The PSR 2017 safeguarding requirements are the reason a business balance at a payment institution is not simply a loan to that firm. They live in a single regulation, number 23, and they decide what happens to your money on the worst day a provider can have.
The problem is that the rule is written for lawyers. It cross references its own paragraphs, "(5) to (11)" and "(12) and (13)", and since 7 May 2026 it has a second layer of FCA rules sitting on top of it. This article reads both in plain English, one paragraph at a time, then turns them into five questions you can put to any provider before you fund an account.
A short note before we start: this is an explanation of the rules, not legal advice.
What PSR 2017 safeguarding actually requires
Safeguarding is the duty to protect customer funds so they can be returned if the firm becomes insolvent. The FCA states that firms must follow regulation 23 of the Payment Services Regulations 2017, together with rules in Chapters 10A and 15 of the Client Assets Sourcebook (CASS) and Chapters 3A and 16 of the Supervision Manual (SUP), according to its safeguarding guidance for payment and e-money institutions.
In one sentence: keep customer money apart from the firm's money, or insure it, prove every day that the numbers match, and be ready to hand it back fast.
Who has to safeguard, and who only may
For an authorised payment institution, safeguarding is mandatory and a condition of authorisation. The FCA says so plainly.
Small payment institutions (SPIs) are different. They can choose to safeguard. If they do, they must apply the same level of protection expected of authorised firms, and they must tell the FCA whether they have opted in, both at registration and in their annual returns.
Firms that only initiate payments or only provide account information are outside the new regime, because they never hold the money. Mayer Brown's summary of the reforms lists them as the exception.
The practical takeaway: "we are FCA registered" is not the same answer as "we safeguard". Ask which kind of firm you are dealing with.
Relevant funds: the money the rules protect
Regulation 23(1) defines "relevant funds" as two things:
- •sums received from, or for the benefit of, a payment service user to execute a payment transaction, and
- •sums received from another payment service provider to execute a transaction on a user's behalf.
Regulation 23(2) handles mixed money. If only part of a sum is for payments and the rest pays for other services, and that split is not known in advance, the firm may safeguard a reasonable estimate based on historical data, to the FCA's satisfaction.
When does the clock start? The FCA's guidance is that the obligation begins as soon as the firm is entitled to the funds, often when they are credited to an account in the firm's name.
Method one: segregation, paragraph by paragraph
Almost every firm uses this route. Regulation 23(3) lets a firm pick segregation or insurance, and 23(4) lets it split its relevant funds between the two.
Keep it apart from day one
Regulation 23(5) is the shortest and most important line: relevant funds must be kept segregated from any other funds the firm holds. Not at month end. From receipt.
The end of the next business day deadline
Regulation 23(6) sets the hard deadline. If the firm still holds relevant funds at the end of the business day after the day they arrived, it must either:
- •(a) place them in a separate account with an authorised credit institution or the Bank of England, or
- •(b) invest them in secure, liquid assets the FCA approves and hold those assets in a separate account with an authorised custodian.
Missing this deadline is the finding auditors raise most. Regulatory Counsel's guide to safeguarding audits names segregation timing breaches as the most common, usually caused by manual steps, once-a-day batch runs or bank cut-off times.
The designated account and nobody else's claim
Regulation 23(7) requires the account to be designated as held for safeguarding and used only for those funds. Regulation 23(8) adds that no one other than the payment institution may have any interest in or right over the money, except as the regulation provides.
In practice that means a written acknowledgement from the bank confirming the account's status and that it has no right of set off against the balance. Regulatory Counsel lists missing or outdated acknowledgement letters among the common audit failures, typically after a firm changes banks.
Records
Regulation 23(11) requires the firm to keep a record of every segregated sum, every safeguarding account and every relevant asset. Without that, nobody can prove whose money is whose.
Method two: insurance or a guarantee
Regulation 23(12) offers the alternative. Relevant funds can be covered by an insurance policy with an authorised insurer, or a comparable guarantee from an authorised insurer or credit institution. The proceeds must be payable on insolvency into a separate, designated account used only for those proceeds, and 23(13) again bars anyone else from claiming them.
The 2026 rules tightened this route. The FCA now requires that policies do not restrict payouts beyond confirming insolvency, and that a contingency plan is in place three months before a policy expires.
It remains the minority choice. MEMA Consultants' safeguarding explainer notes that the vast majority of firms segregate, because suitable insurance products are scarce and expensive.
What happens on insolvency, and the duty under everything
If a firm fails, MEMA explains that safeguarded funds are treated as held on statutory trust: they sit outside the insolvent estate, are not available to general creditors, and go to customers in priority. The catch is in the same sentence of their guide. The protection is only as good as the firm's actual segregation.
That is why regulation 23(17) matters. It requires every authorised payment institution, and every SPI that safeguards voluntarily, to maintain organisational arrangements sufficient to minimise the risk of loss through fraud, misuse, negligence or poor administration.
The FCA had evidence that this was not happening. Mayer Brown quotes PS25/12: for payment firms that failed between Q1 2018 and Q2 2023, there was an average shortfall of 65 percent in funds owed to clients. We looked at what that means for a customer in detail in is your money safe with a payment institution.
The rules added on 7 May 2026
The FCA's answer was a Supplementary Regime that, per Mayer Brown, took effect on 7 May 2026. A second, CASS style "end state" regime that would replace regulation 23 entirely has been deferred pending further consultation. So today, regulation 23 still applies, with these rules on top.
Daily reconciliation
Firms must perform internal and external reconciliations at least once each reconciliation day. The FCA defines that as excluding weekends, bank holidays and days when relevant foreign markets are closed, which matters for a multi-currency provider. Internal reconciliation checks the firm's own records; external reconciliation checks them against bank statements. Mayer Brown adds that any shortfall must be rectified immediately, using the firm's own money if necessary.
Resolution packs
Every firm must keep a CASS 10A resolution pack so funds can be returned quickly after a failure. It includes a master document index, every institution holding relevant funds, executed agreements including acknowledgement letters, insurance policies, agents and distributors, and third-party providers, reviewed at least annually.
Annual safeguarding audit
Most firms must appoint a qualified auditor for an annual reasonable assurance report to the FCA. Firms that have never been required to safeguard more than £100,000 are exempt. Reports are due within four months of the period end, or six months for the first audit under the new rules.
Monthly safeguarding return
A new monthly return, form REP027, goes to the FCA within 15 business days of each month end. It covers the safeguarding requirement, methods, reconciliations, shortfalls, breaches and account details.
Third-party due diligence
Firms must use due skill, care and diligence when choosing and reviewing the banks, custodians and insurers that hold funds, and must consider diversification to reduce concentration risk, documenting the decision.
Five questions to ask your payment provider
The rules above are the firm's problem. These questions make them useful to you.
- •Are you an authorised payment institution, an e-money institution or a small payment institution, and do you safeguard? If the answer is SPI, ask whether they opted in.
- •Which method do you use, segregation or insurance? If insurance, ask when the policy renews.
- •Where are safeguarded funds held, and with how many institutions? The diversification rule means a considered answer should exist.
- •Do you reconcile every reconciliation day? A firm meeting the 2026 rules can say yes without hesitating.
- •Is your safeguarding audit up to date? Unless the firm is under the £100,000 exemption, there should be one.
For how this protection compares with a bank's, see payment institution vs bank and our guide to safeguarding vs FSCS.
How this applies to EX FI
We would rather state our own position exactly than let a badge do it.
EXFI is a trading name of EX Financial Solutions Ltd, which is not itself authorised or regulated by the FCA and acts as a distributor of payment services provided by Gemba Finance Ltd. Gemba Finance Ltd is authorised and regulated by the FCA as a payment institution under FRN 804853. The disclosure on exfi.app reads: regulated payment services provided by Gemba Finance Limited (FCA FRN 804853). UK customers only.
EXFI accounts are payment accounts, not bank accounts. Funds are not covered by the FSCS. They are safeguarded in segregated accounts in accordance with the Payment Services Regulations 2017, which is to say under the regulation 23 rules described above. The five questions in this article are fair to ask us too.
FAQ
Do small payment institutions have to safeguard under PSR 2017? No. Safeguarding is optional for SPIs. An SPI that opts in must meet the same standard as an authorised payment institution and must tell the FCA, at registration and in its annual returns.
Is PSR 2017 safeguarding the same as e-money safeguarding? The goal is the same, the mechanics differ. Payment institutions safeguard funds received for payment transactions until they are paid out. E-money issuers, under the Electronic Money Regulations 2011, safeguard funds equal to the e-money outstanding, for as long as it remains unredeemed.
Can a payment institution invest safeguarded funds? Only within narrow limits. Regulation 23(6)(b) allows investment in secure, liquid assets approved by the FCA, held in a separate account with an authorised custodian, and no one else may claim an interest in them. It is a custody rule, not a return on your balance.
Has the new CASS style regime replaced regulation 23? Not yet. The end state regime that would repeal regulation 23 was deferred pending further consultation. Regulation 23 applies today, with the Supplementary Regime rules that took effect on 7 May 2026 layered on top.