Changing of the (safe)guard: the FCA's proposals for payments and e-money firms

Key points

• The FCA published CP24/20 "Changes to the safeguarding regime for payments and e-money firms" on 25 September 2024. The consultation closed on 17 December 2024.
• Interim-state rules are designed to achieve a greater level of compliance with the existing safeguarding regime in the Payment Services Regulations 2017 (the "PSRs") and the Electronic Money Regulations 2011 (the "EMRs").
• End-state rules will replace the safeguarding provisions in the PSRs and EMRs with a "CASS"-style regime in the FCA Handbook, with relevant funds and assets held on trust for clients.
• To comply in good time, payments and e-money firms need to start preparing now.  

Abstract

Payments and e-money firms are subject to a safeguarding regime designed to protect client funds. However, the FCA does not believe the regime is working. The proposals in CP24/20 are intended to address this problem. Interim-state rules will reinforce existing requirements, including by monthly regulatory returns and annual audits. End-state rules will move to a trust arrangement modelled on the regime for investment business, among other changes. As consulted on, the FCA's proposals will place a greater compliance burden on payments and e-money firms. This may lead to increased enforcement action and consolidation within the sector.

Introduction

This article examines the FCA's proposed changes to the safeguarding regime for payments and e-money firms in CP24/20, which closed to responses on 17 December 2024. It begins by setting out the current safeguarding regime and the FCA's concerns in relation to firms' compliance. It then considers the interim-state and end-state rules and the timetable for their introduction, before concluding with a discussion of the key implications for the payments and e-money sector.  

The proposals in CP24/20 are relevant to several types of payments and e-money firm. However, this article focuses on the implications for authorised payment institutions ("PIs") and authorised e-money institutions ("EMIs"), of which there are approximately 630 in the UK. We refer to "firms" below as a shorthand for PIs and EMIs.

The current safeguarding regime

PIs and EMIs are not covered by the Financial Services Compensation Scheme. Instead, the Payment Services Regulations 2017 (the "PSRs") and the Electronic Money Regulations 2011 (the "EMRs") establish a safeguarding regime to protect "relevant funds", i.e. funds received for the execution of a payment transaction or in exchange for e-money that has been issued by an EMI. The PSRs and EMRs provide for safeguarding in two ways:

• the segregation method; and
• the insurance or comparable guarantee method.

According to the FCA, the segregation method is used by more than 95% of firms. Under it, a firm must keep relevant funds segregated from any other funds that it holds. If it continues to hold the relevant funds at the end of the business day following the day on which they were received, then in accordance with the so-called "D+1 rule" it must either:

• place them in a separate account that it holds with an authorised credit institution or the Bank of England; or
• invest the relevant funds in secure liquid assets ("relevant assets") and place the relevant assets in a separate account with an authorised custodian.

An account in which relevant funds or relevant assets are placed must be designated in such a way as to show that it is an account which is held for this purpose. Further, it can only be used for holding relevant funds, relevant assets and the proceeds of an insurance policy or guarantee held in accordance with the insurance or comparable guarantee method described below. Such accounts are referred to as "Designated Safeguarding Accounts". No person other than the PI or EMI can have any interest in or right over relevant funds or relevant assets placed in a Designated Safeguarding Account, subject to certain limited exceptions.

Where a PI or EMI uses the insurance or comparable guarantee method, they must ensure that, first, any relevant funds are covered by:

• an insurance policy with an authorised insurer;
• a comparable guarantee given by an authorised insurer; or
• a comparable guarantee given by an authorised credit institution.

Second, the proceeds of any such insurance policy or guarantee must be payable upon an insolvency event into a Designated Safeguarding Account. As with the segregation method, no person other than the PI or EMI can have any interest in or right over the proceeds placed in a Designated Safeguarding Account, subject to certain limited exceptions. 

The safeguarding regime is intended to protect customers where a PI or EMI fails. Accordingly, the PSRs and EMRs provide for the following where an "insolvency event" occurs.

• The claims of payment service users and e-money holders are to be paid from safeguarded relevant funds and relevant assets (the "asset pool") in priority to all other creditors.
• Until all claims of payment service users and e-money holders have been paid, no right of set-off or security right may be exercised in respect of the asset pool, except to the extent that a right of set-off relates to fees and expenses in relation to operating a Designated Safeguarding Account.
• The claims of payment service users and e-money holders are not subject to the priority of expenses of an insolvency proceeding, except in respect of the costs of distributing the asset pool.

For this purpose, "insolvency event" is defined broadly by reference to several types of insolvency proceedings, including the making of a winding-up order and entry into administration.[1]

The PSRs and EMRs provide respectively that PIs and EMIs must maintain organisational arrangements sufficient to minimise the risk of loss or diminution of relevant funds or relevant assets through fraud, misuse, negligence or poor administration. This and the obligations above are supplemented by a substantial amount of guidance in chapter 10 of the FCA's "Payment Services and Electronic Money – Our Approach" (the "Approach Document"). This guidance overlays the rules in the PSRs and EMRs with certain supervisory expectations, including in relation to a firm's systems and controls.   

The FCA's concerns

In the FCA's view, there is poor compliance with the safeguarding regime across the payments and e-money sector. In CP24/20, the FCA notes that for firms that became insolvent between Q1 and Q2 2023, there was an average shortfall of 65% in funds owed to clients (i.e. the difference between the funds owed and funds safeguarded). Against this background, the proportion of UK consumers using an e-money account has grown, from 1% in 2017, to 4% in 2020 and to 7% in 2022. Therefore an increasing share of the UK population is exposed to the risks of poor safeguarding.

There is also a concentration of vulnerable customers in the payments and e-money sector. According to the FCA's data from 2022, 40% of e-money account holders have at least one characteristic of vulnerability, such as a low resilience to financial shocks. The FCA notes that any loss or delay in returning safeguarded funds is likely to have a greater impact on such consumers, who may need to borrow money if they are unable to access their funds for an extended period. Even small losses may cause them hardship. 

The FCA also believes there is legal uncertainty following Baker and another v Financial Conduct Authority (Re Ipagoo LLP) [2022] EWCA Civ 302. Prior to this judgment, the FCA had maintained that the safeguarding regime established a statutory trust. However, the Court of Appeal rejected this characterisation. Instead, it found that the EMRs create a sui generis "secured interest" that ranks ahead of the normal creditor waterfall in the Insolvency Act 1986. Further, where there is a shortfall in safeguarded funds, this should be "topped up" from the wider insolvency estate (per Asplin LJ at [79] to [93]). The High Court has since applied this approach to the PSRs in Re Allied Wallet [2022] EWHC 1877 (Ch) (per ICC Judge Burton at [8]).

The FCA notes at paragraph 2.14 of CP24/20 that Ipagoo "has left many questions unanswered". For example, it is unclear how any "top-up" should rank against the claims of other creditors of an insolvent firm, such as those with fixed charges. Without being able to rely on established trust law principles, the FCA observes that insolvency practitioners are continuing to seek court directions on the treatment of safeguarded funds, leading to higher costs and delays in returning them to clients. Such costs reduce the asset pool available for distribution to clients.

The FCA also has concerns in relation to the D+1 rule. It estimates that within this window, approximately 35% of PIs and EMIs hold relevant funds in accounts provided by EMIs. EMIs are subject to less stringent prudential requirements than credit institutions and where multiple firms hold relevant funds at a single EMI, this creates the risk of a single point of failure. More generally, accounts used to hold relevant funds within the D+1 window are not required to be clearly designated as safeguarding accounts, nor are third parties prohibited from having interests in or rights over relevant funds in such accounts. As a result, relevant funds in these accounts are vulnerable to claims from third-party creditors.

Finally, the FCA does not believe that it has sufficient information regarding firms' safeguarding arrangements. At present, PIs and EMIs only report their safeguarding holdings once a year under chapters 16.13 and 16.15 respectively of the FCA's Supervision Manual ("SUP"). This provides the FCA with a "snapshot" in time rather than up-to-date information. The FCA views this as limiting its ability to take proactive supervisory intervention where a firm fails to discharge its safeguarding obligations. 

Interim-state proposals

The interim-state proposals are intended to supplement the existing safeguarding requirements in the PSRs and EMRs. The FCA breaks them into the following categories: (1) improved books and records, (2) enhanced monitoring and reporting, and (3) strengthening elements of safeguarding practices. These will largely be set out in a new chapter 15 of the Client Asset Sourcebook ("CASS"), along with new rules in SUP.

Improved books and records

• The FCA will introduce more detailed record-keeping and reconciliation requirements, building on guidance in the Approach Document and similar to the requirements in CASS 7 for investment firms.
• Both an internal and an external reconciliation will be required at least once each business day. This involves firms comparing the amount of safeguarded funds against internal records and those of third parties (e.g. their safeguarding bank).
• Where a discrepancy is identified, firms will be required to determine the reason behind it and ensure that any shortfall is paid into, or excess withdrawn from, a Designated Safeguarding Account by the end of the business day on which the reconciliation is performed.
• A number of notification requirements will apply in connection with these obligations, including the need to notify the FCA if a firm is unable to remedy a discrepancy in its reconciliations.
• Firms will also be required to maintain a resolution pack. This will identify information and documents that would help an insolvency practitioner and/or the FCA where a firm fails.  

Enhanced monitoring and reporting

• A new monthly regulatory return will be submitted to the FCA, containing granular detail on safeguarded funds.
• Further, a firm's safeguarding arrangements will need to be audited annually. This builds upon existing guidance in the Approach Document. However, the auditor's report will now need to be submitted to the FCA.
• Auditors will need to be eligible for appointment under the Companies Act 2006 and so it will not be possible for compliance consultants without relevant qualifications to continue performing this role. The Financial Reporting Council is producing a standard for such audits.
• A limited audit will still be necessary where a firm was not required to safeguard relevant funds during a relevant period. Thus the requirement will apply to firms whose business models can involve no safeguarding, e.g. remittance providers.
• Oversight of compliance with safeguarding requirements will need to be allocated to an individual in the firm. This codifies existing guidance in the Approach Document and is consistent with the FCA's long-held aim to expand the Senior Managers & Certification Regime to cover the payments and e-money sector.

Strengthening elements of safeguarding practices

• Firms will be required to exercise due skill, care and diligence when appointing safeguarding banks, custodians and managers of relevant assets. Further, they will need to consider concentration risk and whether to diversify their use of such third parties.
• The FCA is aware that a growing number of firms invest relevant funds in relevant assets, given the difficulties in obtaining an account with a credit institution. New rules will require firms to ensure that there is a suitable spread of investments, assets are selected in accordance with an appropriate liquidity strategy and credit risk policy, and any foreign exchange risks are prudently managed. 
• For firms that use the insurance or comparable guarantee method, the FCA is concerned by the "cliff-edge" risk when an insurance policy or guarantee expires. As a result, such firms will be subject to certain new requirements, including an obligation to decide whether to extend their insurance policy or guarantee in advance.

End-state proposals

The FCA's end-state proposals would replace the current safeguarding regime in the PSRs and EMRs when revoked. This forms part of a wider initiative to replace assimilated EU law with rules set by the UK regulators. These new provisions will be implemented by way of amendments to chapter 15 of CASS.

A statutory trust will be imposed over relevant funds, relevant assets and the rights and proceeds under insurance policies and guarantees. This will have a number of important consequences.

• Instead of a PI or EMI and its client having a creditor/debtor relationship, beneficial title to the trust assets will be vested in the firm's clients. Such assets will thus fall outside the firm's general estate and will not be available for distribution to other creditors in insolvency. Where there is a shortfall, relevant third-parties could be pursued using equitable jurisdiction, including the tracing of assets.
• Further, firms will owe their clients fiduciary duties in their capacity as trustee. As the FCA notes, such duties would need to be considered when a PI or EMI's insolvency is imminent.
• The imposition of a trust will also have licensing implications for PIs and EMIs who invest relevant funds in secure liquid assets. The FCA states they will "likely" need permission under Part 4A of the Financial Services and Markets Act 2000 ("FSMA") to manage investments where they manage relevant assets with discretion. Further, if such firms do not have permission to safeguard and administer investments, they will need to deposit the relevant assets with an appropriately authorised custodian.

Interestingly, the FCA states that it could not replicate the post-Ipagoo position when the safeguarding requirements in the PSRs and EMRs are revoked. This is presumably because the FCA's statutory rulemaking powers in Part 9A of FSMA (as applied by the PSRs and EMRs) do not permit it to amend other legislation, e.g. the creditor waterfall in the Insolvency Act 1986. Happily the FCA believes that a trust is the better approach in any event. 

There are several other end-state proposals that merit note.

• The D+1 rule will be abolished, meaning that PIs and EMIs using the segregation method will need to receive relevant funds directly into a Designated Safeguarding Account. This will be subject to two exceptions where the FCA has identified this would be operationally challenging: where relevant funds are received (i) through a merchant acquirer or (ii) into an account that is held only to participate in a payment system. The D+1 rule will continue to apply in such cases.
• Agents and distributors will be prohibited from receiving relevant funds, save where their principal PI or EMI safeguards sufficient funds in Designated Safeguarding Accounts to cover the funds expected to be received by its agents or distributors based on historical transaction data. This tightens the existing position, where firms using the segregation method can allow their agents or distributors to hold relevant funds until the end of the business day following receipt.
• EMIs will no longer be required to hold relevant funds related to the issuance of e-money separately from those received for unrelated payment services. Instead, there will be a single asset pool. This may reduce costs for EMIs, as they can hold these relevant funds in a single Designated Safeguarding Account, subject to the new diversification requirements.
• The FCA plans to introduce an optional mechanism to address unclaimed relevant funds. Firms will be permitted to gift them to a registered charity, subject to the satisfaction of certain conditions. This is a welcome step, given the costs that firms can incur when handling even small unclaimed amounts.

Timetable

The FCA intends to publish final interim-state rules in mid-2025. Firms will then have a transition period of 6 months before they enter force. If this timetable is honoured, it is likely that PIs and EMIs will need to start complying with the interim-state rules by Q4 2025 or Q1 2026.

The timetable for introducing the end-state rules is less clear. The FCA has said that this will happen when the revocation of the safeguarding requirements in the PSRs and EMRs commences. The FCA has proposed then giving firms a 12 month transition period.

It is possible that the FCA will modify the timetable for introducing the measures in CP24/20 based on stakeholder feedback. PIs, EMIs and their advisors will therefore wish to check the FCA's policy statement when available to confirm the final position.

Key implications

Whether the benefits of the FCA's proposals outweigh their disadvantages is a question of policy and economics. However, there can be no doubt the measures in CP24/20 will, subject to any adjustments made following stakeholder feedback, have significant implications for PIs and EMIs.

Firms will face higher compliance costs, for example in relation to the increased frequency of reporting and external audit requirements. This will have a greater financial impact on smaller PIs and EMIs. Groups with firms in both the UK and EU will have to contend with diverging rulebooks. The proposals may also make the UK a less attractive jurisdiction to establish or maintain a payments or e-money business internationally. There is clearly a tension in this regard between enhancing consumer protection and promoting the conditions for economic growth. It will be interesting to see whether the FCA makes any concessions when issuing its final rules in light of the ongoing debate in this area.

The FCA makes several statements in CP24/20 that portend greater supervisory and enforcement action. For instance, in paragraph 1.21 it states that whilst it expects its proposals to lead to an ultimate reduction in the number of supervisory cases and formal interventions, these "may rise in the short term". Likewise, at paragraph 35 of Annex 2, the FCA notes that "… the lack of clarity and precision in current provisions leads to difficulties in enforcement as firms may be able to contest findings." Firms will therefore wish to be on the front foot in complying with the new rules and guidance.

In terms of the architecture of regulation applying to PIs and EMIs, the proposals in CP24/20 promote a welcome rationalisation. At present, there are only comparatively high-level statutory provisions that address safeguarding in the PSRs and EMRs. As noted above, these are then overlaid with numerous supervisory expectations in the Approach Document. This structure is a historical legacy resulting from how EU legislation was transposed prior to Brexit. Moving rules and guidance into the FCA Handbook should make the safeguarding regime more navigable and consistent with the approach for regulating other types of financial services firm.

The abolition of the D+1 rule, meaning that PIs and EMIs need to receive relevant funds directly into a Designated Safeguarding Account, will pose a significant challenge for firms with multi-currency and cross-border business models. Similarly, the prohibition on agents and distributors receiving relevant funds will significantly increase costs and constrain liquidity (for instance, where an EMI relies on a network of distributors for gift card-type products). Such firms will be hoping the FCA's final rules provide for greater flexibility.

The increased compliance costs on firms may trigger consolidation in the UK payments and e-money sector, with firms merging as they seek economies of scale. Similarly, smaller PIs and EMIs may have to exit the market if their business models are no longer financially viable. By narrowing the market, this would have adverse implications for consumer choice and innovation.   

More generally, the FCA has stated that following CP 24/20, it intends to continue working with HM Treasury to review and consult on the rest of the regime currently set out in the PSRs and EMRs, along with other initiatives. Therefore regulatory change in this area is unlikely to slow for the foreseeable future.  

Author bios

Simon Lafferty is a partner and John Budd is a director at Fieldfisher LLP and both specialise in financial services regulation. Emails: simon.lafferty@fieldfisher.com and john.budd@fieldfisher.com