What a safeguarding account is, and what it is not

So, what is a safeguarding account? It's a bank account that a payment or e-money firm opens in its own name and fills with its customers' money, kept apart from everything the firm owns. That's the whole definition, and it fits on a card. The rest of this piece is about the part nobody puts on a pricing page, which is how you'd know the account actually holds what it should.

I'll admit I used to picture it as a vault with a customer's name on each shelf. I was wrong about that, and wrong in a way that matters on the day a firm fails, because nobody's name is on the account except the firm's. I had assumed that a regulated arrangement for other people's money would at least record, somewhere visible, which of those people each pound belonged to, and I suspect that assumption survives in plenty of heads besides mine, with the account pictured as if it were a row of little personal safes rather than one pooled balance and a ledger kept by the same company whose failure you are worried about.

Where the account comes from

In the UK the duty sits in regulation 20 of the Electronic Money Regulations 2011, which says relevant funds "must be safeguarded in accordance with either regulation 21 or regulation 22". Regulation 21 is the account route. Regulation 22 lets a firm cover the money with "an insurance policy with an authorised insurer" or a comparable guarantee instead. Regulation 23 of the Payment Services Regulations 2017 says an authorised payment institution "must keep relevant funds segregated from any other funds that it holds".

The timing rule is short and strict. If the firm still holds the money "at the end of the business day following the day on which they were received", it must place it in a separate account at a credit institution or the Bank of England, or in secure, liquid, low risk assets. Money that arrives by card gets longer, 5 business days after the e-money is issued. People call this D+1, and I've never seen a provider's app mention it once.

The EU wording is almost a copy, which is less surprising once you remember that the UK regulations of 2011 and 2017 were written to implement those very directives, back when the UK still had to, and the drafters had little reason to invent a different clock for the same money. Article 10 of PSD2 wants funds deposited "in a separate account in a credit institution" by the end of the next business day, and "insulated" against the claims of other creditors, "in particular in the event of insolvency". Article 7 of Directive 2009/110/EC applies the same idea to e-money. So segregated funds payment institution rules in Paris and in London point at the same object, a separate account the firm holds for other people.

Client money rules for an EMI are not the rules you might expect

Here's a trap I walked into while reading for this piece, and I suspect plenty of finance teams walk into it too. In UK finance, client money usually means the CASS rules that investment firms follow, and people carry that picture over. Client money rules emi firms follow were, for years, a much thinner set: the 2011 regulations, the 2017 regulations and an FCA approach document. That changed on 7 May 2026.

The FCA published PS25/12 on 7 August 2025 and gave firms 9 months. The new rules now sit in chapter CASS 15 of the Handbook, titled "Payment services and electronic money: relevant funds". The first rule, CASS 15.2.1, says a safeguarding institution must "maintain adequate arrangements to safeguard the client's rights". It reads like a sentence nobody could disagree with. I nodded along the first time too. The detail underneath is much heavier than that.

Anyway, a small aside on naming, since the labels confuse people. The FCA calls the old statute plus its new rules the Supplementary Regime, and it had planned a second stage built on a statutory trust. It parked that, writing that it is "not proposing to implement the proposals without further consideration and consultation". I suspect the trust would have changed more for customers than any of the paperwork did, but that's an instinct, not something I can show you with a number.

What the firm now has to do with the account

Firms must "perform safeguarding reconciliations at least once each day, other than weekends, public holidays and days when relevant foreign markets are not open". An internal reconciliation checks the firm's own ledgers. An external one compares those records with a third party balance, usually the bank statement for the safeguarding account itself. When they disagree, somebody has to explain the difference the same day, and in a firm moving money across several currencies and several partner banks that can mean a person chasing a timing gap, a returned payment or a card settlement that landed late, every single working morning, before anyone is allowed to call the number fine.

They must also keep a resolution pack, described in the policy statement as records "that would help achieve a timely return of relevant funds". And a payment firm must send "a safeguarding return to the FCA within 15 business days of the end of each month", which the FCA's firm page names as form REP027. That's 12 returns a year from a firm that, before May, may have filed nothing on the subject at all.

Firms using insurance instead of an account get a deadline of their own. At least 3 months before a policy or guarantee expires, they have to decide on renewal, tell the FCA and have a plan. I find that rule more reassuring than I expected, because a lapsed policy is exactly the kind of quiet failure that nobody notices until the claim.

UK safeguarding obligations in force from 7 May 2026, read from the FCA policy statement and legislation.gov.uk on 16 September 2026.

Requirement	Frequency or deadline	Where it sits
Move funds to the safeguarding account	End of the business day after receipt	EMR 2011 reg 21, PSR 2017 reg 23
Card receipts	5 business days after issue	EMR 2011 reg 20(4)
Reconciliation	At least once each business day	CASS 15, PS25/12
Safeguarding return	Monthly, within 15 business days	SUP 16, form REP027
Safeguarding audit	Annual, report within 4 months	SUP 3A
Insurance or guarantee renewal decision	3 months before expiry	PS25/12

The safeguarding audit, and what it actually signs off

The safeguarding audit is the part I'd read first if I were choosing a provider. Under SUP 3A.9.2R the auditor has to say whether the firm "has maintained systems adequate to enable it to comply with the relevant funds regime throughout the period", and whether it "was in compliance with the relevant funds regime at the end of the period covered by the report". The engagement is a reasonable assurance one, the same level an auditor uses for accounts.

Notice the split between those two tests. Systems are judged across the whole year. Actual compliance is judged at a single date. That's a snapshot, and snapshots flatter anyone who knows when the camera is coming, which in an annual audit is everybody involved, from the finance team preparing the ledgers to the auditor who agreed the period end months earlier. A firm could, in principle, have adequate systems all year and still be short on a Tuesday in March, and I cannot tell from the rule text whether an auditor would catch that. I'm not sure the rule was designed to.

The report goes to the FCA "within 4 months of the end of the period covered". There's a transitional rule giving 6 months for a period ending within 53 weeks of 7 May 2026. And there's an exemption for small firms. If a firm "has not been required to safeguard more than £100,000 of relevant funds at any time over a period of at least 53 weeks", it doesn't need the audit at all. For a very small firm that's sensible, since an audit costs real money. For a customer of that small firm, it means the account nobody audits is the one at the provider least able to absorb a mistake.

Why the regulator bothered

The FCA's own figure explains the tone of all this. Payment firms that became insolvent between Q1 2018 and Q2 2023 "had average shortfalls of 65% of their customers' funds". In its 2019 review of 11 non-bank firms, it wrote that checks on safeguarded amounts "were not always as frequent or accurate as they should be". Those 2 findings, published 6 years apart, are more or less the case for daily reconciliation in a single paragraph.

I keep thinking about what a 65 per cent shortfall means in a safeguarding account specifically. For every 100 pounds customers were owed, the average failed firm could find about 35. I don't know how that average splits between firms that never set the account up properly and firms that moved money out of it later, and the FCA's press release doesn't break it down.

The law does help a little here. In the Ipagoo LLP case, decided by the Court of Appeal on 9 March 2022, the court held that the asset pool "must also include a sum equal to such relevant funds which ought to have been but have not been safeguarded". It also found no statutory trust. So a hole in the account becomes a claim against the rest of the firm. That's better than nothing, and much slower than a full account, and anyone who has watched an administration grind through its creditors' claims knows that the word slower can hide a very long stretch of a company's life in which the money is owed, acknowledged and still unavailable. Regulation 24 then puts e-money holders "in priority to all other creditors", behind only the costs of distributing the pool.

How a business customer can test any of this

You can't see a provider's safeguarding account. But you can ask about it in writing, and the answers are telling. I'd ask the provider which method it uses, account or insurance. I'd ask at which bank or banks the account sits, whether its last safeguarding audit was delivered to the FCA, and whether that audit report carried any qualification. A firm that answers the first two quickly and goes quiet on the audit has told you something.

Some providers publish more than others, and the difference between a firm that explains its arrangement in plain words and a firm that hides behind the phrase fully regulated is, in my experience of reading these pages, a better guide to its habits than anything on the pricing table. Wise has a help centre article on how its UK entity, Wise Payments Limited, safeguards customer funds, and says the money is not covered by the FSCS. Qonto, a French payment institution under ACPR licence 16958, says client funds sit segregated at partner banks. Neither publication is an audit, and I wouldn't treat either as one. They're a start, and not much more. I'd still pick the provider that publishes something.

Inside the EU the rules are about to move again. The European Parliament and the Council reached a provisional agreement on new payment services texts on 27 November 2025, and the ECON committee approved them on 5 May 2026. The Parliament's tracker showed the file as close to adoption on 1 August 2026. I don't know yet what the final safeguarding articles will say. I went looking for the Council's own page on 16 September and got a browser check instead of text.

What still bothers me is the gap between the rules and what a customer can see. A firm now reconciles every business day and files 12 returns a year, and none of that reaches the finance director whose payroll sits in the account. The regulator sees the monthly figure. The customer sees a balance. That's the distance this whole regime still hasn't closed, and I'm not convinced another reporting form is the thing that closes it.