Safeguarding audit: who needs one and when it's due

Who needs one

The rules in SUP 3A apply to e-money institutions and to authorised payment institutions, other than those authorised only for payment initiation or account information services.

You're exempt if you haven't had to safeguard more than £100,000 of relevant funds at any time over a period of at least 53 weeks (SUP 3A.1.1R). Until 14 May 2027, the test is whether you've gone over £100,000 at any time since 7 May 2026 (SUP TP 1).

The period and the deadline

Each audit period ends no more than 53 weeks after the later of the date you became subject to the rules, the date you stopped being exempt, or the end of your previous period. The report is due within 4 months of the period end.

There's more time for first reports under the new rules: if the period ends within 53 weeks of 7 May 2026, the report is due within 6 months (SUP TP 1).

What you have to do

• Appoint an external auditor and tell the FCA who it is (SUP 3A.3.2R).
• Review the auditor's draft report and explain each breach it identifies and what you're doing about it, before the report is due (SUP 3A.10.1G).
• Take the final report to your governing body (SUP 3A.10.2R).

If the report will be late

The auditor delivers the report, but the deadline affects you both. If the auditor expects to miss it, they must tell the FCA before the deadline and explain why (SUP 3A.9.8R).

Sources

• FCA Handbook: SUP 3A Payment services and electronic money
• FCA Handbook: SUP 3A.9 Duties of auditors: notification and safeguarding report
• FCA Handbook: SUP TP 1 Transitional provisions

This page is a summary, not legal or regulatory advice. The rules in the sources above take precedence.