The monthly safeguarding return, form REP027, is the report every payment and e-money firm that safeguards customer money now sends the FCA each month. Safeguarding means keeping customer money separate from the firm's own money so it can be returned if the firm becomes insolvent. The return is required by SUP 16.14A of the FCA Handbook, introduced by Policy Statement PS25/12 alongside the CASS 15 safeguarding rules, and has applied since 7 May 2026.
REP027 gives the FCA a monthly view of each firm's relevant funds, safeguarding method, accounts, reconciliations, shortfalls and breaches. The FCA uses it for trend analysis, peer comparison and supervisory engagement. It replaced the safeguarding questions that used to sit in the periodic returns for payment institutions and e-money institutions. For the wider rules it reports against, see our CASS 15 explainer.
| Firm type | Must submit REP027? |
|---|---|
| Authorised payment institution holding customer money | Yes |
| Authorised e-money institution | Yes, with e-money and unrelated payment services reported separately |
| Small e-money institution | Yes |
| Credit union issuing e-money | Yes |
| Small payment institution that has opted in to safeguarding | Yes |
| Small payment institution that does not safeguard | No |
| Payment initiation or account information firm only | No; it holds no customer money |
The FCA considered allowing smaller or lower-risk firms to report quarterly and decided against it, describing monthly reporting as necessary and proportionate. A firm that is exempt from the annual safeguarding audit still files REP027 every month, and the return includes a field identifying firms that rely on the audit exemption.
SUP 16.14A.3R requires the return within 15 business days of the end of each calendar month. Business days exclude weekends and UK bank holidays. The deadline is the same for every firm type; there is no separate reporting calendar by permission. A firm does not file for the month in which it first becomes a safeguarding institution, and starts with the following month.
| Reporting month | Due by |
|---|---|
| September 2026 | 21 October 2026 |
| October 2026 | 20 November 2026 |
| November 2026 | 21 December 2026 |
| December 2026 | 22 January 2027 |
The dates above are calculated from the rule for England and Wales bank holidays. Each firm's own schedule is shown in My FCA, and the firm should diarise each deadline at the start of the year rather than calculate it month by month.
REP027 is submitted electronically through My FCA, the FCA's online portal for firms. The firm's reporting schedule in My FCA shows the due dates that apply to it.
The return was refined after a pilot in which a sample of firms each submitted two trial returns. The table summarises the main areas and where the data should come from.
| Area | What is reported | Source record |
|---|---|---|
| Relevant funds | Funds safeguarded, with e-money and unrelated payment services as separate pools | Daily internal reconciliations |
| Segregation position | D+1 segregation requirement compared with D+1 segregation resource | Daily D+1 comparison |
| Reconciliations | Confirmation that at least one internal and one external reconciliation ran each reconciliation day | Reconciliation calendar and records |
| Reconciliation method | Whether a non-standard internal method is used | Method approval and auditor's report |
| Shortfalls | Shortfalls in the month and how they were corrected | Break and breach records |
| Accounts | Safeguarding accounts, the institutions holding them and balances | External reconciliations |
| Relevant assets | Which assets are held with which custodians | Custodian statements |
| Method | Segregation, insurance or guarantee, or a combination, with provider details | Safeguarding policy and contracts |
| Audit exemption | Whether the firm relies on the £100,000 exemption | Documented exemption assessment |
| Breaches | Breaches in the month and notifications made to the FCA | Breach register |
The return's explanatory notes include guidance on the exchange rate to use when converting foreign currency balances, and on how firms with an unlimited insurance policy or guarantee should complete it.
Every figure in REP027 should trace to a daily operational record. The return is a summary of the month's controls, not a separate calculation.
When those records sit in a controlled system, preparing the return is a matter of drawing approved data. When they sit in spreadsheets, the firm has to rebuild the month from scattered files, emails and memory, and the return starts to drift from what the auditor will later test. Our guide to internal and external safeguarding reconciliations explains how the daily records should be built.
A return compiled separately from the reconciliation records will diverge from what the auditor tests. The FRC's interim guidance for safeguarding auditors expects them to check that the monthly return is consistent with the other evidence they gather.
A calendar drawn up after the event often does not match the reconciliations actually performed. Fix the calendar in advance, including which foreign market closures the firm treats as relevant, and check the records against it before confirming.
E-money and unrelated payment services funds are reported separately. Combining them can hide a shortfall in one pool behind an excess in the other.
A shortfall paid in by the end of the reconciliation day still occurred and is still reported, together with how it was corrected.
Reporting a breach in REP027 does not replace a notification the rules require. Under CASS 15.8.60R a firm must tell the FCA in writing without delay if, for example, it cannot carry out a reconciliation or cannot correct a shortfall. That notification is made when the event occurs, not when the next return is filed.
| Stage | What to do |
|---|---|
| Every reconciliation day | Perform and record both reconciliations and the D+1 comparison; log breaks and their resolution; update the breach register |
| First business days after month end | Draw the return from those records; check the reconciliation confirmation against the calendar; confirm the pool split |
| Review | Confirm shortfalls and corrections are complete and balances agree to the external reconciliations; an independent reviewer checks the figures |
| Approval | The director or senior manager responsible for safeguarding under CASS 15.2.4R approves the return |
| By business day 15 | Submit through My FCA and record the submission |
| After submission | Retain the return and supporting records; include the key figures in board management information |
The firm is responsible for the accuracy of the return. If an error is found after submission, correct it with the FCA promptly and record the cause, so the same error does not recur. Records made under CASS 15 are kept for five years.
REP027 sits alongside the firm's other periodic returns to the FCA, such as its financial returns, and its annual safeguarding audit. The audit tests the same records that feed the monthly return, so a gap between the two is a likely audit finding. Our guide to FCA safeguarding audits under CASS 15 explains what the auditor tests, and our overview of FCA regulatory reporting for PIs and EMIs sets REP027 in the context of every return a firm submits.
Safeheld, the firm's own safeguarding platform, assembles REP027 from the reconciliation records approved during the month, so the reported figures match the daily records and the supporting evidence stays available for audit. More detail is on the Safeheld page.
It is form REP027, required by SUP 16.14A since 7 May 2026. It reports a firm's relevant funds, safeguarding method, accounts, reconciliations, shortfalls and breaches for each calendar month.
Within 15 business days of the end of each calendar month. The deadline is the same for every firm type and is shown in the firm's reporting schedule in My FCA.
Electronically through My FCA, the FCA's online portal for firms.
Only if they have opted in to safeguarding. An SPI that safeguards files the return monthly like an authorised firm.
Yes. A shortfall that occurred is reported however quickly it was corrected, together with how it was corrected.
Separately. They are separate asset pools under CASS 15 and are reconciled and reported as such.
It is a breach that must be notified to the FCA in writing without delay under CASS 15.8.60R, recorded in the breach register and reflected in the next return.
Buckingham Capital Consulting has obtained FCA authorisations for payment and e-money firms including Orbital, Oval and Hryze since 2013, and sets up the monthly REP027 safeguarding return for them. Its safeguarding work covers reconciliation design, return preparation and review, breach registers and alignment with the annual safeguarding audit.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.