Changes to the safeguarding regime for payments and e-money firms

Home
Knowledge
FCA proposed changes to the safeguarding regime for payments and e-money firms in the United Kingdom
Changes to the safeguarding regime for payments and e-money firms

Changes to the safeguarding regime for payments and e-money firms

{1E976400-B590-40D2-B94D-28F19521BD6F}

November 29, 2024

On 25 September 2024, the Financial Conduct Authority (FCA) announced a consultation on the rules and guidance that payments and e-money firms must follow to safeguard customer funds (CP24/20: Changes to the safeguarding regime for payments and e-money firms). The FCA said it was consulting to address what it sees as weaknesses in the current approach to safeguarding customers' money.

The consultation proposes a staged approach to changing the rules around safeguarding with an interim state, which will improve compliance with the existing safeguarding requirements, and an end state where relevant funds and assets will be held on trust and with a "CASS" style regime.

In a series of articles, we will look at what changes the proposals will bring in both the interim and end states, and also talk about what this means for you if the rules are implemented as consulted upon.

The first of these articles looks at the impact the proposed rule changes will have on the books and records requirements for payments and e-money firms.

Improved books and records

One of the key areas of the FCA's consultation paper is record-keeping, reconciliations and resolution packs.

The FCA has expressed its concerns that many firms have inadequate processes for identifying relevant funds and therefore performing reconciliations to ensure that they are properly protecting funds that are held to complete payment transactions or for issued e-money.

The FCA believes that by formalising record-keeping and reconciliation requirements it will be able to better hold firms to account and ensure that they have adequate processes in place to properly protect relevant funds. This will also mean that information is available more quickly to insolvency practitioners and the FCA in the event of a firm's failure, thereby ensuring a swifter return of funds in the event of firm failure.

Organisational requirements

While the regulations require firms to maintain organisational requirements to minimise the risk of loss or diminution of relevant funds, the majority of information for firms on organisational requirements for safeguarding is guidance contained in Chapter 10 of the FCA's Approach to Payment Services and Electronic Money Document (Approach Document). Setting out firm requirements in the FCA Handbook will enable the FCA to identify and act on breaches by firms that fail to establish adequate organisational safeguards for client funds.

Existing rules	Proposal
Regs. 24(3) of the EMRs¹ and 23(17) of the PSRs² require firms to maintain organisational arrangements that are sufficient to minimise the risk of loss or diminution of relevant funds or assets through fraud, misuse, negligence or poor administration. Firms must also meet the conditions for authorisation at regs. 6 of the EMRs and PSRs. Among other things, these conditions include robust governance arrangements, effective procedures and adequate internal controls. Guidance at Chapter 10 of the Approach Document.	Interim state: Codifying Chapter 10 of the Approach Document. Firms must establish, implement and maintain adequate policies and procedures to help ensure compliance with the safeguarding provisions in the EMRs and PSRs, and the safeguarding rules. End state: The requirements for policies and procedures, along with resolution packs, will be aligned with the end state proposals. New organisational requirements to mitigate the risk of funds being lost due to fraud, poor record-keeping, or negligence will replace existing rules in regs. 23(17) of the PSRs and 24(3) of the EMRs. Firms must have clear policies and procedures to identify which funds are considered "relevant funds" when engaged in activities beyond payment services or e-money issuance.

Existing rules

Proposal

Regs. 24(3) of the EMRs¹ and 23(17) of the PSRs² require firms to maintain organisational arrangements that are sufficient to minimise the risk of loss or diminution of relevant funds or assets through fraud, misuse, negligence or poor administration.

Firms must also meet the conditions for authorisation at regs. 6 of the EMRs and PSRs. Among other things, these conditions include robust governance arrangements, effective procedures and adequate internal controls.

Guidance at Chapter 10 of the Approach Document.

Interim state:

Codifying Chapter 10 of the Approach Document.

Firms must establish, implement and maintain adequate policies and procedures to help ensure compliance with the safeguarding provisions in the EMRs and PSRs, and the safeguarding rules.

End state:

The requirements for policies and procedures, along with resolution packs, will be aligned with the end state proposals.

New organisational requirements to mitigate the risk of funds being lost due to fraud, poor record-keeping, or negligence will replace existing rules in regs. 23(17) of the PSRs and 24(3) of the EMRs.

Firms must have clear policies and procedures to identify which funds are considered "relevant funds" when engaged in activities beyond payment services or e-money issuance.

Records

The FCA considers that robust record-keeping requirements are essential for firms to establish effective processes for safeguarding relevant funds.

Existing rules	Proposal
Regs. 23(11) of the PSRs and 21(5) of the EMRs require firms to keep records of relevant funds or assets which are safeguarded. Chapter 10 of the Approach Document also confirms the FCA's general record-keeping requirements and that it expects clear, accurate records showing compliance, with documented rationale for decisions, to be reviewed regularly and be available upon request.	Interim state: Records and accounts must be maintained to enable a firm at any time, and without delay, to distinguish between relevant funds and other funds. engaged in activities beyond payment services or e-money issuance.

Reconciliations

The FCA believes reconciliation requirements will help firms quickly identify and address shortfalls in safeguarded funds. These requirements will also allow firms to understand whether they have adequate processes in place to protect relevant funds.

Existing rules	Proposal
The FCA provides guidance on reconciliations at paras. 10.79 to 10.88 of its Approach Document. Reconciliations should be done both internally and with third parties, and they should occur as frequently as necessary. Special attention is given to safeguarding practices which might result in discrepancies, with institutions being required to correct any mismatches as soon as possible, except in cases of timing issues.	Reconciliations must occur daily (at least once per business day) and must follow the method outlined in the proposed rules. Discrepancies must be identified, investigated and corrected by the end of the business day (unless they are as a result of timing differences between internal and external systems).

Existing rules

Proposal

The FCA provides guidance on reconciliations at paras. 10.79 to 10.88 of its Approach Document. Reconciliations should be done both internally and with third parties, and they should occur as frequently as necessary. Special attention is given to safeguarding practices which might result in discrepancies, with institutions being required to correct any mismatches as soon as possible, except in cases of timing issues.

Reconciliations must occur daily (at least once per business day) and must follow the method outlined in the proposed rules.

Discrepancies must be identified, investigated and corrected by the end of the business day (unless they are as a result of timing differences between internal and external systems).

Notification requirements

The FCA is proposing new notification requirements for firms³ where a range of different issues arise. These notification requirements appear to have been included so that the FCA is able to identify where issues with safeguarding funds are arising and rapidly intervene to ensure customer funds remain protected.

Existing rules	Proposal
N/A	Under the new proposals, firms will be required to notify the FCA without delay if any of the following occur: their internal records are materially out of date, inaccurate or invalid; they are unable to perform an internal or external reconciliation; they are unable to resolve a discrepancy found during reconciliations; or there has been a material difference between the amount of relevant funds they were safeguarding and the amount they should have been safeguarding at any point in the previous year.

Existing rules

Proposal

N/A

Under the new proposals, firms will be required to notify the FCA without delay if any of the following occur:

their internal records are materially out of date, inaccurate or invalid;
they are unable to perform an internal or external reconciliation;
they are unable to resolve a discrepancy found during reconciliations; or
there has been a material difference between the amount of relevant funds they were safeguarding and the amount they should have been safeguarding at any point in the previous year.

Resolution packs

Given the issues that insolvency practitioners and the FCA have faced with payment firm failures, it is clear that the FCA is looking to replicate the existing approach it takes with resolution packs in CASS 10.

Existing rules	Proposal
N/A	FCA considers that a resolution pack will ensure that firms maintain and are able to retrieve information that would: help an IP achieve a timely return of relevant funds to consumers; in the event of another firm's resolution, help the Bank of England or FSCS; and in both of the above cases, help the FCA deal with an insolvency event. Specified documents must be able to be retrieved within 48 hours.

Existing rules

Proposal

N/A

FCA considers that a resolution pack will ensure that firms maintain and are able to retrieve information that would:

help an IP achieve a timely return of relevant funds to consumers;
in the event of another firm's resolution, help the Bank of England or FSCS; and
in both of the above cases, help the FCA deal with an insolvency event.

Specified documents must be able to be retrieved within 48 hours.

What does this mean for you?

To comply with the new FCA rules, you will need to review your current organisational arrangements, record-keeping, notification procedure and reconciliation process, and conduct a gap analysis to identify discrepancies between your existing practices and the new rules. Existing reconciliation processes will need to be carefully reviewed against the new rules for both internal and external reconciliation. Firms should start looking to identify whether they have all of the required information and whether additional resource is going to be required in order to comply with these requirements. This will be a two-stage process, with separate reviews for both the interim and end state rules.

We can support you throughout this process by conducting a thorough gap analysis and working alongside you to address any gaps in your policies and procedures. Our approach will not only ensure regulatory compliance, but also help you streamline your operations to enhance efficiency and reduce risk in a way that goes beyond just complying with the rules.

We anticipate that the resolution pack will be a novel challenge to most firms which are not currently subject to CASS. Aside from the initial resources required for preparing the resolution pack, you will need to allocate ongoing resource to keep resolution packs up to date and periodically test their availability against the required timeframe.