Does my payments firm need a safeguarding audit?

Current position

Proposed changes in CP24/20

The regulator is proposing to codify the requirement for a safeguarding audit in rules, and to extend it to all payments firms (other than payment initiation service providers, small payment institutions (‘SPIs’) and credit unions that issue e-money, for which this will be guidance only).  

Even if the firm (with the above exception) was not required to safeguard relevant funds during the period, they will still require a ‘Limited assurance’ safeguarding audit. 

The auditor provides a ‘reasonable assurance opinion’ on: 

• whether the institution has maintained organisational arrangements adequate to enable it to meet the FCA’s expectations of its compliance with the safeguarding provisions of the EMRs/PSRs 2017 (as set out in chapter 10 of the approach document) throughout the audit period; and 
• whether the institution met those expectations as at the audit period end date. 

An annual audit report, prepared in a prescribed format, confirming:  

• whether the institution has maintained systems adequate to comply with the applicable safeguarding requirements; 
• whether the firm was in compliance with those requirements at the end of the audit period; 
• details of any breaches; and 
• the remedial actions taken (if any) by the firm and the circumstances that gave rise to the breach