The clock is ticking to finish preparing your safeguarding gap analysis. On 7 May 2026, the UK’s safeguarding landscape transforms fundamentally with the implementation of the FCA’s Supplementary Regime under Policy Statement PS25/12. Payment institutions and electronic money institutions have only a couple of months to overhaul safeguarding frameworks built over years of regulatory scrutiny. For most firms, this timeline demands an uncomfortable truth: what worked yesterday won’t pass muster tomorrow.

The question isn’t whether your current safeguarding arrangements need updating. The question is whether you know precisely where the gaps are, how material they are, and what remediation will actually take. Without structured gap analysis conducted now, firms face implementation chaos, regulatory censure, and the genuine possibility that statutory auditors will qualify your first safeguarding audit in 2027.

This article examines why existing safeguarding frameworks are structurally unlikely to comply with the new regime, where the most significant exposures lie, and how firms should approach gap analysis with the rigour the FCA expects.

P.S. At the end of this article, you’ll find a free template that you can download to conduct your own gap analysis against the new regulatory framework.

The Regulatory Direction of Travel: From Guidance to Prescription

For over a decade, UK safeguarding requirements operated primarily through principles-based guidance that were stipulated within the FCA’s Payment Services and Electronic Money – Our Approach. Firms had discretion over safeguarded funds reconciliation methodology, frequency, and documentation standards. The FCA’s supervisory approach relied on outcome-focused assessments rather than prescriptive rule enforcement.

That model is ending. PS25/12 introduces the Supplementary Regime- a framework of mandatory, prescriptive requirements that fundamentally alters the relationship between regulatory expectation and firm discretion. As we noted in our previous article, analysing the upcoming changes, three pillars underpin this transformation:

Safeguarding gap analysis key aspects of new safeguarding regime

Enhanced Books and Records Requirements

The new regime mandates safeguarding reconciliations at least once each reconciliation day (excluding weekends, public holidays, and days when relevant foreign markets are closed). Reconciliation frequency is no longer a matter of firm discretion but a regulatory obligation. Firms must maintain detailed, auditable records demonstrating that reconciliations occurred, discrepancies were identified, and remediation actions were documented.

The introduction of resolution packs represents a step-change in documentation expectations. Within 48 hours of a request, firms must produce comprehensive documentation detailing where relevant funds are held, lists of agents and distributors, procedures for managing and transferring assets, and recovery methodologies. These are not static compliance documents- they are operational blueprints that insolvency practitioners must be able to execute without firm management involvement.

Mandatory External Auditing and Monthly Reporting

For firms holding more than £100,000 of relevant funds at any point over 53 weeks, annual safeguarding audits by qualified statutory auditors are mandatory. These are not advisory reviews or gap assessments- they are formal audit opinions on whether safeguarding arrangements comply with regulatory requirements.

Monthly safeguarding returns, submitted within 15 business days of each month-end, provide the FCA with granular, near-real-time visibility into firm safeguarding practices. The returns are not high-level attestations – they require detailed quantitative data including the highest and lowest safeguarding requirements during the period, breakdowns of safeguarding resource by component (bank account balances, segregated but undeposited (to the safeguarding accounts) funds, relevant assets, insurance and guarantee coverage), the outcome of the last internal reconciliation including any excess or shortfall, D+1 segregation comparisons, confirmation of whether reconciliations were performed every reconciliation day, and details of acknowledgement letter compliance across all safeguarding accounts. This represents a fundamental shift from reactive supervision to proactive, data-driven oversight where material gaps become visible to the regulator within weeks rather than at the next supervisory review.

Strengthened Safeguarding Practices and Controls

The regime tightens requirements around safeguarding account structures, reconciliation methodologies, and governance oversight. Firms must demonstrate that safeguarding arrangements operate as designed, that controls are effective, and that senior management exercises active oversight rather than delegated neglect.

The Risk Landscape: Regulatory, Operational, and Enforcement Consequences

Failure to identify and remediate safeguarding gaps carries consequences across multiple dimensions. The risks are not theoretical- they are grounded in supervisory precedent, enforcement patterns, and the FCA’s stated supervisory priorities.

Regulatory and Supervisory Risk

The FCA has been explicit that safeguarding represents a supervisory priority following concerning failure trends showing customer fund losses averaging 65% when firms fail. Monthly reporting provides the FCA with granular visibility into firm safeguarding practices. Material gaps will become visible quickly.

Firms demonstrating inadequate safeguarding controls can expect intensive supervisory engagement, requirements for independent reviews, restrictions on business growth, and formal enforcement consideration for persistent non-compliance. Supervisory intervention is disruptive, expensive, and reputationally damaging even when it does not escalate to formal enforcement.

Operational and Business Continuity Risk

Safeguarding deficiencies create operational vulnerabilities. Firms unable to reconcile customer funds accurately, identify discrepancies promptly, or resolve issues systematically face operational incidents, customer complaints, and financial losses from undetected errors.

Resolution pack inadequacy compounds operational risk. If firms cannot produce required documentation within 48 hours, insolvency practitioners face delays recovering customer funds, customers experience extended fund access restrictions, and firm reputations suffer lasting damage.

External Audit Qualification and Reporting Obligations

Qualified audit opinions on safeguarding arrangements trigger regulatory reporting obligations and supervisory scrutiny. The FCA will expect firms receiving qualified opinions to remediate deficiencies rapidly, commission independent reviews, and demonstrate control improvements before the next audit cycle.

Audit qualifications create board-level escalation, investor concerns, and potential impacts on banking relationships and correspondent arrangements. They are not administrative inconveniences- they are material regulatory events.

Enforcement and Financial Penalties

Persistent safeguarding failures carry enforcement risk. The FCA’s approach to payment sector supervision has intensified materially in recent years, with the Payments Supervision Department renamed the Payments Market Intervention Department to reflect heightened supervisory intensity.

Enforcement actions for safeguarding failures typically involve financial penalties, individual accountability referrals, and public censure. The reputational damage extends beyond the immediate sanction to customer confidence, banking relationships, and investor perceptions.

What Is a Safeguarding Gap Analysis and Why Is It Essential Now

A safeguarding gap analysis is a structured assessment comparing a firm’s current safeguarding arrangements against the Supplementary Regime’s requirements. It identifies compliance gaps, assesses their materiality, evaluates remediation complexity, and produces an actionable implementation roadmap.

Gap analysis is not a documentation exercise. It is an operational diagnostic examining whether current processes, controls, systems, and governance frameworks can meet the new standards. Effective gap analysis answers five critical questions that are each analysed below.

1. Where do current arrangements fail to meet specific regulatory requirements?

The analysis must map current practices against each Supplementary Regime requirement, identifying precise compliance gaps. Generic assessments stating “reconciliation processes need enhancement” provide no implementation value.

Effective gap analysis specifies: “We have not set specific reconciliation point; requirement is that each reconciliation is conducted using the same reconciliation point as the previous reconciliation,” or “Reconciliation documentation lacks formal discrepancy investigation procedures – no documented evidence trail for 40% of identified discrepancies.”

2. What is the materiality and urgency of each identified gap?

Not all gaps carry equal risk or urgency. Gaps creating immediate audit qualification risk or regulatory reporting failures demand urgent remediation. Gaps representing documentation deficiencies in otherwise effective processes carry lower immediate risk but still require systematic resolution before audit.

3. What operational, technological, and governance changes are required for remediation?

Remediation demands clarity on whether gaps require process redesign, technology investment, governance restructuring, or capability building. Firms must understand whether solutions involve hiring additional reconciliation staff, implementing new software, redesigning fund flow arrangements, or restructuring oversight frameworks.

4. What are the dependencies, timelines, and resource requirements for implementation?

Effective gap analysis produces realistic implementation timelines considering dependencies, resource constraints, and operational continuity requirements. Technology migration projects requiring vendor selection, data migration, and parallel running cannot be completed in weeks. Governance restructuring requiring board approval, policy development, and training implementation demands months of preparation.

5. What interim controls or mitigation measures are necessary before full remediation?

Where full remediation extends beyond the May 2026 implementation date, firms must implement interim controls demonstrating compliance intent and protecting customer funds. Interim measures might include enhanced manual reconciliation processes, increased oversight frequency, or restricted business activities in high-risk areas pending systems capability.

How Regulators Expect Firms to Approach Gap Analysis: Supervisory Expectations

The FCA’s supervisory expectations for gap analysis are implicit in PS25/12’s implementation guidance and consistent with broader FCA supervisory approaches. Firms should anticipate that supervisory assessments will focus on:

evidence of systematic and comprehensive assessment
realistic implementation planning with contingency provisions
independent challenge and quality assurance
practical considerations for conducting effective gap analysis

Effective gap analysis requires disciplined methodology, cross-functional engagement, and operational realism. Firms should structure gap analysis around several core principles:

granular requirement mapping against current state
operational process walkthroughs and testing
technology and systems capability assessment
governance and oversight framework evaluation
third-party and agent relationship review
resource and capability gap assessment

Structural Misalignment: Key Areas to Consider in Safeguarding Gap Analysis

Most payment and e-money institutions built safeguarding frameworks under the previous regime’s principles-based approach. Compliance was judged on outcome (whether customer funds were protected when needed) rather than process adherence. Firms designed arrangements that balanced regulatory objectives with operational efficiency, often using bespoke methodologies suited to their specific business models.

The Supplementary Regime does not accommodate bespoke interpretation. It imposes standardised requirements that many existing frameworks were never designed to meet. The misalignment manifests across multiple dimensions discussed below and forms the basis of the safeguarding gap analysis.

Reconciliation Frequency and Documentation Gaps

Many firms perform reconciliations every couple of days, weekly, fortnightly, or even monthly intervals that could meet previous guidance expectations but fall short of the “each reconciliation day” at “same reconciliation point” standard. Even firms performing daily reconciliations may lack the structured documentation demonstrating that reconciliations occurred, discrepancies were analysed, and remediation was tracked to conclusion.

The regime also introduces a prescriptive deadline for fund allocation. Under CASS 15.2.5R, firms must allocate any relevant funds they receive to an individual client no later than the end of the business day following the day of receipt. Pending allocation, received funds must be recorded as ‘unallocated relevant funds’ in the firm’s books and records, and these unallocated amounts feed directly into the safeguarding requirement calculation. Firms whose current systems allow funds to remain unattributed for longer periods – whether due to batch processing cycles, manual allocation workflows, or delays in identifying the originating client – face a compliance gap that affects both their record-keeping obligations and the accuracy of their safeguarding reconciliations.

The regime requires reconciliations to be documented in a format suitable for external audit scrutiny. Spreadsheet-based reconciliations with manual adjustments, undocumented investigation processes, and informal discrepancy resolution mechanisms will not withstand statutory audit examination and should be marked in your safeguarding gap analysis as a discrepancy.

Prescribed Reconciliation Methodology and D+1 Segregation

Beyond frequency, the Supplementary Regime fundamentally changes how reconciliations must be performed. Under the previous regime, firms had broad discretion to design reconciliation methodologies suited to their business models. PS25/12 introduces a standard method of internal safeguarding reconciliation that prescribes exactly what firms must calculate and compare.

The standard method requires two distinct reconciliation steps. First, firms must compare their safeguarding resource – the aggregate of all relevant funds held across relevant funds bank accounts, segregated but undeposited funds, relevant assets, and amounts protected by insurance or guarantee – against their safeguarding requirement, being the sum of individual safeguarding balances calculated for each client plus any unallocated relevant funds. This comparison must occur at defined reconciliation points that remain consistent each reconciliation day. Second, firms must perform a D+1 segregation comparison: verifying that the amounts actually held in relevant funds bank accounts and relevant assets accounts (the D+1 segregation resource) match what should be held there (the D+1 segregation requirement). Where the D+1 segregation resource falls short, firms must remedy the deficit by the end of the day on which the reconciliation is performed. If relevant funds are unavailable, firms must use their own funds to cover the shortfall.

Firms wishing to use a non-standard reconciliation methodology face significant additional requirements. Before adopting any alternative method, the firm must document in writing how its proposed approach will meet safeguarding obligations and, critically, must obtain a written reasonable assurance report from an independent auditor confirming that the proposed method is suitably designed and that the firm’s systems and controls can support it. Any material subsequent change to the methodology triggers the same documentation and independent audit requirements afresh. This makes non-standard methods operationally expensive and procedurally demanding.

The gap analysis implications are significant. Firms must assess whether their current reconciliation logic can produce the specific calculations the standard method requires: individual safeguarding balances per client, aggregated safeguarding resource across all account types and methods, and separate D+1 segregation comparisons. Many existing reconciliation processes were designed around aggregate balance checks or simplified netting approaches that will not satisfy these requirements without material redesign. Firms relying on bespoke methodologies must evaluate whether adopting the standard method is feasible or whether the cost and complexity of obtaining an independent auditor’s report for a non-standard method is justified.

Safeguarding Account Structures and Fund Flows

Many firms operate complex fund flow arrangements involving multiple intermediaries, cross-border transfers, multicurrency balances, and prefunding mechanisms. The regime demands that firms understand precisely where customer funds are at all times, can reconcile these positions daily, and can evidence safeguarding effectiveness through documented controls.

Firms unable to trace customer funds through their payment flows, reconcile balances across intermediary accounts, or demonstrate that safeguarded amounts accurately reflect customer exposures face material compliance gaps. These are not documentation deficiencies- they are structural inadequacies in safeguarding design.

Safeguarding Account Acknowledgement Letters

CASS 15.7 introduces a mandatory requirement for safeguarding institutions to complete, sign, and send acknowledgement letters for every relevant funds bank account and relevant assets account, using a prescribed template that is ever so slightly different from that referred to in the current Approach. These letters must be countersigned by the approved bank or authorised custodian and returned to the firm. The template is not optional – firms must use the form set out in CASS 15 Annex 1, and may not amend any text that is not in square brackets.

The acknowledgement letter serves multiple protective purposes: it puts third parties on formal notice of clients’ interests in the funds, confirms that the account has been opened in compliance with the relevant funds regime, and secures the third party’s agreement that it has no recourse or right against funds in the safeguarding account in respect of any liability owed by the firm. The letter explicitly prevents the bank or custodian from exercising set-off rights against safeguarded funds – a critical protection in insolvency scenarios.

The operational burden extends beyond initial completion. Firms must periodically review each countersigned letter – at least annually and whenever something referred to in the letter changes – to ensure continued accuracy. Inaccurate letters must be promptly replaced. When accounts transfer to another institution, new letters must be drawn up and countersigned. Firms must also retain countersigned letters for five years from the date the last account they relate to is closed, and must take reasonable steps to verify that the individual countersigning was authorised to do so.

While some firms may have informal acknowledgement arrangements with their banking partners, few will have letters in the precise mandatory format now required. For firms operating multiple safeguarding accounts across several banking relationships – and particularly those with accounts held internationally – the process of negotiating, executing, and tracking acknowledgement letters represents a meaningful workstream within the gap analysis that should not be underestimated.

Resolution Pack Preparedness

Resolution packs are operationally unfamiliar to most payment and e-money firms. Firms handling client assets in other sectors maintain resolution packs as standard practice, but payments firms generally lack the operational infrastructure, documentation standards, and testing protocols these frameworks require.

A compliant resolution pack is not a static document produced once and filed. It is a living operational blueprint updated continuously as account structures change, agents are onboarded, fund flows evolve, and new folder is created for each of the reconciliation day’s documentation. Firms without disciplined documentation practices, centralised records management, and robust version control will struggle to maintain resolution packs at the required standard and would need to highlight this as an issue in the safeguarding gap analysis.

Technology and Systems Inadequacy

Many smaller firms operate on white-label core banking platforms with limited reconciliation automation, rudimentary reporting capabilities, and manual data extraction processes. Monthly regulatory returns demand data aggregation, currency conversions, revaluation of the open FX positions, and reconciliation summaries that these systems were not designed to produce.

Firms may require significant technology investment or platform migration to achieve compliance. Migration projects carry operational risk, data integrity challenges, and implementation timelines that extend well beyond nine months if initiated late in the preparation cycle.

Governance and Oversight Deficiencies

The regime expects demonstrable senior management oversight of safeguarding arrangements. Firms where safeguarding operates as a back-office function with limited board visibility, infrequent reporting, and reactive escalation will not meet governance expectations.

Effective oversight requires regular management information on reconciliation outcomes, discrepancy trends, resolution timeframes, and control effectiveness. Boards and senior management must evidence that they understand safeguarding risks, challenge operational effectiveness, and intervene when controls underperform.

Critically, CASS 15.2.4R introduces an explicit obligation to allocate responsibility for safeguarding oversight to a single director or senior manager of sufficient skill and authority. This individual must be responsible for both operational oversight of the institution’s compliance with the entire relevant funds regime and for reporting on that oversight to the governing body. The requirement is precise: it must be a single individual, not a committee or shared responsibility; they must possess sufficient skill to understand safeguarding operations and sufficient authority to effect change when controls underperform.

For many firms, this represents a material governance change. Where safeguarding has historically been managed as part of broader finance or operations responsibilities without formal allocation, firms must now identify, appoint, and document a named individual. The resolution pack requirements compound this obligation: the CASS resolution pack must include a document identifying this individual, alongside every other senior manager, director, and person critical to the performance of safeguarding operational functions. Firms should assess whether their current governance structures support this appointment, whether the designated individual has adequate access to reconciliation data, discrepancy reporting, and control effectiveness information, and whether reporting lines to the governing body are formalised and documented.

External Audit Readiness

Statutory auditors will test safeguarding arrangements against specific regulatory requirements, not against firm-designed frameworks. Auditors will examine reconciliation documentation, test control effectiveness, assess governance oversight, and form an opinion on compliance adequacy.

Not even speaking about concerns in the safeguarding gap analysis, firms whose safeguarding arrangements rely on informal processes, undocumented controls, or manual interventions face material audit qualification risk. First-year audit failures create regulatory reporting obligations, supervisory scrutiny, and reputational damage that extend well beyond the immediate compliance deficiency.

The Role of External Expertise in Gap Analysis and Implementation

While gap analysis can be conducted internally, external expertise provides several advantages. Specialists with direct experience implementing safeguarding regimes at multiple firms bring comparative perspectives on effective approaches, common implementation pitfalls, and realistic resource requirements. External experts can provide an independent challenge to internal assessments, ensuring that gap analysis does not overlook material issues or underestimate implementation complexity. They can accelerate gap analysis timelines by deploying proven methodologies rather than developing bespoke approaches.

Critically, external specialists can support audit readiness by ensuring that remediation approaches align with how statutory auditors will assess compliance. Process designs that satisfy internal stakeholders but lack the documentation rigour or control robustness that auditors expect create subsequent remediation requirements.

However, external support should complement rather than replace internal ownership. Firms retain ultimate responsibility for safeguarding compliance. Effective use of external expertise involves collaborative engagement where specialists transfer knowledge, build internal capability, and enable firms to sustain compliance independently.

Safeguarding Gap Analysis as a Strategic Opportunity

While safeguarding reform is rightly viewed as a compliance obligation, it also presents strategic opportunity. Firms implementing robust safeguarding frameworks demonstrate commitment to customer protection, operational discipline, and regulatory partnership.

Enhanced safeguarding capabilities differentiate firms in competitive markets where customers, banking partners, and investors increasingly scrutinise operational risk management. Firms positioning themselves as safeguarding leaders can leverage enhanced capabilities commercially.

The resolution pack framework, while operationally demanding, improves business continuity and crisis preparedness beyond regulatory compliance. Firms with robust operational documentation and disaster recovery frameworks are better positioned to manage operational incidents, leadership transitions, and business transformation.

Enhanced reconciliation and reporting capabilities improve financial control and management information. Firms gain clearer visibility into fund positions, operational performance, and control effectiveness- insights valuable beyond safeguarding compliance.

Act Now or Face Implementation Crisis

The Supplementary Regime represents the most significant safeguarding transformation in UK payments regulation in over a decade. Firms cannot retrofit compliance into existing frameworks through incremental adjustment. Systematic transformation is required, and it starts with a detailed safeguarding gap analysis.

Without structured gap analysis conducted now, firms face implementation chaos, regulatory censure, and material audit qualification risk. Safeguarding gap analysis is not optional preparation, it is fundamental to achieving compliant implementation within available timelines.

Firms that conduct rigorous safeguarding gap analysis, develop realistic implementation plans, and execute with operational discipline will navigate the transition successfully. Those that delay, underestimate complexity, or treat gap analysis as a compliance formality will find May 2026 approaching with material gaps unresolved and inadequate time remaining for remediation.

The window for strategic preparation is closing. Firms should commence safeguarding gap analysis immediately, engage external expertise where capability gaps exist, and commit resources necessary for successful implementation. The regulatory, operational, and enforcement consequences of inadequate preparation are too material to accept.

The transition from the current safeguarding regime to the Supplementary Regime is not merely a regulatory event- it is a fundamental restructuring of how UK payment and e-money firms protect customer funds. Firms that approach this transition with rigour, realism, and adequate resources will emerge with enhanced operational capabilities and competitive positioning. Those who approach it with complacency will face consequences extending well beyond the immediate compliance requirement.

Download Structured Safeguarding Gap Analysis Framework

The framework addresses governance structures, safeguarding account arrangements, reconciliation processes and controls, documentation and record-keeping standards, resolution pack requirements, reporting obligations, agent and distributor oversight, and audit readiness preparation. Firms can access this framework to accelerate safeguarding gap analysis, ensure comprehensive coverage of regulatory requirements, and develop actionable implementation roadmaps aligned with supervisory expectations.

Safeguarding Gap Analysis: Why Your Framework Won’t Survive the New FCA Regime