Since 7 May 2026, authorised payment institutions (APIs) and electronic money institutions (EMIs) above a £100,000 threshold must have an independent auditor report to the FCA on their safeguarding each year. Safeguarding is the protection of customer money, kept separate from the firm's own money so it can be returned if the firm becomes insolvent. The audit rules sit in chapter SUP 3A of the FCA Handbook, introduced by Policy Statement PS25/12 alongside CASS 15. For most firms this is their first audit of any part of the business against a CASS regime.
| Item | Position from 7 May 2026 |
|---|---|
| Firms in scope | APIs, other than those providing only payment initiation or account information services, and EMIs |
| Exemption | Not required to safeguard more than £100,000 of relevant funds at any time for at least 53 weeks |
| Assurance level | Reasonable assurance |
| Auditor | Eligible for appointment as a company auditor under the Companies Act 2006, and independent |
| Frequency | Each period, ending no more than 53 weeks after the previous one |
| First report | Within six months of the period end, for periods ending within 12 months of 7 May 2026 |
| Later reports | Within four months of the period end |
| Addressee | The FCA; the auditor delivers it and gives the firm a copy at the same time |
| Opinion | Adequate systems throughout the period, and compliance at the period end |
| Breaches | Every breach identified, listed in the breaches schedule |
The audit tests the whole relevant funds regime: the Payment Services Regulations 2017, the Electronic Money Regulations 2011, CASS 15, CASS 10A and the related FCA rules and guidance. Firms should prepare against all of it, not CASS 15 alone. Our CASS 15 explainer sets out the full rulebook the auditor tests against.
SUP 3A applies to authorised payment institutions, other than firms providing only payment initiation or account information services, and to EMIs. It covers firms using the segregation method and those using insurance or a guarantee, because the audit concerns compliance with the relevant funds regime as a whole.
A firm is exempt if it has not been required to safeguard more than £100,000 of relevant funds at any time over a period of at least 53 weeks. This is not a year-end balance test. One day above £100,000 within the period takes the firm outside the exemption. Senior management must decide on a continuing basis whether the exemption still applies, record that decision and appoint an auditor as soon as it does not.
A firm that usually safeguards about £50,000 but receives a large batch of customer payments that briefly takes it to £150,000 has crossed the threshold and should revisit its audit position at once. Growing firms should monitor the peak daily requirement, not the month-end figure.
Small payment institutions that opt in to safeguarding, and firms within the exemption, still need adequate safeguarding arrangements and still file the monthly return. The FCA recognises that a voluntary audit can help such firms demonstrate that their arrangements work, and many banks and partners ask for one.
The report is not a check that money was in the safeguarding account on one date. Under SUP 3A.9.2R the auditor states two things: whether the firm maintained systems adequate to comply with the relevant funds regime throughout the period, and whether it was in compliance with the regime at the end of the period.
The first opinion makes the audit operational. Systems are not adequate if relevant funds were identified incorrectly, reconciliations were unreliable, shortfalls were corrected slowly or records could not show what each customer was owed. The second opinion needs evidence of actual compliance on the closing date, not documented policies alone. A clean closing balance does not cure months of weak controls earlier in the period.
Arrangements that are sound today but cannot be shown to have operated across the period leave the auditor nothing to rely on.
SUP 3A.9.1R requires the report to be prepared under a reasonable assurance engagement. That is a higher standard than the limited assurance considered during policy development. The auditor must obtain sufficient appropriate evidence to give a positive opinion, which means testing processes, records, reconciliations, transactions, third-party arrangements and governance, not relying on management's statements.
Every breach the auditor identifies goes into the breaches schedule. A breach does not automatically lead to a qualified or adverse opinion; the auditor weighs its significance, duration, context and whether it recurred, individually and together with other breaches. Minor breaches below any financial materiality level are still reported.
Firms should avoid cosmetic fixes made just before fieldwork. The auditor tests the whole period, so a weakness that existed in month three must be disclosed and explained even if it was corrected in month nine. What counts is a clear record of the issue, the correction and the evidence that the correction worked.
CASS 15 requires internal and external safeguarding reconciliations at least once each reconciliation day, which excludes weekends, UK bank holidays and days when a relevant foreign market is closed. The reconciliations show what the firm owes customers, what safeguarding resources it holds and whether differences were found and corrected promptly.
Auditors look past whether a spreadsheet exists. They examine the method, data inputs, timing, cut-offs, pending transactions, unallocated funds, foreign exchange, fees and exceptions. They look for evidence of review: why each difference arose, how fast it was investigated, whether a shortfall resulted, what was done and whether recurring issues were escalated. The count of reconciliations performed should match the count of reconciliation days in the period, and any gap needs an explanation.
Where a firm uses a non-standard internal reconciliation method, the auditor will expect the independent auditor's written report that approved it. Our guide to FCA safeguarding reconciliations sets out the method and evidence in detail.
Misclassifying customer money is one of the most common underlying issues an audit finds. The firm must show when money becomes relevant funds, how long the duty lasts and which amounts fall outside the regime, such as fees that are due and payable to the firm.
The flows that need the closest analysis are card settlement, merchant acquiring, cross-border transfers, fees, refunds, chargebacks, prefunding and money received through agents or distributors. The audit trail should explain the treatment of each material category and show that it is the same in customer terms, systems, accounting, the safeguarding calculation and regulatory reporting.
Money the firm cannot yet match to a customer does not leave the safeguarding regime because of that. If it was received for a payment transaction or in exchange for e-money, it is still relevant funds while allocation is resolved, and it must be safeguarded and reconciled. Generic policy wording that is not mapped to the firm's real transaction flows gives the auditor little to rely on.
For the segregation method, the auditor checks that relevant funds sit in proper safeguarding accounts and that the legal and operational protections are documented. Each account must be designated as held for safeguarding relevant funds and used only for that purpose.
The auditor will read each acknowledgement letter: the letter in which the bank or custodian confirms that it holds the money for safeguarding, that it has no right of set-off, lien or counterclaim against it and that it will not combine the account with others. Its wording, execution and continued validity all matter, because together they show the account is not ordinary company money available for the firm's own debts. CASS 15.7 requires letters to be reviewed at least annually and whenever something they refer to changes, and kept for five years after the last related account closes.
Every account in every currency should have a countersigned letter that matches its current title and number. A letter that names an old account, or one opened since the last review without a letter in place, is a likely finding.
Most firms rely on banks, custodians, payment processors, agents and other providers, so the audit reaches beyond the firm's own controls. CASS 15.6 requires due skill, care and diligence in selecting, appointing and periodically reviewing the third parties that hold relevant funds or assets. The review should cover:
Overseas arrangements need legal analysis of whether local insolvency law recognises the protection the UK regime intends, and whether any legal or contractual term could delay the return of customer money. Where a large share of relevant funds sits with one institution, senior management should record why that concentration is acceptable and whether to diversify.
A due diligence file from the original onboarding is unlikely to be enough. Reviews should be refreshed at least annually and whenever something material changes, with the reasoning recorded. Commercial files on credit limits, pricing or service levels do not replace safeguarding-specific due diligence.
CASS 10A requires a resolution pack: the documents an insolvency practitioner or administrator needs to identify and promptly return safeguarded money. Each document must be retrievable as soon as practicable and in any event within 48 hours, and a material change must be reflected within five business days. The pack should be a live operational resource, not something assembled for the audit.
The auditor may test the pack for completeness, currency and retrieval within the time limit. Expired contracts, old bank details and links to systems the reader cannot reach are typical findings. The practical test is whether an informed outsider with no prior knowledge of the firm could locate the money, work out the safeguarding amount and reconstruct customer entitlements from the pack alone. Pack quality is usually a good indicator of the quality of the wider framework. Our article on the CASS 10A resolution pack lists every required document.
Since 7 May 2026, every safeguarding institution files the monthly safeguarding return, REP027, through My FCA within 15 business days of each month end. The FRC's interim guidance for auditors expects them to check that the monthly return is consistent with the other evidence they gather.
The audit and REP027 should therefore not be separate processes. The return's figures should come from the same books, reconciliation data and method used every day. Differences between REP027, the reconciliations, bank statements and management information raise difficult questions, and repeated differences point to weak data controls. A firm should keep a documented bridge between the return and its records, and approve in advance any significant adjustment, unusual movement or change of method. Our guide to FCA regulatory reporting for payment institutions and EMIs covers REP027 alongside the firm's other returns.
CASS 15.2.4R requires a single director or senior manager of sufficient skill and authority to hold responsibility for operational compliance with the safeguarding rules and to report on it to the governing body. That responsibility must be visible in real decisions, management information, escalation and board oversight, not only in a name in the policy.
Senior management information should cover safeguarded balances, reconciliation breaks, shortfalls, unresolved exceptions, concentration by institution, audit findings and reporting issues. Where issues recur, the board should see whether the root cause is being fixed, not only that each break was closed.
Auditors may review how a breach was handled: when management became aware, how significance was assessed, whether notification to the FCA was considered and what correction followed. A mature framework leaves a trail from exception to investigation, escalation, decision and closure. Governance that relies on informal conversations is hard to evidence.
The report has a breaches schedule. Under SUP 3A.9.12R the auditor identifies each regulation or rule where a breach was found, or states that none was. The FCA expects the schedule to list every breach identified during the audit, whether the auditor found it, the firm disclosed it or it came from another source. The FRC's interim guidance is explicit: all breaches, regardless of materiality, are reported.
| Part of the report | Completed by |
|---|---|
| Part 1: auditor's opinion | The auditor |
| Part 2: breaches schedule, columns A to D | The auditor |
| Part 2: breaches schedule, column E (the firm's response) | The firm |
Firms should keep their own safeguarding breach register all year. Relying on the auditor to find issues suggests weak internal monitoring. The register should distinguish isolated errors from systemic weaknesses, record each correction and flag repeated themes, which should prompt a redesign of the control rather than another one-off fix. A complete register also makes column E straightforward to complete.
The FRC's interim guidance says IT general controls will typically be an important element of safeguarding assurance work. These are the controls over the systems that hold and calculate safeguarding data, such as access to applications and data, backup and recovery, and incident management. Auditors identify the key systems, assess the design of their controls and test whether they worked, including at outsourced providers, where a service organisation report may be relied on.
This matters most for firms running safeguarding in spreadsheets, where access control, version control and a record that cannot be altered afterwards are difficult to evidence. Firms should agree with their auditor at scoping how IT controls will be tested and what evidence is expected. Safeheld, the firm's own safeguarding platform, records reconciliations, breaks, corrections and approvals as they happen and can give auditors read-only access to the period under review.
The safeguarding auditor does not have to be the firm's statutory auditor, though it may be. SUP 3A requires the firm to take reasonable steps to ensure that the auditor is eligible for appointment as a company auditor under the Companies Act 2006, is independent and has the skill, resources and experience to carry out the work.
Price should not be the only criterion. An auditor unfamiliar with payment flows, e-money liabilities, safeguarding reconciliations or the line between relevant and other funds may need much more time, which costs more in the end. Ask about the team's CASS and payments experience, how they will test IT controls and what data format they need.
Engage early to agree the audit period, evidence, data format and timetable. Waiting until the period end can force the firm to reconstruct historic evidence. Keep a clear line between regulatory advisers who helped design or run the framework, any internal assurance and the independent SUP 3A audit, so that independence is not in question.
Under SUP 3A.9.6R, an audit period must end no more than 53 weeks after the latest of three dates: when the firm first became subject to the audit chapter, when it became subject again after losing an exemption, or the end of the previous period. The period need not match the financial year, though many firms align them for convenience.
The auditor must deliver the report to the FCA within four months of the period end. For periods ending within 12 months of 7 May 2026, the first report has six months. The auditor gives the firm a draft to review and a copy of the final report at the same time it goes to the FCA, and must notify the FCA if the deadline will not be met.
| Audit period ends | Report due by |
|---|---|
| 31 December 2026 (first period) | 30 June 2027 |
| 31 March 2027 (first period) | 30 September 2027 |
| Any later period | Four months after the period end |
Where the first audit period began before 7 May 2026, the auditor assesses the firm against the rules in force at each point. The FRC's interim guidance allows the firm to elect either a single hybrid opinion covering both regimes or two separate opinions, one for each part of the period, as long as each part covers no more than 53 weeks. Firms should agree the approach with their auditor at the start. The FCA's safeguarding guidance for payment and e-money institutions summarises the timetable.
The evidence request follows the obligations. A firm that can produce each item below from a single, consistent record is well placed for fieldwork.
| Obligation | Evidence requested |
|---|---|
| Reconciliation | Records for every reconciliation day: requirement, resource, comparison, outcome and action; the reconciliation calendar and its basis |
| Breaks | Investigation, resolution and approver for each break |
| Breaches | The breach register, FCA notifications and correspondence |
| Resolution planning | The resolution pack and evidence of updates |
| Accounts | Acknowledgement letters for every safeguarding account |
| Third parties | Due diligence files with review dates |
| Policies | Safeguarding policy and procedures with version history |
| Governance | Board and committee papers, minutes and management information |
| Reporting | REP027 returns for the period and their supporting records |
| Insurance or guarantee | The policy or guarantee and the related FCA notifications |
Staff who operate the controls will be interviewed. Brief them so they can explain what they do and why, consistent with the written procedures.
The firm's free safeguarding readiness checker gives a quick first view of gaps against PS25/12 and CASS 15.
The most significant findings are rarely large shortfalls of customer money. They are usually an inability to show consistent, reliable calculations and controls across the period. Typical findings include:
Most of these are evidence gaps rather than control gaps: the firm did the right thing but cannot show it. Fast-growing firms carry added exposure when new products, currencies, agents, banks or settlement models arrive without the controls being redesigned. A policy written for the original authorisation may no longer describe how money actually moves.
A first safeguarding audit runs smoothly when the firm works back from the report deadline. The table sets out a practical cycle for a firm whose audit period ends on 31 December.
| Timing | Action |
|---|---|
| Start of the period | Confirm SUP 3A applies, fix the audit period, appoint the auditor and agree scope, data format and the opinion approach |
| Throughout the period | Run and record daily reconciliations, keep the breach register, update the resolution pack, file REP027 monthly |
| Three months before the period end | Internal readiness review; correct gaps and document each correction |
| Period end | Lock the period's records; prepare the evidence pack |
| One to three months after | Auditor fieldwork, interviews and testing |
| Draft report | Review the draft; complete column E of the breaches schedule |
| Within six months (first) or four months (later) | Auditor delivers the report to the FCA and a copy to the firm |
The draft review is the firm's opportunity to check factual accuracy and set out its response to each breach. It is not a negotiation of the opinion; the auditor's judgement on the evidence stands.
Once the report reaches the FCA, the firm's response to each finding becomes part of its supervisory record. A clear, dated remediation plan, owned by the director or senior manager responsible for safeguarding, is the most useful document the firm can hold at that point.
Auditors also have a statutory duty under the Payment Services Regulations and Electronic Money Regulations to report matters of material significance to the FCA, and should consider whether anything needs notifying immediately. A firm that has already identified, disclosed and begun correcting an issue is in the strongest position when the FCA asks about it.
The audit is best treated as an annual assurance cycle rather than a deadline. The same records support the audit, FCA supervision, the monthly return and an orderly return of funds if the firm becomes insolvent. The firm's safeguarding and CASS 15 practice carries out pre-audit assessments and remediation; the independent SUP 3A audit itself is performed by a qualified external auditor.
No. SUP 3A applies to authorised payment institutions, other than payment initiation or account information only firms, and to EMIs. A firm that has not been required to safeguard more than £100,000 at any time over at least 53 weeks is exempt.
Reasonable assurance. The auditor reports on whether systems were adequate to comply with the relevant funds regime throughout the period and whether the firm complied at the period end.
Within six months of the end of the first audit period, for periods ending within 12 months of 7 May 2026. Later reports are due within four months of the period end.
No. The FCA allows a different firm, provided the auditor is eligible under the Companies Act 2006, independent and has the skill, resources and experience for the work.
No. Every breach identified is listed in the breaches schedule, and the FRC's interim guidance states that materiality does not apply to breach reporting.
Yes. The FRC's interim guidance treats IT general controls, such as access to systems and data, backup and recovery and incident management, as an important part of the work.
Evidence across the whole cycle: the relevant funds method, money flows, account letters, daily reconciliations, due diligence, the resolution pack, REP027 returns, breach records and governance papers. A readiness review two to three months before fieldwork leaves time to correct gaps.
Buckingham Capital Consulting has obtained FCA e-money and payment authorisations for firms including Dzing Finance, Hryze and Global Send since 2013, and prepares PIs and EMIs for the SUP 3A safeguarding audit. Its work covers pre-audit readiness reviews, breach register and evidence design, auditor scoping and remediation of audit findings.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.