A safeguarding audit looks at whether a payment or e-money firm’s arrangements are designed and operating effectively to protect relevant customer funds and comply with the FCA’s safeguarding requirements.
Auditors will consider much more than whether customer funds are held in a separate account. The review can cover any area of safeguarding requirements including:
- the firm’s safeguarding policies and procedures,
- governance, senior management and risk management,
- identification of relevant funds,
- reconciliations,
- safeguarding accounts,
- third-party arrangements,
- record keeping and resolution planning.
https://www.fca.org.uk/publication/policy/ps25-12.pdf
The FCA’s strengthened safeguarding regime came into force on 7 May 2026, introducing enhanced requirements for payment and e-money firms.
What Is a Safeguarding Audit?
Safeguarding requirements are designed to protect relevant customer funds if a payment or e-money institution fails and to increase consistency across the industry.
For firms subject to the safeguarding audit requirements, an external auditor assesses the firm’s safeguarding arrangements and provides an opinion on its compliance with the relevant funds regime.
This means a safeguarding audit is not simply a check of bank balances. It considers the systems, controls and processes supporting the firm’s safeguarding arrangements and how effectively they operate in practice.
What Do Safeguarding Auditors Look For?
The precise scope will depend on the firm’s business model and safeguarding arrangements, but there are several key areas an auditor may examine.
1. Safeguarding Policies and Procedures
Firms should have documented safeguarding policies and procedures that accurately reflect how their business operates.
These should cover areas such as the identification of relevant funds, safeguarding methods, reconciliations, treatment of discrepancies and oversight of safeguarding arrangements.
An auditor may consider whether these policies are appropriate, up to date and, importantly, whether the firm is actually following them.
Having a safeguarding policy is not enough on its own. Firms should be able to demonstrate that their documented arrangements operate effectively in practice.
2. Governance, Senior Management and Risk Management
Auditors may look at how responsibility for safeguarding is allocated and how senior management oversees the firm’s arrangements.
This can include considering whether there is clear accountability for safeguarding, appropriate management information and evidence that issues are identified, escalated and addressed.
3. Identification of Relevant Funds
A fundamental part of safeguarding is correctly identifying which customer funds need to be protected.
Auditors may examine how the firm determines what constitutes relevant funds, when its safeguarding obligation begins and ends, and how relevant funds are distinguished from the firm’s own money.
This can be particularly important for firms with complex payment flows, multiple products or several sources of customer funds.
4. Segregation and Safeguarding Accounts
Where a firm uses the segregation method, the auditor may examine how relevant funds are separated from the firm’s own funds and where they are held.
This could include reviewing safeguarding bank accounts, account structures and associated documentation to establish whether funds are being appropriately protected.
Auditors may also consider whether the appropriate safeguarding account acknowledgement letters are in place and accurately reflect the firm’s arrangements.
5. Internal and External Reconciliations
Reconciliations are a key part of the safeguarding framework.
Under the strengthened FCA regime, firms are required to carry out internal and external safeguarding reconciliations at least once on each reconciliation day.
Auditors may examine whether reconciliations are being performed at the required frequency, whether the methodology is appropriate and whether discrepancies or shortfalls are identified and resolved promptly.
They may also consider the quality of the underlying records and whether there is appropriate review and oversight of the reconciliation process.
6. Third-Party Arrangements
Payment and e-money firms frequently rely on banks and other third parties as part of their safeguarding arrangements.
Auditors may consider the due diligence undertaken when selecting these providers and how the firm monitors and reviews the relationship on an ongoing basis.
Firms should be able to demonstrate appropriate oversight of third-party safeguarding arrangements rather than simply relying on the fact that a provider has been appointed.
7. Records and Record Keeping
Firms need to maintain clear and accurate records relating to relevant funds and their safeguarding arrangements.
Auditors may therefore consider whether records are complete, accessible and sufficient to demonstrate how relevant funds have been identified, reconciled and safeguarded.
Poor or incomplete records can make it difficult for a firm to demonstrate compliance even where appropriate processes have been designed.
8. Resolution Planning
Safeguarding institutions are required to maintain a CASS resolution pack containing key information about their safeguarding arrangements.
An auditor may consider whether the resolution pack is complete, accurate and kept up to date.
The purpose of the resolution pack is to ensure that important information is readily available to help facilitate the return of relevant funds if the firm fails.
9. Breaches, Shortfalls and Remediation
Auditors may also examine instances where safeguarding arrangements have not operated as intended.
Firms should be able to demonstrate how safeguarding breaches, discrepancies or shortfalls were identified, investigated and resolved, as well as what action was taken to prevent an issue recurring.
This is particularly important because correcting an individual discrepancy does not necessarily address the underlying weakness that caused it.
How Can Firms Prepare for a Safeguarding Audit?
Preparation should ideally begin well before the auditor starts their work.
Rather than approaching the audit simply as a document-gathering exercise, firms should consider whether their safeguarding arrangements accurately reflect how the business currently operates and whether there is sufficient evidence to demonstrate that key controls have operated effectively.
This can include reviewing:
- safeguarding policies and procedures;
- internal and external reconciliations;
- safeguarding account documentation and acknowledgement letters;
- third-party due diligence;
- governance and management information;
- record keeping and regulatory reporting;
- the CASS resolution pack;
- wind-down plans;
- customer communications and financial promotions related to safeguarding;
- IT controls, such as system security, testing, breach logging, access control, etc.
- previous findings and remediation.
A readiness review before the formal audit can also help firms identify gaps or weaknesses that may need to be addressed.
How Neopay can help
Neopay supports payment and e-money firms in auditing, reviewing and strengthening their safeguarding arrangements.
Working alongside our accountancy partner where required, our experienced team can support firms with safeguarding audits while retaining the practical, hands-on approach our clients know.
As well as safeguarding audits, we can also support firms in developing and improving their safeguarding frameworks, policies and procedures, reconciliations, governance, regulatory reporting and audit preparation.
If you’re preparing for a safeguarding audit or would like to discuss your current arrangements, contact Neopay to speak with one of our regulatory consultants.
Frequently Asked Questions
Who needs a safeguarding audit?
The FCA’s safeguarding audit requirements apply to relevant Authorised Payment Institutions (APIs) and Electronic Money Institutions (EMIs), subject to applicable exemptions.
A firm may be exempt from the mandatory safeguarding audit requirement where it has not been required to safeguard more than £100,000 of relevant funds at any time for a continuous period of at least 53 weeks.
Firms relying on the exemption should keep their position under review, document their assessment and retain appropriate records supporting the relevant fund balances used to determine their eligibility.
What does a safeguarding auditor look at?
A safeguarding auditor can consider the firm’s policies and procedures, governance, identification and segregation of relevant funds, reconciliations, safeguarding accounts, third-party arrangements, records, resolution planning and the handling of safeguarding issues or breaches.
The purpose is not simply to establish whether safeguarding processes exist, but to consider whether the firm’s systems and arrangements enable it to comply with the relevant safeguarding requirements and operate effectively in practice.
What governance and senior management arrangements should firms have for safeguarding?
Firms should have clear governance and oversight arrangements for safeguarding, including appropriate Board responsibility for safeguarding policies and controls and clear allocation of responsibility for the day-to-day operation, monitoring and oversight of safeguarding arrangements.
Firms should also consider how safeguarding matters are reported to the governing body, how responsibilities are documented and how relevant staff are trained and assessed as competent.
Safeguarding arrangements should be supported by appropriate policies and procedures, record keeping and an up-to-date CASS resolution pack. Firms should also have processes for identifying matters that may require regulatory notification, including relevant breaches or material changes to their safeguarding arrangements.
Who can conduct a safeguarding audit?
Firms within scope of the mandatory safeguarding audit requirements must appoint an external auditor.
Firms are responsible for taking reasonable steps to ensure that the auditor has the appropriate skill, resources and experience to carry out the safeguarding audit.
This includes considering whether the auditor has appropriate knowledge and experience of the safeguarding requirements applying to payment and e-money institutions.
What is the deadline for submitting a safeguarding audit report?
The FCA introduced transitional arrangements for the first safeguarding audit under the strengthened regime.
For the initial audit period, firms have six months from the end of the relevant period to submit the report to the FCA. For subsequent annual audit periods, the report must generally be submitted within four months of the end of the period covered.
Firms should check the FCA’s current requirements and the dates applicable to their individual reporting period.
What are common issues identified during safeguarding audits?
Issues can include weaknesses in:
- identifying relevant funds correctly;
- internal or external reconciliation processes;
- investigating and resolving discrepancies or shortfalls;
- safeguarding account arrangements;
- third-party due diligence and ongoing monitoring;
- record keeping;
- governance and oversight; and
- maintaining an accurate and up-to-date resolution pack.
Problems can also arise where documented policies and procedures do not reflect how safeguarding actually operates in practice.
The precise findings will depend on the firm’s business model and safeguarding arrangements, but firms should be able to demonstrate not only that appropriate controls have been designed, but that they operate effectively.
How often are safeguarding reconciliations required?
Under the FCA’s strengthened safeguarding regime, firms are required to perform internal and external safeguarding reconciliations at least once on each reconciliation day.
Firms should also have appropriate processes for identifying, investigating and resolving any discrepancies or shortfalls identified through the reconciliation process.
What is a CASS resolution pack?
A CASS resolution pack brings together important records and documents relating to a firm’s safeguarding arrangements.
It is designed to make key information readily available and assist with the identification and return of relevant funds if the firm fails.
How should a firm prepare for a safeguarding audit?
Firms should ensure their safeguarding policies and procedures are current, reconciliations are operating correctly, records are complete, relevant safeguarding account and third-party documentation is in place, the resolution pack is up to date and previous issues have been appropriately addressed.
Useful FCA resources
FCA – Safeguarding requirements for payment and e-money institutions
FCA safeguarding requirements
FCA Policy Statement – PS25/12: Changes to the safeguarding regime for payments and e-money firms
FCA Payment services and electronic money approach document
https://www.fca.org.uk/publication/finalised-guidance/payment-services-electronic-money-approach.pdf
FCA Payment services and electronic money approach document -Draft May 2026
https://www.fca.org.uk/publication/finalised-guidance/payment-services-electronic-money-approach.pdf
FCA Handbook – CASS 15: Payment services and electronic money: relevant funds
FCA Handbook – CASS 15
FCA Handbook – SUP 3A: Payment services and electronic money
FCA Handbook – SUP 3A
FCA Handbook – CASS 10A: Resolution packs
FCA Handbook – CASS 10A
