Enhanced monitoring and reporting

Home
Knowledge
FCA proposed changes to the safeguarding regime for payments and e-money firms in the United Kingdom
Enhanced monitoring and reporting

Enhanced monitoring and reporting

{362936F9-A8E1-4524-8729-A3368193A62F}

December 10, 2024

In this third article in our series about the FCA's consultation on changes to the safeguarding regime for payments and e-money firms, we look at the FCA's proposals to require safeguarding audits for most firms and enhanced reporting.

In line with the FCA's focus on becoming a "data-driven" regulator,¹ it has proposed enhanced monitoring and reporting requirements in its consultation. It expects that this increased oversight will strengthen its ability to identify and intervene where firms are not compliant with the safeguarding regime, as well as facilitating targeted proactive supervision in response to trends detected across the sector.² The FCA further notes that the existing infrequent and light-touch regulatory reports also limit its ability to quantify and assess the risk of a firm failing.³

Safeguarding audits

The FCA considers that regular and robust safeguarding audits would help to improve firms' safeguarding arrangements, systems and controls, and increase compliance with the safeguarding requirements. This would allow firms to independently verify their safeguarding policies, processes and practices, and to address any breaches of the safeguarding requirements to improve consumer protection. The proposed safeguarding audits are also expected to help the FCA identify firms that pose the most risk and help to ensure that they comply with the safeguarding regime.⁴


Existing rules	Proposal
The FCA expects firms to arrange specific annual audits assessing their compliance with the safeguarding requirements where they are required to arrange statutory audits of their accounts under the Companies Act 2006.⁵ A firm's auditor is required to report to the FCA on:⁶ significant contraventions of the PSRs/EMRs; matters affecting the firm's ability to meet the conditions for authorisation and, if applicable, the requirement to maintain own funds; concerns about the firm's ability to continue as a going concern; and inability to confirm that the annual accounts comply with certain provisions of the Companies Act 2006.	Interim state: Rules will extend to all authorised payments firms, excluding payment initiation service providers, small payment institutions (SPIs) and credit unions issuing e-money.⁷ The audit requirements will apply irrespective of whether the firm needed to safeguard funds during the audit period. If the firm did not need to safeguard funds during the audit period, the audit should be conducted under a limited assurance engagement. The FCA proposes codification of safeguarding audit requirements including rules relating to:⁸ the appointment of an external safeguarding auditor and procedures for appointing an auditor if a firm fails to do so within 28 days; obligations for firms to cooperate with their auditors; and requirements for auditors to cooperate with the FCA. An annual audit report will need to be submitted to the FCA in a prescribed format.⁹ The audit report will need to confirm: whether the firm had maintained systems adequate to comply with the applicable safeguarding requirements; whether the firm was in compliance with those requirements at the end of the audit period; details of any breaches; and the remedial actions taken (if any) by the firm and the circumstances that gave rise to the breach. End state: The rules will be amended to reflect the new safeguarding regime in the end-state rules.

Safeguarding reporting

The FCA is concerned that the existing reporting requirements provide them with only a "snapshot" in time, rather than up-to-date information, and does not account for how or where firms safeguard relevant funds. This lack of oversight hinders the FCA's ability to proactively target supervisory activity or identify poor practice early on. This can lead to more significant challenges in crisis scenarios, such as when a firm with a high value of safeguarded funds fails, or where a firm holding safeguarded funds or assets for others fails.¹⁰


Existing rules	Proposal
Firms report their safeguarding holdings once a year.¹¹	Interim state: Firms will need to submit a new monthly regulatory return which will include data on: the safeguarding audit requirements; the safeguarding method(s) used; amounts of relevant funds safeguarded; safeguarding reconciliation in the period, including the excess or shortfall identified and adjustments made to rectify them, as well as the frequency of internal and external reconciliations; relevant funds bank accounts and relevant assets accounts; and notifiable breaches.¹²

What does this mean for you?

Firms that were not previously required to conduct audits under the Companies Act 2006 will now need to comply with the new rules for annual audits. As a result, they will need to identify and engage a suitable statutory auditor and ensure adequate staff resources to address audit findings.

While the FCA did not identify any one-off costs with the move to annual audits for all firms, there will need to be time and financial resources allocated to finding and appointing an auditor. The FCA estimates the ongoing costs for safeguarding audits to be about £12,000 per annum for a small payments firm (which are estimated to be the majority of firms not currently required to conduct an audit under the Companies Act 2006). Smaller firms in particular should start investigating the costs of an annual audit and budget for these ongoing costs in their business planning.

Firms will also need to plan the timing of their audits carefully, engaging auditors well in advance to avoid breaching rules and to help them manage costs (by ensuring they have the opportunity to "shop around" and choose an auditor that best meets their requirements).

For those firms already conducting statutory audits, they should perform a gap analysis to align current reporting with the new format required for the annual audit report.

The FCA has suggested that the move to monthly reporting will not require firms to collect any further data. Firms will need to test this assertion by assessing reporting requirements and ensuring that all necessary MI is in fact available and can be accessed promptly to meet reporting deadlines. The effect of these requirements on staffing and resources will also need to be considered, and firms will need to designate staff responsible for the timely submission of reports.