Safeguarding: what happens to merchant money if a payment firm fails

What safeguarding actually is

When a payment institution takes money that belongs to a merchant, and holds it for any period before passing it on, that money is not the firm's own. It belongs to the merchant.

Safeguarding is the set of rules that requires the firm to keep those funds identifiable and separate. In practice that usually means holding them in a designated account at a credit institution, separate from the firm's operating money, and reconciling regularly so that the amount held always matches the amount owed. The alternative permitted method is protection under an insurance policy or guarantee.

The point of it is insolvency. If the firm fails, safeguarded funds sit outside the pool available to general creditors, and are returned to the customers they belong to.

Safeguarding is not the Financial Services Compensation Scheme. Money held by a payment institution is not FSCS protected in the way a bank deposit is. Safeguarding is the protection that applies instead, which is precisely why how well it is done matters.

What went wrong under the old regime

The FCA's own review found that the rules were not being followed well enough to do their job.

Across the payment firms that became insolvent between the first quarter of 2018 and the second quarter of 2023, there was an average shortfall of 65 per cent between the funds owed to customers and the funds actually safeguarded. In other words, on average, only about a third of what customers were owed had been properly protected.

Alongside the shortfalls came delay. Where funds were available to distribute, customers often waited years to receive them.

The FCA's assessment was that the requirements themselves were insufficiently detailed and that firms were implementing them inconsistently. That combination produced a regime that looked protective on paper and failed in practice at exactly the moment it was needed.

What changed on 7 May 2026

The FCA set out final rules in Policy Statement PS25/12, published on 7 August 2025. The first phase, which the FCA calls the Supplementary Regime, came into force on 7 May 2026.

The changes are not a redesign of the concept. They are a tightening of how it has to be done:

• Record keeping. Consistent records, so a firm can demonstrate at any point what it holds and who it belongs to.
• Reconciliation. More frequent and more rigorous checking that funds held match funds owed.
• Reporting and monitoring. Enhanced returns to the regulator, so shortfalls surface early rather than at insolvency.
• Audit. Independent audit of safeguarding arrangements, with a proportionality threshold for the smallest firms.

The rules apply to authorised payment institutions, authorised and small e-money institutions, and credit unions issuing e-money. Small payment institutions can opt in.

A second phase, the Post-Repeal Regime, would replace the existing statutory requirements with a client assets style regime including a statutory trust over safeguarded funds. That phase depends on legislative change and its final shape is not yet settled.

What this means for a merchant

In ordinary trading, nothing. Safeguarding is invisible when it is working. Money arrives on the expected timetable and the arrangements behind it are not visible in the settlement report.

It becomes relevant in one scenario: the firm handling your money fails while it is holding some of yours. The gap between a sale and settlement means there is almost always some money in transit.

The practical question for a merchant is therefore not how safeguarding works, but whether the firm in the chain is authorised and subject to these rules at all. That is checkable. Every authorised firm appears on the Financial Services Register with a firm reference number, and the register shows what the firm is permitted to do.

What this means for a software platform choosing a payments partner

Platforms embedding payments are making this choice on behalf of their merchants, whether or not the question is asked out loud. A merchant who loses money because the payments firm behind their software failed will not draw a distinction between the software company and the payments company.

Reasonable questions to ask any prospective partner:

• What is your FCA authorisation, and what is your firm reference number?
• Are you subject to the safeguarding rules that came into force on 7 May 2026, and how are you implementing them?
• Where are safeguarded funds held, and how often are they reconciled?
• Who audits your safeguarding arrangements?
• At what points in the flow are merchant funds held by you rather than in transit?

A partner that answers these easily is a partner that has thought about them. A partner that treats them as an odd question is telling you something.

VestaOne is authorised by the Financial Conduct Authority as a payment institution, firm reference number 784165, and is subject to the safeguarding regime described here.

Frequently asked questions

Is safeguarded money the same as FSCS protected money? No. FSCS protection applies to deposits held by banks and building societies. Money held by a payment institution is not FSCS protected. Safeguarding is the separate regime that applies instead.

Does safeguarding mean my money is always safe? It means the firm is required to keep it separate and identifiable so it can be returned if the firm fails. The FCA's own findings show that the requirement was not always met under the previous regime, which is the reason the rules were tightened.

How can I check whether a firm is authorised? Search the Financial Services Register on the FCA website using the firm's name or reference number. It shows whether the firm is authorised and what permissions it holds.

Does this affect how quickly I get paid? No. Safeguarding governs how funds are held and reconciled, not the settlement timetable.

Who do the new rules apply to? Authorised payment institutions, authorised and small e-money institutions, and credit unions issuing e-money in the UK. Small payment institutions can opt in.

The FCA's policy statement, including the final rules and guidance, is published in full at fca.org.uk/publications/policy-statements/ps25-12-changes-safeguarding-regime-payments-and-e-money-firms

VestaOne is a trading brand of Vesta Merchant Services Limited, registered in England and Wales, company number 07108015. Vesta Merchant Services Limited is authorised by the Financial Conduct Authority as a payment institution, firm reference number 784165. Part of Vesta Software Group.

This article is provided for general information only. It is not financial, legal or regulatory advice, and it does not take account of any particular business's circumstances.