Safeguarding / Segregated Account is a bank account designated solely for holding the customer funds of a payment institution or e-money institution apart from the firm's own money, so customers are repaid first if the firm fails. Safeguarding is a licence condition because these firms are not banks and cannot use customer money to fund their business. UK regulation 23 of the Payment Services Regulations 2017 permits segregation, with funds placed in a designated account by the end of the business day after receipt, or an insurance or guarantee method. Since 7 May 2026, CASS 15 adds daily reconciliations, monthly REP027 returns and annual audits. A shortfall is shared among customers and can block change-in-control approval.
How does safeguarding work
In the UK, regulation 23 of the Payment Services Regulations 2017 gives an authorised payment institution two methods. Under the segregation method, relevant funds must be kept apart from the firm's own funds and, if still held at the end of the business day after receipt, placed in a designated account with an authorised credit institution or the Bank of England, or invested in approved secure, liquid assets held by a custodian. Under the insurance method, an insurance policy or comparable guarantee pays out into a designated account if the firm becomes insolvent. Firms may combine the two. PSD2 Article 10 gave EU payment institutions the same two options.
Insolvency priority
If the firm becomes insolvent, regulation 23 states that the claims of payment service users are paid from the asset pool in priority to all other creditors. That protection is only as good as the firm's records: a shortfall between what customers are owed and what sits in the account is shared among customers.
What changed with CASS 15
The FCA's new safeguarding chapter, CASS 15, has applied since 7 May 2026. It adds four obligations UK firms did not previously have in this form. Internal and external reconciliations must be run on every reconciliation day, and any shortfall corrected the same day. A monthly safeguarding return, REP027, is due within 15 business days of each month end. A resolution pack, covered by CASS 10A, must be retrievable within 48 hours of an insolvency appointment. An annual safeguarding audit is required unless the firm has not had to safeguard more than £100,000 at any time over a period of at least 53 weeks.
An illustrative case: a PI holding £4.2m of customer funds overnight runs its reconciliation on Tuesday morning and finds the safeguarding account holds £4.15m because a refund batch left from the wrong account. Under CASS 15 it must top up the £50,000 from its own funds that day and record the breach.
Proposals for a statutory trust over safeguarded funds were not taken forward; the FCA said it would consult again only after reviewing how CASS 15 works over a full audit period.
Safeguarding in due diligence
For a buyer of an EMI or PI, safeguarding is the first file to open. Daily reconciliation records, the last safeguarding audit report, the acknowledgement letter from the safeguarding bank and any breach notifications to the regulator show whether customer money has ever been at risk. A qualified safeguarding audit or an unresolved shortfall can block regulatory approval of the change in control and is usually priced as a specific indemnity.