themself that they are free from any conflict of interest in respect of that institution from which bias may reasonably be inferred. An auditor must take appropriate action where this is not the case. 3A.8.7 G SUP 3A.5.4G explains that an auditor whose appointment does not breach the ethical guidance in current issue from the auditor’s recognised supervisory body will be regarded as independent by the FCA. Auditors’ rights to information 3A.8.8 G SUP 3A.6.1R requires a relevant institution to cooperate with its auditor. SUP 3A.6.3G refers to the rights to information which an auditor is granted

FCA 2025/38 Page 70 of 116 by the Act, as applied by the Payment Services Regulations and the Electronic Money Regulations. SUP 3A.6.4G refers to similar rights granted by the Companies Act 2006. Communication between the FCA, the relevant institution and the auditor 3A.8.9 G Within the legal constraints that apply, the FCA may pass on to an auditor any information which it considers relevant to the auditor’s function. An auditor is bound by the confidentiality provisions set out in Part XXIII of the Act (Public record, disclosure of information and cooperation), as applied by the Payment Services Regulations and the Electronic Money Regulations, in respect of confidential information received from the FCA. An auditor may not pass on such confidential information without lawful authority – for example, if an exception applies under the Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (SI 2001/2188), as applied by the Payment Services Regulations and the Electronic Money Regulations, or with the consent of the person from whom that information was received and (if different) to whom that information relates. Auditors’ statutory duty to report 3A.8.10 G (1) Statutory auditors of safeguarding institutions are subject to regulation 24(3) of the Payment Services Regulations and regulation 25(3) of the Electronic Money Regulations. Those regulations require statutory auditors to communicate matters of material significance to the FCA. (2) A failure to safeguard relevant funds will usually be of material significance, so should be communicated to the FCA. This is especially the case where an institution claims not to be required to safeguard relevant funds at all. (3) Sections 342(3) and 343(3) of the Act, as applied by the Payment Services Regulations and the Electronic Money Regulations, provide that an auditor does not contravene any duty by giving information or expressing an opinion to the FCA, if they are acting in good faith and reasonably believe that the information or opinion is relevant to any functions of the FCA. These provisions continue to have effect after the end of the auditor’s term of appointment. Termination of term of office 3A.8.11 R An auditor must notify the FCA without delay if they: (1) are removed from office by a relevant institution; (2) resign before their term of office expires; or (3) are not reappointed by a relevant institution.

FCA 2025/38 Page 71 of 116 3A.8.12 R If an auditor ceases to be, or is formally notified that they will cease to be, the auditor of a relevant institution, they must notify the FCA without delay: (1) of any matter connected with the ceasing of their appointment which the auditor thinks ought to be drawn to the FCA’s attention; or (2) that there is no such matter. 3A.9 Duties of auditors: notification and safeguarding report Auditor’s safeguarding report: content 3A.9.1 R An external auditor of a relevant institution must prepare a safeguarding report addressed to the FCA which: (1) states the matters set out in SUP 3A.9.2R; (2) specifies the matters to which SUP 3A.9.11R and SUP 3A.9.12R refer; and (3) is prepared in accordance with the terms of a reasonable assurance engagement. Auditor’s safeguarding report 3A.9.2 R The auditor’s safeguarding report must state whether, in the auditor’s opinion: (1) the relevant institution has maintained systems adequate to enable it to comply with the relevant funds regime throughout the period; and (2) the relevant institution was in compliance with the relevant funds regime at the end of the period covered by the report. 3A.9.3 R The auditor’s safeguarding report must be: (1) in the form prescribed by SUP 3A Annex 1; and (2) signed on behalf of the audit firm by the individual with primary responsibility for the relevant institution’s safeguarding report and in that individual’s own name. 3A.9.4 G SUP 3A.9.1R provides that an auditor must ensure that a safeguarding report is prepared in accordance with the terms of a reasonable assurance engagement. The FCA also expects an auditor to have regard, where relevant, to material published by the Financial Reporting Council that deals specifically with the safeguarding report which the auditor is required to submit to the FCA. In the FCA’s view, a safeguarding report that is prepared in accordance with that material is likely to comply with SUP

FCA 2025/38 Page 72 of 116 3A.9.1R and SUP 3A.9.2R where that report is prepared for a relevant institution within the scope of the material in question. 3A.9.5 R (1) An auditor must ensure that the information provided to it by a relevant institution in accordance with SUP 3A.10.1G is included in the safeguarding report. (2) If by the date at which the report is due for submission in accordance with SUP 3A.9.7R an auditor has not received the information referred to in SUP 3A.10.1G it must submit the report without that information, together with an explanation for its absence. Auditor’s safeguarding report: period covered 3A.9.6 R The period covered by an auditor’s safeguarding report must end not more than 53 weeks after the later of: (1) the date the relevant institution first becomes subject to this chapter; (2) the date the relevant institution becomes subject to this chapter after being exempt in accordance with SUP 3A.1.1R(2); or (3) the end of the period covered by the previous report. Auditor’s safeguarding report: timing of submission 3A.9.7 R The auditor of a relevant institution must deliver their safeguarding report to the FCA within 4 months of the end of the period covered. 3A.9.8 R (1) If an auditor expects that it will fail to comply with SUP 3A.9.7R, it must, no later than the end of the 4-month period in question: (a) notify the FCA that it expects that it will be unable to deliver a safeguarding report by the end of that period; and (b) ensure that the notification in (a) is accompanied by a full account of the reasons for its expected failure to comply with SUP 3A.9.7R. (2) If an auditor fails to comply with SUP 3A.9.7R, it must promptly: (a) notify the FCA of that failure; and (b) ensure that the notification in (a) is accompanied by a full account of the reasons for its failure to comply with SUP 3A.9.7R. 3A.9.9 G The rights and duties of auditors are set out in SUP 3A.8 (Rights and duties of auditors) and SUP 3A.9 (Duties of auditors: notification and safeguarding report). An auditor should bear these rights and duties in mind when carrying out safeguarding report work, including whether anything should be notified to the FCA immediately.

FCA 2025/38 Page 73 of 116 3A.9.10 R An auditor must: (1) provide the relevant institution with a draft of its safeguarding report so it has an adequate period of time to consider the auditor’s findings and provide the auditor with comments of the kind referred to in SUP 3A.10.1G; and (2) deliver a copy of the final report to the relevant institution at the same time as it delivers that report to the FCA in accordance with SUP 3A.9.7R. Auditor’s safeguarding report: requirements not met or inability to form opinion 3A.9.11 R If the auditor’s safeguarding report states that one or more of the requirements in SUP 3A.9.2R have not been met, the auditor must specify in the report each of those requirements and the respects in which they have not been met. 3A.9.12 R (1) Whether or not an auditor concludes that one or more of the requirements in SUP 3A.9.2R have been met, the auditor must ensure that the safeguarding report identifies each individual regulation or rule in respect of which a breach has been identified. (2) If an auditor does not identify a breach of any individual regulation or rule, it must include a statement to that effect in the safeguarding report. 3A.9.13 R For the purpose of SUP 3A.9.11R and SUP 3A.9.12R, an auditor must ensure that the information prescribed under those rules is submitted using, respectively, Part 1 (Auditor’s Opinion) and Part 2 (Breaches Schedule) of SUP 3A Annex 1. 3A.9.14 G (1) The FCA expects that the list of breaches will include every breach of a regulation or rule in the relevant funds regime insofar as that regulation or rule is within the scope of the safeguarding report and is identified in the course of the auditor’s review of the period covered by the report, whether identified by the auditor or disclosed to it by the relevant institution, or by any third party. (2) For the purpose of determining whether to qualify its opinion or express an adverse opinion, the FCA would expect an auditor to exercise its professional judgment as to the significance of a breach of a regulation or rule, as well as to its context, duration and incidence of repetition. The FCA would expect an auditor to consider the aggregate effect of any breaches when judging whether a relevant institution had failed to comply with the requirements in SUP 3A.9.2R. 3A.9.15 R If an auditor is unable to form an opinion as to whether one or more of the applicable requirements in SUP 3A.9.2R have been met, the auditor must

FCA 2025/38 Page 74 of 116 specify in the report under SUP 3A.9.1R those requirements and the reasons why the auditor has been unable to form an opinion. Method of submission of reports 3A.9.16 R An auditor of a relevant institution must submit their safeguarding report by electronic means made available by the FCA. 3A.10 Review of auditor’s safeguarding report 3A.10.1 G A relevant institution should ensure that: (1) it considers the draft safeguarding report provided to the institution by its auditor in accordance with SUP 3A.9.10R(1) in order to provide an explanation of: (a) the circumstances that gave rise to each of the breaches identified in the draft report; and (b) any remedial actions that it has undertaken or plans to undertake to correct those breaches; and (2) the explanation provided in accordance with (1): (a) is submitted to its auditor in a timely fashion and in any event before the auditor is required to deliver a report to the FCA in accordance with SUP 3A.9.7R; and (b) is recorded in the relevant field in the draft report submitted to it by its auditor. 3A.10.2 R A relevant institution must ensure that the final safeguarding report delivered to it in accordance with SUP 3A.9.10R(2) is reported to the institution’s governing body. 3A.10.3 G The FCA expects a relevant institution to use the safeguarding report as a tool to evaluate the effectiveness of the systems it has in place for the purpose of complying with the requirements in SUP 3A.9.2R. Accordingly, a relevant institution should ensure that the report is integrated into its risk management framework and decision-making. 3A.10.4 G SUP 3A.4.2R provides that a relevant institution must take reasonable steps to ensure that its auditor has the required skill, resources and experience to perform its functions. The FCA expects a relevant institution to keep under review the adequacy of the skill, resources and experience of its auditor and critically assess the content of the safeguarding report as part of that ongoing review. 3A Annex 1 Auditor’s safeguarding report

FCA 2025/38 Page 75 of 116 [Editor’s Note: The use of italics in the following provisions of SUP 3A Annex 1 indicate text to be completed in the Auditor’s safeguarding report and are not indicative of terms in the Glossary of Definitions.] 3A Annex 1.1 R Independent auditor’s report on safeguarding to the Financial Conduct Authority in respect of [institution name], firm reference number [number], for the period started [dd/mm/yyyy] and ended [dd/mm/yyyy] Part 1: Auditor’s Opinion on Safeguarding We report in respect of [institution name] (‘the institution’) on the matters set out below for the period started [dd/mm/yyyy] and ended [dd/mm/yyyy] (‘the period’). Our report has been prepared as required by SUP 3A.9.1R and is addressed to the Financial Conduct Authority (‘the FCA’) in its capacity as regulator of payment institutions and electronic money institutions under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011. Basis of opinion We have carried out such procedure as we considered necessary for the purposes of this report in accordance with [specify Standard/Guidance used] issued by the [specify organisation name]. This opinion relates only to the period and should not be seen as providing assurance as to any future position, as changes to systems or control procedures may alter the validity of our opinion. Opinion In our opinion: [The institution has maintained] [Except for….the institution has maintained] [Because of….the institution did not maintain] systems adequate to enable it to comply with the relevant funds regime throughout the period since [the last date at which a report was made] [the institution was authorised or registered] [the institution became subject to SUP 3A.10 and we, its auditor, became subject to SUP 3A.9].* [The institution was] [Except for…the institution was] [Because of….the institution was not] in compliance with the relevant funds regime as at the period end date.* Other matters The report should be read in conjunction with the Breaches Schedule that we have prepared and which is appended to it. [Signature of the partner/individual with primary responsibility within the audit firm] [Typed name of signing individual]

FCA 2025/38 Page 76 of 116 For and on behalf of [Name of the audit firm] [Registered office] [Date of report] Instructions for Part 1

• If the auditor expresses an adverse opinion (ie, states the institution ‘did not maintain…’ or ‘was not in compliance…’) they must set out the reasons why. This can be done by reference to items in columns A to D in Part 2 of the auditor’s safeguarding report. If the auditor expresses a qualified opinion (ie, states that ‘except for …., the institution has maintained’ or that ‘except for …., the institution was in compliance’) they must do so by reference to items in columns A to D in Part 2 of the auditor’s safeguarding report. 3A Annex 1.2 R Part 2: Identified breaches of the relevant funds regime that occurred during the period [Institution name], firm reference number [number], for the period started [dd/mm/yyyy] and ended [dd/mm/yyyy] In accordance with SUP 3A.9.13R, Columns A to D are to be completed by and are the responsibility of the auditor. In accordance with SUP 3A.10.1G, Column E should be completed by the institution. The auditor has no responsibility for the content of Column E. Column A Column B Column C Column D Column E Item No. Regulation or Rule Reference(s) Identifying party Breach Identified Institution’s Comment 1 … Instructions for Part 2: In Columns A to D of the above schedule, the auditor is to set out all the breaches of the relevant funds regime by the institution that occurred during the period subject to the auditor’s report. These must include the breaches the auditor has identified through its work (such as in the sample testing of

FCA 2025/38 Page 77 of 116 reconciliations) and breaches identified by the institution or any other party (such as those included in the institution’s breaches register or identified by the FCA). In Column B, the auditor must specify the provision(s) in the Electronic Money Regulations 2011 or Payment Services Regulations 2017, and/or rule(s) in CASS 15 the breach relates to. In relation to any breach identified, the auditor must provide in column D any information that it has as respects the severity and duration of the breach identified including, where relevant: (1) the number of times the breach occurred; (2) the longest duration of a single instance of the breach and the value of that instance; (3) the highest value of a single instance of the breach and the duration of that instance; (4) the average value of instances of the breach; and (5) the average duration of instances of the breach. The value of a breach is the amount of any shortfall caused by the breach, or the amount of any relevant funds affected or put at risk by the breach. The auditor must provide a ‘nil’ return for this part of the report where no breach of the relevant funds regime has been identified. In Column E, the institution should set out any remedial actions taken (if any) associated with the breaches cited, together with an explanation of the circumstances that gave rise to the breach in question. Amend the following as shown. 16 Reporting requirements 16.1 Application … 16.1.1AA G … 16.1.1AB R SUP 16.14A applies to safeguarding institutions. … Application of different sections of SUP 16 (excluding SUP 16.13, SUP 16.14A, SUP 16.15, SUP 16.22 and SUP 16.26) …

FCA 2025/38 Page 78 of 116 16.2 Purpose 16.2.1 G … (3) The FCA has supervisory functions under the Payment Services Regulations and the Electronic Money Regulations. In order to discharge these functions, the FCA requires the provision of information on a regular basis. SUP 16.13 sets out the information that the FCA requires from payment service providers to assist it in the discharge of its functions as well as directions and guidance on the periodic reports that are required under the Payment Services Regulations. SUP 16.14A sets out the requirement for safeguarding institutions to submit safeguarding returns under the Electronic Money Regulations and the Payment Services Regulations. SUP 16.15 sets out the information that the FCA requires from electronic money issuers to assist it in discharging its functions and responsibilities under the Electronic Money Regulations. … 16.3 General provisions on reporting … Structure of the chapter 16.3.2 G This chapter has been split into the following sections, covering: … (11) … (11A) safeguarding return: safeguarding institutions (SUP 16.14A); … … Insert the following new section, SUP 16.14A, after SUP 16.14 (Client money and asset return). All the text is new and is not underlined. 16.14A Safeguarding return: safeguarding institutions Application 16.14A.1 R This section applies to safeguarding institutions. Purpose

FCA 2025/38 Page 79 of 116 16.14A.2 G The purpose of the rules and guidance in this section is to ensure that the FCA receives regular and comprehensive information from a safeguarding institution about its safeguarding of relevant funds. Safeguarding return 16.14A.3 R (1) Subject to (3), a safeguarding institution must submit a safeguarding return to the FCA within 15 business days of the end of each month. (2) In this rule, ‘month’ means a calendar month. (3) A safeguarding institution is not required to submit a safeguarding return in respect of a month during which it becomes a safeguarding institution. Method of submission 16.14A.4 R A safeguarding return must be submitted by electronic means made available by the FCA. Application of SUP 16.3 16.14A.5 R The following provisions apply to the submission of safeguarding returns as if references to firms were references to safeguarding institutions: (1) SUP 16.3.11R (Complete reporting); (2) SUP 16.3.13R (Timely reporting), other than paragraph (4); and (3) SUP 16.3.14R (Failure to submit reports). Amend the following as shown. 16 Annex 27CD Authorised Payment Institution Capital Adequacy Return This annex consists only of one or more forms. Firms are required to submit the returns using the electronic means made available by the FCA.

FCA 2025/38 Page 80 of 116 FSA056 Authorised Payment Institution Capital Adequacy Return … Part Three: SUPPLEMENTARY INFORMATION Safeguarding of relevant funds Please indicate which method the firm uses to safeguard relevant funds B C D (Select all that apply and add the appropriate information) Credit institution name Country where the account is located 61 Placed in a separate account with an authorised credit institution Custodian name Country where the account is located 62 Invested in approved secure liquid assets held in a separate account with authorised custodian Insurer name 63 Covered by an insurance policy with an authorised insurer Insurer name 64 Covered by a guarantee from an authorised insurer Credit institution name 65 Covered by a guarantee from an authorised credit institution

FCA 2025/38 Page 81 of 116 …

FCA 2025/38 Page 82 of 116 16 Annex 27D Notes on completing FSA056 (Authorised Payment Institution Capital Adequacy Return – SUP 16 Annex 27CD) 16 Annex 27D.1 G FSA056 Authorised Payment Institution Capital Adequacy Return … 16 Annex 27D.2 G INTRODUCTORY MATTERS … 16 Annex 27D.3 G Part One: CAPITAL REQUIREMENT … 16 Annex 27D.4 G Part Two: TOTAL CAPITAL RESOURCES … 16 Annex 27D.5 G Part three: SUPPLEMENTARY INFORMATION SAFEGUARDING OF RELEVANT FUNDS You must select the relevant box(es) to identify the method(s) used by the firm to safeguard relevant funds. At least one of the boxes in ‘Elements 61 to 65’ must be selected. … 16 Annex 27D.6 G Part Four: PROVIDERS OF ACCOUNT INFORMATION AND/OR PAYMENT INITIATION SERVICES … … 16 Annex 28CD Small Payment Institution Return

FCA 2025/38 Page 83 of 116 This annex consists only of one or more forms. Firms are required to submit the returns using the electronic means made available by the FCA. …

FCA 2025/38 Page 84 of 116 FSA057 Payment Services Directive Transactions … Safeguarding of relevant funds … If you have answered YES to question 4, Please indicate which method(s) the firm uses to safeguard relevant funds A B C (Select all that apply and add the appropriate information) Credit institution name Country where the account is located 5 Placed in a separate account with an authorised credit institution Custodian name Country where the account is located 6 Invested in approved secure liquid assets held in a separate account with authorised custodian Insurer name 7 Covered by an insurance policy with an authorised insurer Insurer name 8 Covered by a guarantee from an authorised insurer Credit institution name 9 Covered by a guarantee from an authorised credit institution …

FCA 2025/38 Page 85 of 116 16 Annex 28D Notes on completing FSA057 (Small Payment Institution Return) 16 Annex 28D.1 G FSA057 Payment Services Directive Transactions … 16 Annex 28D.2 G INTRODUCTORY MATTERS … 16 Annex 28D.3 G TRANSACTION AND USER INFORMATION … 16 Annex 28D.4 G SAFEGUARDING OF CLIENT ASSETS Element 4A: State whether you voluntarily safeguard relevant funds. Under the PSRs 2017, small PIs can choose to comply with safeguarding requirements in order to offer the same protections over customer funds as authorised PIs must provide. If an SPI does choose to safeguard they will need to apply the same levels of protection as are expected of an authorised PI. We will expect an SPI to tell us if it is choosing to safeguard funds. SPIs that answer ‘No’ to this question should move to the Number of Agents section. If you answer ‘Yes’, to this question you must select the relevant box(es) to identify the method(s) used by the firm to safeguard relevant funds and answer the relevant questions relating to this method. At least one of the boxes in elements 5 to 9 must be selected to this question, you will be scheduled to receive the safeguarding return that you will need to complete monthly. 16 Annex 28D.5 G NUMBER OF AGENTS … 16 Annex 28D.6 G PAYMENT SYSTEMS

FCA 2025/38 Page 86 of 116 … Insert the following new Annex, SUP 16 Annex 29BR, after SUP 16 Annex 29A (Guidance notes for the data item in SUP 16 Annex 29R). All the text is new and is not underlined. [Editor’s note: the below table is for illustrative purposes only. The online form in RegData reflects design and user experience considerations.] 16 Annex 29BR Safeguarding return This annex consists only of one or more forms. Safeguarding institutions are required to submit the returns using the electronic means made available by the FCA. [Editor’s note: insert link to safeguarding return form.] [Editor’s Note: The use of italics in the following form indicate instructions for completing the safeguarding return and are not indicative of terms in the Glossary of Definitions.]

FCA 2025/38 Page 87 of 116 Safeguarding return Section 1 – Safeguarding institution Information This section should be completed by all safeguarding institutions

1. Name and category of safeguarding institution Name Category1
2. Was the safeguarding institution a relevant institution as specified in SUP 3A.1.1R(1)(a) during the reporting period2? Yes / No – not in scope / No - exempt
3. If the answer to question 2 was ‘no’, will the safeguarding institution voluntarily arrange an audit in accordance with SUP 3A.1.3G in respect of the reporting period? Yes / No 1 Authorised payment institution (API), small payment institution that has opted into safeguarding (SPI opt-in), electronic money institution (EMI), electronic money institution that provides payment services unrelated to the issuance of electronic money (EMI + UPS), small electronic money institution (SEMI), small electronic money institution that has opted into safeguarding for payment services unrelated to the issuance of electronic money (SEMI opt-in), credit union that issues electronic money (credit union), credit union that issues electronic money and has opted into safeguarding for payment services unrelated to the issuance of electronic money (credit union opt-in). EMI + UPS, SEMI opt-ins and credit union opt-ins should fill out sections 2 to 9 in respect of the issuance of electronic money and related payment services. They should fill out sections 10 to 17 in respect of payment services unrelated to the issuance of electronic money. 2 Safeguarding institutions that are not of a type referred to in SUP 3A.1.1R(1)(a) should select ‘no – not in scope’. Those that are exempt in accordance with SUP 3A.1.1R(2) should select ‘no – exempt’.

FCA 2025/38 Page 88 of 116 4. If the answer to question 2 or 3 was ‘yes’, and a safeguarding report has previously been submitted in respect of the safeguarding institution in accordance with SUP 3A.9, please complete the following fields: Date of last auditor’s safeguarding report1F Name of audit firm2F 3 Section 2 – Safeguarding This section should be completed by all safeguarding institutions 5. Was the safeguarding institution required to safeguard relevant funds in accordance with the Electronic Money Regulations or Payment Services Regulations during the reporting period? Yes / No 6. If the answer to question 5 was ‘yes’, please fill out the following table: Method Please indicate which method(s) were used during the reporting period (select as many as are relevant) Please indicate which method was used at the time of the last internal safeguarding reconciliation carried out in the reporting period The segregation method only 3 The electronic means for submitting the return may contain a pre-populated list of auditors. It is not possible to list all auditors. However, certain auditors may be named for convenience, and the FCA does not in any way recommend or endorse any auditors that are named. If the name of the auditor is inserted in a free text field, please use the full legal name of the firm and not, for example, a trading name.

FCA 2025/38 Page 89 of 116 The insurance or guarantee method only A combination of the segregation method and the insurance or guarantee method at the same time 7. If the answer to question 5 was ‘yes’, how many clients was the safeguarding institution safeguarding relevant funds for at the end of the reporting period? 8. If the answer to question 5 was ‘yes’, did the safeguarding institution use a non-standard method of internal safeguarding reconciliation during the reporting period? Yes / No Section 3 – Balances This section should only be completed if the answer to question 5 was ‘yes’ Amount of relevant funds safeguarded 9. Highest safeguarding requirement during the reporting period (£)4 4 Where the safeguarding requirement was expressed in currencies other than GBP, that amount should be converted into GBP using the closing spot exchange rate for the day before the date of the safeguarding requirement.

FCA 2025/38 Page 90 of 116 10. Lowest safeguarding requirement during the reporting period (£)5 Section 4 – Safeguarding relevant funds This section should only be completed if the answer to question 5 was ‘yes’ Segregated relevant funds 11. If any relevant funds were held in accounts in accordance with the segregation method during the reporting period, please fill out the following table: Institution where relevant funds were held by the safeguarding institution3F 6 Type of account (relevant funds bank account or other)5F 7 Number of accounts containing relevant funds held with the institution Total amount of relevant funds held with the institution at the end of the reporting period (£)6F 8 Fixed term or notice period7F 9 Country of incorporation of the institution 5 Where the safeguarding requirement was expressed in currencies other than GBP, that amount should be converted into GBP using the closing spot exchange rate for the day before the date of the safeguarding requirement. 6 When filling in the name of the institution use the full legal name and not, for example, a trading name. 7 Where relevant funds are held in more than one type of account at an institution, a different row should be used for each type of account. A different row should also be used for each fixed term account and each account with a notice period for making a withdrawal. All accounts categorised as ‘other’ should be treated as the same type of account. 8 The figures in this column should reflect the figures used in the last internal safeguarding reconciliation carried out in the reporting period. Where more than one row is used for an institution, the figure should be the same for all rows relating to that institution. Any figures expressed in currencies other than GBP should be converted into GBP using the closing spot exchange rate for the day before that reconciliation. 9 Please use ‘FT’ to indicate a fixed term and ‘NP’ to indicate a notice period. Please put ‘N/A’ if the account is not a fixed term account and there is no notice period for making a withdrawal.

FCA 2025/38 Page 91 of 116 Total Secure liquid assets 12 If any relevant assets were held during the reporting period, please fill out the following table: Asset8F 10 If the asset is of a type referred to in CASS 15.4.2G, please indicate which paragraph(s) of Article 114 of the UK CRR the asset complies with Please indicate in this column if the asset is not of a type referred to in CASS 15.4.2G 2 (ECAI credit assessment corresponding to a risk weight of no more than 0%) 3 (exposure to the ECB) 4 (exposure to HMG or the Bank of England in sterling) 7 (exposure to a third country government or central bank assigned a risk weight of no more than 0% by equivalent competent authorities) 13. Please fill out the following table in respect of the relevant assets listed in the table in question 12: 10 This includes units in UCITS, in which case please treat each UCITS as an asset. Please put the name of the UCITS in this column and indicate in the other columns what type(s) of asset(s) the UCITS invests in, selecting as many as are relevant.

FCA 2025/38 Page 92 of 116 Name of custodian9F 11 Asset.12 Total value of relevant assets held with the custodian at the end of the reporting period10F 13 Total Insurance policies and guarantees 14. If any relevant funds were protected through an insurance policy in accordance with the insurance or guarantee method during the reporting period, please fill out the following table: Name of insurer(s)1F 14 Maximum amount of cover provided by the policy (£)15 Date of expiry of the insurance policy Total overdue premiums (£)2F ( 16 11 When filling in the name of the custodian use the full legal name and not, for example, a trading name. 12 This column should be in the same terms as the column headed ‘asset’ in question 12. Where more than one asset is held with a custodian, a different row should be used for each asset. The figure in the final column should be the same for all entries relating to the same custodian. 13 The figures in this column should reflect the figures used in the last internal safeguarding reconciliation carried out in the reporting period. Any figures expressed in currencies other than GBP should be converted into GBP using the closing spot exchange rate for the day before that reconciliation. 14 When filling in the name of the insurer use the full legal name and not, for example, a trading name. Where more than one policy is held with an insurer, list them separately. 15 The figures in this column should reflect the figures used in the last internal safeguarding reconciliation carried out in the reporting period. If an insurance policy is unlimited in the amount of cover it provides the relevant field should be filled out with the safeguarding requirement. If this is expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before that reconciliation. 16 A premium is overdue if it, or part of it, has not been paid in full and the date it is to be paid by has passed. This column should show the total amount of overdue premiums owed in respect of each policy. If this is expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the last internal safeguarding reconciliation carried out in the reporting period.

FCA 2025/38 Page 93 of 116 15. If any relevant funds were protected through a guarantee in accordance with the insurance or guarantee method during the reporting period, please fill out the following table: Name of guarantor(s)13F 17 Amount of cover provided by the guarantee (£)18 Date of expiry of the guarantee Total overdue premiums (£)4F ( 19 Section 5 – Safeguarding resource and requirement This section should only be completed if the answer to question 5 was ‘yes’ 16. Safeguarding resource from the last internal safeguarding reconciliation carried out in the reporting period (£)20 17 When filling in the name of the guarantor use the full legal name and not, for example, a trading name. Where more than one guarantee is held with a guarantor, list them separately. 18 The figures in this column should reflect the figures used in the last internal safeguarding reconciliation carried out in the reporting period. If a guarantee is unlimited in the amount of cover it provides the relevant field should be filled out with the safeguarding requirement. If this is expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before that reconciliation. 19 A premium is overdue if it, or part of it, has not been paid in full and the date it is to be paid by has passed. This column should show the total amount of overdue premiums owed in respect of each guarantee. If this is expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the last internal safeguarding reconciliation carried out in the reporting period. 20 If this was expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. If relevant funds are safeguarded through an unlimited insurance policy or guarantee this should be the filled out with the safeguarding requirement. That applies whether or not the segregation method is also used.

FCA 2025/38 Page 94 of 116 17. Please fill out the following table in respect of the components of the safeguarding resource referred to in question 16 (see CASS 15.8.26R): Component Total used in the last internal safeguarding reconciliation carried out in the reporting period (£)21 Aggregate balance of funds held in relevant funds bank accounts (less any funds that are not relevant funds in an account of a type described in regulation 21(4A) of the Electronic Money Regulations or regulation 23(9) of the Payment Services Regulations (Bank of England settlement accounts)) Aggregate balance of relevant funds segregated but not placed in a relevant funds bank account or invested in relevant assets Aggregate value of relevant assets Aggregate value of relevant funds protected using the insurance or guarantee method 18. Safeguarding requirement from the last internal safeguarding reconciliation carried out in the reporting period (£)22 19. Please fill out the following table in respect of the components of the safeguarding requirement referred to in question 18 (see CASS 15.8.30R): 21 Where this was expressed in currencies other than GBP, that amount should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. Where a non-standard method of internal safeguarding reconciliation was used, totals should only be provided for those components relevant to the method used. 22 If this was expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation.

FCA 2025/38 Page 95 of 116 Component Total used in the last internal safeguarding reconciliation carried out in the reporting period (£)23 Individual safeguarding balances calculated in accordance with CASS 15.8.31R, ignoring any negative balances Amounts received but unallocated to an individual client under CASS 15.2.5R (Allocation of relevant funds receipts) 20. Excess (+) or shortfall (-) of safeguarding resource against safeguarding requirement identified at the end of the reporting period (£)5F 24 21. Adjustments made to withdraw an excess (-) or rectify a shortfall (+) identified in question 20 (£)6F 25 Section 6 – D+1 segregation resource and requirement26 23 Where this was expressed in currencies other than GBP, that amount should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. Where a non-standard method of internal safeguarding reconciliation was used, totals should only be provided for those components relevant to the method used. 24 This should reflect the outcome of the last internal safeguarding reconciliation carried out in the reporting period. It should show the amount by which the safeguarding resource was greater (an excess) or lower (a shortfall) than the safeguarding requirement, before any adjustment was made to correct any excess or shortfall. If it was calculated in currencies other than GBP, it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. Where an excess or shortfall did not exist, this should be filled out with a ‘0’. 25 This is the amount of funds withdrawn to correct an excess (-), or used to correct a shortfall (+), reported in question 20. If currencies other than GBP were used, the amount should be converted into GBP using the closing spot exchange rate for the day before the last internal safeguarding reconciliation carried out in the reporting period. 26 Where a non-standard method of internal safeguarding reconciliation was used please only answer the questions relevant to the method used.

FCA 2025/38 Page 96 of 116 This section should only be completed if the answer to question 5 was ‘yes’ 22. D+1 segregation resource from the last internal safeguarding reconciliation carried out in the reporting period (£)27 23. D+1 segregation requirement from the last internal safeguarding reconciliation carried out in the reporting period (£)28 24. Shortfall of D+1 segregation resource against D+1 segregation requirement identified at the end of the reporting period17F 29 25. Adjustments made to rectify a shortfall identified in question 2418F 30 27 If this was expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. 28 If this was expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. 29 This should reflect the outcome of the last internal safeguarding reconciliation carried out in the reporting period. It should show the amount by which the D+1 segregation resource was lower (a shortfall) than the D+1 segregation requirement, before any adjustment was made to correct any shortfall. If it was calculated in currencies other than GBP, it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. Where a shortfall did not exist, this should be filled out with a ‘0’. 30 This is the amount of funds used to correct a shortfall reported in question 24. If currencies other than GBP were used, the amount should be converted into GBP using the closing spot exchange rate for the day before the last internal safeguarding reconciliation carried out in the reporting period.

FCA 2025/38 Page 97 of 116 Section 7 – Safeguarding reconciliations This section should only be completed if the answer to question 5 was ‘yes’ 26. Did the safeguarding institution carry out internal safeguarding reconciliation(s) every reconciliation day during the reporting period? Yes / No 27. Did the safeguarding institution carry out external safeguarding reconciliation(s) every reconciliation day during the reporting period? Yes / No Section 8 – Record keeping 28. Please fill out the following table if the table in question 11 and/or 12 was filled out: Number of accounts held at the beginning of the reporting period Number of new accounts opened during the reporting period Number of accounts closed during the reporting period Total number of accounts held at the end of the reporting period (X) Total number of accounts held at the end of the reporting period covered by an acknowledgem ent letter (Y) Explanation of any difference between X and Y Relevant funds bank accounts other than accounts at the Bank of England referred to in regulation 21(4A) of the Electronic Money Regulations or regulation 23(9) of the Payment Services Regulations Relevant assets accounts

FCA 2025/38 Page 98 of 116 Section 9 – Notifiable CASS breaches This section should be completed by all safeguarding institutions 29. Did any of the circumstances referred to in CASS 15.8.60R (notification requirements) arise during the reporting period? Yes / No 30. If yes, did the safeguarding institution comply with the notification requirements? Yes / No Section 10 – Safeguarding (unrelated payment services) This section should be completed by all EMI + UPS, SEMI opt-ins and credit union opt-ins 31. Was the safeguarding institution required to safeguard relevant funds in accordance with regulation 20(6) of the Electronic Money Regulations during the reporting period? Yes / No 32. If the answer to question 31 was ‘yes’, please fill out the following table: Method Please indicate which method(s) were used during the reporting period (select as many as are relevant) Please indicate which method was used at the time of the last internal safeguarding reconciliation carried out in the reporting period The segregation method only

FCA 2025/38 Page 99 of 116 The insurance or guarantee method only A combination of the segregation method and the insurance or guarantee method at the same time 33. If the answer to question 31 was ‘yes’, how many clients was the safeguarding institution safeguarding relevant funds for at the end of the reporting period? 34. If the answer to question 31 was ‘yes’, did the safeguarding institution use a non-standard method of internal safeguarding reconciliation during the reporting period? Yes / No Section 11 – Balances (unrelated payment services) This section should only be completed by EMI + UPS, SEMI opt-ins and credit union opt-ins if the answer to question 31 was ‘yes’ Amount of relevant funds safeguarded 35. Highest safeguarding requirement during the reporting period (£)31 31 Where the safeguarding requirement was expressed in currencies other than GBP, that amount should be converted into GBP using the closing spot exchange rate for the day before the date of the safeguarding requirement.

FCA 2025/38 Page 100 of 116 36. Lowest safeguarding requirement during the reporting period (£)32 Section 12 – Safeguarding relevant funds (unrelated payment services) This section should only be completed by EMI + UPS, SEMI opt-ins and credit union opt-ins if the answer to question 31 was ‘yes’ Segregated relevant funds 37. If any relevant funds were held in accounts in accordance with the segregation method during the reporting period, please fill out the following table: Institution where relevant funds were held by the safeguarding institution3F 33 Type of account (relevant funds bank account or other)5F 34 Number of accounts containing relevant funds held with the institution Total amount of relevant funds held with the institution at the end of the reporting period (£)6F 35 Fixed term or notice period7F 36 Country of incorporation of the institution 32 Where the safeguarding requirement was expressed in currencies other than GBP, that amount should be converted into GBP using the closing spot exchange rate for the day before the date of the safeguarding requirement. 33 When filling in the name of the institution use the full legal name and not, for example, a trading name. 34 Where relevant funds are held in more than one type of account at an institution, a different row should be used for each type of account. A different row should also be used for each fixed term account and each account with a notice period for making a withdrawal. All accounts categorised as ‘other’ should be treated as the same type of account. 35 The figures in this column should reflect the figures used in the last internal safeguarding reconciliation carried out in the reporting period. Where more than one row is used for an institution, the figure should be the same for all rows relating to that institution. Any figures expressed in currencies other than GBP should be converted into GBP using the closing spot exchange rate for the day before that reconciliation. 36 Please use ‘FT’ to indicate a fixed term and ‘NP’ to indicate a notice period. Please put ‘N/A’ if the account is not a fixed term account and there is no notice period for making a withdrawal.

FCA 2025/38 Page 101 of 116 Total Secure liquid assets 38. If any relevant assets were held during the reporting period, please fill out the following table: Asset8F 37 If the asset is of a type referred to in CASS 15.4.2G please indicate which paragraph(s) of Article 114 of the UK CRR the asset complies with Please indicate in this column if the asset is not of a type referred to in CASS 15.4.2G 2 (ECAI credit assessment corresponding to a risk weight of no more than 0%) 3 (exposure to the ECB) 4 (exposure to HMG or the Bank of England in sterling) 7 (exposure to a third country government or central bank assigned a risk weight of no more than 0% by equivalent competent authorities) 39. Please fill out the following table in respect of the relevant assets listed in the table in question 38: 37 This includes units in UCITS, in which case please treat each UCITS as an asset. Please put the name of the UCITS in this column and indicate in the other columns what type(s) of asset(s) the UCITS invests in, selecting as many as are relevant.

FCA 2025/38 Page 102 of 116 Name of custodian9F 38 Asset39 Total value of relevant assets held with the custodian at the end of the reporting period10F 40 Total Insurance policies and guarantees 40. If any relevant funds were protected through an insurance policy in accordance with the insurance or guarantee method during the reporting period, please fill out the following table: Name of insurer(s)1F 41 Maximum amount of cover provided by the policy (£)42 Date of expiry of the insurance policy Total overdue premiums (£)2F ( 43 38 When filling in the name of the custodian use the full legal name and not, for example, a trading name. 39 This column should be in the same terms as the column headed ‘asset’ in question 38. Where more than one asset is held with a custodian, a different row should be used for each asset. The figure in the final column should be the same for all entries relating to the same custodian. 40 The figures in this column should reflect the figures used in the last internal safeguarding reconciliation carried out in the reporting period. Any figures expressed in currencies other than GBP should be converted into GBP using the closing spot exchange rate for the day before that reconciliation. 41 When filling in the name of the insurer use the full legal name and not, for example, a trading name. Where more than one policy is held with an insurer, list them separately. 42 The figures in this column should reflect the figures used in the last internal safeguarding reconciliation carried out in the reporting period. If an insurance policy is unlimited in the amount of cover it provides the relevant field should be filled out with the safeguarding requirement. If this is expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before that reconciliation. 43 A premium is overdue if it, or part of it, has not been paid in full and the date it is to be paid by has passed. This column should show the total amount of overdue premiums owed in respect of each policy. If this is expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the last internal safeguarding reconciliation carried out in the reporting period.

FCA 2025/38 Page 103 of 116 41. If any relevant funds were protected through a guarantee in accordance with the insurance or guarantee method during the reporting period, please fill out the following table: Name of guarantor(s)13F 44 Amount of cover provided by the guarantee (£)45 Date of expiry of the guarantee Total overdue premiums (£)4F ( 46 Section 13 – Safeguarding resource and requirement (unrelated payment services) This section should only be completed by EMI + UPS, SEMI opt-ins and credit union opt-ins if the answer to question 31 was ‘yes’ 42. Safeguarding resource from the last internal safeguarding reconciliation carried out in the reporting period (£)47 44 When filling in the name of the guarantor use the full legal name and not, for example, a trading name. Where more than one guarantee is held with a guarantor, list them separately. 45 The figures in this column should reflect the figures used in the last internal safeguarding reconciliation carried out in the reporting period. If a guarantee is unlimited in the amount of cover it provides the relevant field should be filled out with the safeguarding requirement. If this is expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before that reconciliation. 46 A premium is overdue if it, or part of it, has not been paid in full and the date it is to be paid by has passed. This column should show the total amount of overdue premiums owed in respect of each guarantee. If this is expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the last internal safeguarding reconciliation carried out in the reporting period. 47 If this was expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. If relevant funds are safeguarded through an unlimited insurance policy or guarantee this should be the filled out with the safeguarding requirement. That applies whether or not the segregation method is also used.

FCA 2025/38 Page 104 of 116 43. Please fill out the following table in respect of the components of the safeguarding resource referred to in question 42 (see CASS 15.8.26R): Component Total used in the last internal safeguarding reconciliation carried out in the reporting period (£)48 Aggregate balance of funds held in relevant funds bank accounts (less any funds that are not relevant funds in an account of a type described in regulation 21(4A) of the Electronic Money Regulations or regulation 23(9) of the Payment Services Regulations (Bank of England settlement accounts)) Aggregate balance of relevant funds segregated but not placed in a relevant funds bank account or invested in relevant assets Aggregate value of relevant assets Aggregate value of relevant funds protected using the insurance or guarantee method 44. Safeguarding requirement from the last internal safeguarding reconciliation carried out in the reporting period (£)49 45. Please fill out the following table in respect of the components of the safeguarding requirement referred to in question 44 (see CASS 15.8.30R): 48 Where this was expressed in currencies other than GBP, that amount should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. Where a non-standard method of internal safeguarding reconciliation was used, totals should only be provided for those components relevant to the method used. 49 If this was expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation.

FCA 2025/38 Page 105 of 116 Component Total used in the last internal safeguarding reconciliation carried out in the reporting period (£)50 Individual safeguarding balances calculated in accordance with CASS 15.8.31R, ignoring any negative balances Amounts received but unallocated to an individual client under CASS 15.2.5R (Allocation of relevant funds receipts) 46. Excess (+) or shortfall (-) of safeguarding resource against safeguarding requirement identified at the end of the reporting period (£)5F 51 47. Adjustments made to withdraw an excess (-) or rectify a shortfall (+) identified in question 46 (£)6F 52 Section 14 – D+1 segregation resource and requirement (unrelated payment services)53 50 Where this was expressed in currencies other than GBP, that amount should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. Where a non-standard method of internal safeguarding reconciliation was used, totals should only be provided for those components relevant to the method used. 51 This should reflect the outcome of the last internal safeguarding reconciliation carried out in the reporting period. It should show the amount by which the safeguarding resource was greater (an excess) or lower (a shortfall) than the safeguarding requirement, before any adjustment was made to correct any excess or shortfall. If it was calculated in currencies other than GBP, it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. Where an excess or shortfall did not exist, this should be filled out with a ‘0’. 52 This is the amount of funds withdrawn to correct an excess (-), or used to correct a shortfall (+), reported in question 46. If currencies other than GBP were used, the amount should be converted into GBP using the closing spot exchange rate for the day before the last internal safeguarding reconciliation carried out in the reporting period. 53 Where a non-standard method of internal safeguarding reconciliation was used please only answer the questions relevant to the method used.

FCA 2025/38 Page 106 of 116 This section should only be completed by EMI + UPS, SEMI opt-ins and credit union opt-ins if the answer to question 31 was ‘yes’ 48. D+1 segregation resource from the last internal safeguarding reconciliation carried out in the reporting period (£)54 49. D+1 segregation requirement from the last internal safeguarding reconciliation carried out in the reporting period (£)55 50. Shortfall of D+1 segregation resource against D+1 segregation requirement identified at the end of the reporting period17F 56 51. Adjustments made to rectify a shortfall identified in question 5018F 57 54 If this was expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. 55 If this was expressed in a currency other than GBP it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. 56 This should reflect the outcome of the last internal safeguarding reconciliation carried out in the reporting period. It should show the amount by which the D+1 segregation resource was lower (a shortfall) than the D+1 segregation requirement, before any adjustment was made to correct any shortfall. If it was calculated in currencies other than GBP, it should be converted into GBP using the closing spot exchange rate for the day before the internal safeguarding reconciliation. Where a shortfall did not exist, this should be filled out with a ‘0’. 57 This is the amount of funds used to correct a shortfall reported in question 50. If currencies other than GBP were used, the amount should be converted into GBP using the closing spot exchange rate for the day before the last internal safeguarding reconciliation carried out in the reporting period.

FCA 2025/38 Page 107 of 116 Section 15 – Safeguarding reconciliations (unrelated payment services) This section should only be completed by EMI + UPS, SEMI opt-ins and credit union opt-ins if the answer to question 31 was ‘yes’ 52. Did the safeguarding institution carry out internal safeguarding reconciliation(s) every reconciliation day during the reporting period? Yes / No 53. Did the safeguarding institution carry out external safeguarding reconciliation(s) every reconciliation day during the reporting period? Yes / No Section 16 – Record keeping (unrelated payment services) 54. Please fill out the following table if the table in question 37 and/or 38 was filled out: Number of accounts held at the beginning of the reporting period Number of new accounts opened during the reporting period Number of accounts closed during the reporting period Total number of accounts held at the end of the reporting period (X) Total number of accounts held at the end of the reporting period covered by an acknowledgem ent letter (Y) Explanation of any difference between X and Y Relevant funds bank accounts other than accounts at the Bank of England referred to in regulation 21(4A) of the Electronic Money Regulations or regulation 23(9) of the Payment Services Regulations Relevant assets accounts

FCA 2025/38 Page 108 of 116 Section 17 – Notifiable CASS breaches (unrelated payment services) This section should be completed by all EMI + UPS, SEMI opt-ins and credit union opt-ins 55. Did any of the circumstances referred to in CASS 15.8.60R (notification requirements) arise during the reporting period? Yes / No 56. If yes, did the safeguarding institution comply with the notification requirements? Yes / No

FCA 2025/38 Page 109 of 116 Amend the following as shown. 16 Annex 30HD Authorised electronic money institution questionnaire This annex consists only of one or more forms. Firms are required to submit the returns using the electronic means made available by the FCA. ...

FCA 2025/38 Page 110 of 116 FIN060a Authorised Electronic Money Institution Questionnaire … Section 6: Method of Safeguarding A B C D E-money Unrelated Payment Services Credit institution name Country where the account is located 64 Placed in a separate account with an authorised credit institution Custodian name Country where the account is located 65 Invested in approved secure liquid assets held in a separate account with an authorised custodian Insurer name 66 Covered by an insurance policy with an authorised insurer Insurer name 67 Covered by a guarantee from an authorised insurer Credit institution name 68 Covered by a guarantee from an authorised credit institution …

FCA 2025/38 Page 111 of 116 16 Annex 30I Notes on completing authorised electronic money institution questionnaire 16 Annex 30I.1 G FIN060a Authorised Electronic Money Institution Questionnaire … 16 Annex 30I.2 G Section 1: Income Statement … 16 Annex 30I.3 G Section 2: EMRs and PSRs 2017 activity … 16 Annex 30I.4 G Section 3: Net capital resources … 16 Annex 30I.5 G Section 4: Capital requirements for unrelated payment services … 16 Annex 30I.6 G Section 5: Overall capital requirements … 16 Annex 30I.7 G Section 6: Method of Safeguarding [deleted] You must select the relevant box(es) to identify the method(s) used by the firm to safeguard relevant funds. You must provide separate safeguarding information for relevant funds received in exchange for e-money that has been issued and (where relevant) relevant funds received for the purposes of executing unrelated payment transactions. If you do not provide unrelated payment services you do not need to answer elements 64 to 68.

FCA 2025/38 Page 112 of 116 16 Annex 30I.8 G Section 7: Agents … 16 Annex 30I.9 G Section 8: Payment systems … 16 Annex 30I.10 G Section 9: Providers of account information services or payment initiation services … 16 Annex 30JD Small electronic money institution questionnaire This annex consists only of one or more forms. Firms are required to submit the returns using the electronic means made available by the FCA. …

FCA 2025/38 Page 113 of 116 FIN060b Small E-money Institution Questionnaire … Section 6: Method of Safeguarding A B C D Electronic Money Unrelated Payment Services Credit institution name Country where the account is located 38 Placed in a separate account with an authorised credit institution Custodian name Country where the account is located 39 invested in approved secure liquid assets held in a separate account with an authorised custodian Insurer name 40 Covered by an insurance policy with an authorised insurer Insurer name 41 Covered by a guarantee from an authorised insurer

FCA 2025/38 Page 114 of 116 Credit institution name 42 Covered by a guarantee from an authorised credit institution …

FCA 2025/38 Page 115 of 116 16 Annex 30K Notes on completing small e-money institution questionnaire 16 Annex 30K.1 G FIN060b Small E-Money Institution Questionnaire … 16 Annex 30K.2 G Section 1: Income Statement … 16 Annex 30K.3 G Section 2: EMRs and PSRs 2017 activity … 16 Annex 30K.4 G Section 3: Capital requirements for e-money … 16 Annex 30K.5 G Section 4: Net capital resources … 16 Annex 30K.6 G Section 6: Method of Safeguarding [deleted] You must select the relevant box(es) to identify the method(s) used by the firm to safeguard relevant funds. You must provide separate safeguarding information for relevant funds received in exchange for e-money that has been issued and (where relevant) relevant funds received for the purposes of executing unrelated payment transaction. If you do not provide unrelated payment services you do not need to answer elements 36 to 42.

FCA 2025/38 Page 116 of 116 16 Annex 30K.7 G Section 7: Agents … … TP1 Transitional Provisions … TP 1.2 (1) (2) Material to which the transitional provision applies (3) (4) Transitional provision (5) Transitional provision: dates in force (6) Handbook provision: coming into force … 3C … … … … … 3D SUP 3A.1.1 R In paragraph (2) for ‘over a period of at least 53 weeks’ substitute ‘since this rule came into force’. From 7 May 2026 until 14 May 2027 7 May 2026 3E SUP 3A.9.7 R If the period covered ends within 53 weeks of the rule in column 2 coming into force, the safeguarding report must be delivered within 6 months of the end of the period covered. From 7 May 2026 7 May 2026 …

© Financial Conduct Authority 2025 12 Endeavour Square London E20 1JN Telephone: +44 (0)20 7066 1000 Website: www.fca.org.uk All rights reserved Pub ref: 1-008404 All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 1000 Sign up for our news and publications alerts