Safeguarding at scale: the controls that protect client money

Establish what has changed

The supplementary regime set out in FCA PS25/12 took effect on 7 May. It strengthens safeguarding arrangements for specified payments and e-money firms, with the aim of reducing shortfalls and improving the return of funds if a firm fails. The scope includes authorised payment institutions, subject to stated exclusions, authorised and small e-money institutions, and credit unions issuing e-money in the UK. Small payment institutions can opt in. The separate post-repeal regime remains a distinct stage of the reform. FCA PS25/12 (opens in a new tab)

The implementation date should now lead to a review of operating evidence. Leadership needs confidence that the arrangements approved during the programme work across the actual business, including the exceptions that do not fit a standard process diagram.

Safeguarding also has an important place in the growth plan. A new payment route, additional currency or acquisition can change the movement of money and the records needed to explain it. The commercial decision should account for the control capacity required to support that change reliably.

Trace the money and the information together

Begin with the customer's transaction and follow the funds through the relevant accounts, systems and counterparties. Identify where the organisation records an obligation to the customer and how that record connects to the funds held. Include refunds, rejected payments and other exceptions that may follow a different route.

A clear funds-flow map should have an equally clear information flow beside it. If one system records a transaction before another receives confirmation, the team needs to understand how that difference is identified and resolved. A movement that is economically straightforward can become difficult to explain when the records use inconsistent identifiers or timing conventions.

For each important hand-off, establish who owns the data and who can correct it. That ownership should remain clear when processing is outsourced or when a supplier changes its interface. The business should be able to explain a customer's position without depending on one person's ability to reconstruct several spreadsheets.

This exercise can also reveal avoidable operating costs. Repeated manual adjustments may indicate a process or data problem that will become more expensive as volume increases. Resolving the cause can improve service quality and reduce the effort required to demonstrate control.

Treat unresolved differences as management information

Reconciliation produces value when differences are understood and acted upon. A completed task on a daily schedule does not, by itself, establish that the underlying position is reliable. Leadership should be able to see the significance and age of outstanding items, including recurring breaks that are repeatedly carried forward.

Set escalation arrangements that reflect both the financial exposure and the uncertainty involved. A small unresolved difference may reveal a systematic defect affecting many transactions. Conversely, a clearly explained timing item may require monitoring through an established process. The classification needs evidence and appropriate review.

Management information should show whether the same causes continue to generate exceptions. It should also reveal where resolution depends on a supplier or a constrained internal team. That view helps management decide whether to improve an interface, change a process or increase capacity before a backlog becomes harder to control.

Automation can support this work where records and matching rules are dependable. It should make exceptions easier to investigate and preserve a usable history of corrections. Automating an unclear process can make errors harder to notice, so the operating design should be understood before the technology is expanded.

Test the arrangements under business stress

A useful exercise would combine a busy processing period with delayed information from a key provider. Ask whether the firm can establish the relevant balances, investigate differences and keep the right decision-makers informed. Include staff absence and access to the records needed outside normal working arrangements.

The exercise should also consider how information would be assembled if the firm could no longer operate normally. The policy statement sets out detailed expectations concerning safeguarding records and resolution arrangements. Management should test the availability and coherence of the records relevant to its own business against those requirements. Safeguarding policy statement and final rules (opens in a new tab)

For the executive committee, the immediate questions are practical. Can we explain where customer funds are and how the records support that explanation? Are unresolved differences being reduced at their source? Will the controls still work at the volumes assumed in our growth forecast?

Answering those questions with evidence gives leadership a firmer basis for expansion. It also connects safeguarding to the quality and reliability of the service customers receive every day.