Since 7 May 2026, under the FCA's policy statement PS25/12, payment and e-money institutions that safeguard relevant funds submit a safeguarding return every month, within 15 business days of each month end. Those that safeguard more than £100,000 also need an external auditor to report on their safeguarding every year, within 4 months of the end of each audit period, or 6 months for first reports under the new rules.
The monthly safeguarding return
The safeguarding return is due within 15 business days of the end of each calendar month (SUP 16.14A). It applies to safeguarding institutions: in practice, payment and e-money institutions that have to safeguard relevant funds.
- It's always a calendar month, whatever your accounting reference date.
- Fifteen business days is three calendar weeks, and longer when a bank holiday falls in the window. It never falls before the 19th of the following month.
- For example, the September 2026 return is due by 21 October, the October return by 20 November and the November return by 21 December.
- You don't submit a return for the month in which you become a safeguarding institution.
A late or incomplete return costs a £100 administrative fee under the FCA's general reporting rules, and repeated failures can lead to further action.
The annual safeguarding audit
If you're an e-money institution or an authorised payment institution and you safeguard more than £100,000 of relevant funds, an external auditor reports to the FCA on your safeguarding every year (SUP 3A). Firms authorised only for payment initiation or account information services are outside these rules.
Each report covers an audit period of up to 53 weeks and is due 4 months after it ends (SUP 3A.9). The first periods under the new rules get 6 months instead, under the transitional provisions. The safeguarding audit page covers the exemption test, how periods are counted and what happens if the auditor will be late.
Planning the audit
The report is the auditor's, but the work around it is yours: appointing the auditor and telling the FCA who it is, explaining each breach the draft report identifies, and taking the final report to your governing body. Agree a date for the draft early, so there's time to respond before the deadline.
Alongside your other returns
Safeguarding sits with REP017, FSA056 or FIN060, REP-CRIM and the controllers and close links reports. See the full list of returns for payment and e-money institutions.
Get reminded before each deadline
Regmindr sets up your compliance calendar from a template in about two minutes, and emails your team before each deadline is due.
Sources
- FCA PS25/12: Changes to the safeguarding regime for payments and e-money firms
- FCA Handbook: SUP 16.14A Safeguarding return
- FCA Handbook: SUP 16.3 General provisions on reporting
- FCA Handbook: SUP 3A Payment services and electronic money
- FCA Handbook: SUP 3A.9 Duties of auditors: notification and safeguarding report
- FCA Handbook: SUP TP 1 Transitional provisions
This page is a summary, not legal or regulatory advice. The rules in the sources above take precedence.