UK e-money and payment institutions must file their first monthly FCA safeguarding return, form REP027, by 21 July 2026. That is 15 business days after the June month-end, the deadline set when the safeguarding Supplementary Regime came into force on 7 May 2026 under Policy Statement PS25/12. Our view is that this filing, not the May go-live, is when the new regime starts to bite. A policy refresh got firms through May. A monthly return that discloses reconciliation results and breach counts cannot be papered over, and it repeats every month, indefinitely.
That matters for anyone weighing where to hold an e-money licence. The UK EMI authorisation now carries a standing operational reporting cost that no EU regime currently matches, and it lands while the EU's own safeguarding overhaul under PSD3 is still one to two years from applying. Firms comparing the UK against Lithuania, Ireland or Malta on our e-money matrix should price in a permanent month-end reporting cycle on the UK side, not a one-off compliance project.
What does the FCA safeguarding return require?
REP027, submitted through RegData, asks for the safeguarding method used, the highest and lowest safeguarding requirement in the period, balances held at each third party, the results of the daily reconciliations the regime now mandates, account openings and closures, and any notifiable breaches. The FCA's safeguarding requirements page, updated 7 May 2026, confirms the return is due within 15 business days of each calendar month-end.
The rules behind it are the new CASS 15 and CASS 10A sourcebooks: daily internal and external reconciliations, a resolution pack that would let an insolvency practitioner return funds quickly, and enhanced due diligence on the banks and custodians holding safeguarded money. The FCA's rationale is blunt. Its own data on payment and e-money firm insolvencies between Q1 2018 and Q2 2023 found an average shortfall of 65 per cent in customer funds owed, roughly 35p in the pound returned.
The £100,000 exemption is narrower than it looks
Firms holding under £100,000 in relevant funds across a rolling 53-week period escape the annual safeguarding audit. They do not escape the monthly return. Every safeguarding firm reports from the June period onwards regardless of size, and the audit exemption threshold is low enough that most operating EMIs will clear it quickly. Smaller firms that read the exemption as a general carve-out should re-read it before 21 July. Audit timing runs separately: the first safeguarding audit report is due within six months of the firm's audit period end, four months for subsequent periods.
A two-regime problem for dual-licensed groups
Groups holding both a UK authorisation and an EU EMI licence now run two safeguarding regimes on different timetables: CASS 15 monthly discipline in the UK today, and the EU's PSD3 and PSR package later, with its provisional trilogue text endorsed in spring 2026 but application still expected in 2027 or 2028. Two reporting cadences and two audit cycles are a real cost of holding two licences, and worth modelling before you commit. Our UK e-money profile carries the current requirements, our comparison tool puts the UK against any EU peer side by side, and dated regime updates land on our changes feed as they happen.
The FCA has also said the Supplementary Regime is the interim step, with a fuller statutory-trust model to follow once legislation allows. How firms perform on these first returns will shape how hard that next phase lands.
Sources
- FCA Policy Statement PS25/12: Changes to the safeguarding regime for payments and e-money firms
- FCA press release: safeguarding rule changes and insolvency shortfall data
- FCA: Safeguarding requirements for payment and e-money institutions (updated 7 May 2026)
- Bratby Law: FCA safeguarding Supplementary Regime timeline and analysis (14 June 2026)
This article is for general information only and is not legal advice.