AML Automation That Ships Fast

CASPs serving EU clients must obtain MiCA authorisation before 1 July 2026 or cease offering and soliciting services in the EU and wind down in an orderly manner. Travel-rule and AML/CFT obligations apply throughout.

1. Requirements Already Implemented (Current Law)

Firms must currently comply with the safeguarding requirements established in existing regulations and the FCA’s "Approach Document."

• Legal Framework: Safeguarding is mandated by Regulation 23 of the Payment Services Regulations 2017 (PSRs) and Regulation 20 of the Electronic Money Regulations 2011 (EMRs).
• "Relevant Funds": Firms must protect sums received from, or for the benefit of, a payment service user for the execution of a payment transaction, or in exchange for e-money.
• The "D+1" Rule: If funds are still held at the end of the business day following receipt, they must be placed in a designated safeguarding account (DSA) with an authorized credit institution or invested in secure, liquid assets.
• Methods of Safeguarding:

• 1. Segregation: Keeping relevant funds separate from the firm’s own funds.
• 2. Insurance/Guarantee: Protecting funds through an insurance policy or comparable guarantee from an authorized insurer/credit institution.

• Current Guidance: Firms are expected to follow Chapter 10 of "Payment Services and Electronic Money – Our Approach," which covers systems and controls, segregation methods, and the effect of insolvency.

• 
  

2. The Phased Changes: Interim vs. End-State

The FCA is moving safeguarding from high-level regulations to a more prescriptive regime in the:

• Stage 1: The Supplementary Regime (Interim Rules): These rules strengthen existing practices and improve reporting without replacing the underlying EMRs/PSRs yet. This stage takes effect on May 7, 2026.
• Stage 2: The Post-Repeal Regime (End-State Rules): This will replace the PSR/EMR safeguarding requirements entirely with a "CASS-style" regime, including the imposition of a statutory trust over relevant funds.

3. Requirements to be Implemented by May 7, 2026

By this date, firms must comply with the:

A. Improved Books and Records

Daily Reconciliations: Firms must perform internal and external reconciliation:

• Internal: Reconcile internal records to ensure the amount safeguarded matches what should be safeguarded.
• External: Compare internal records against the records of third parties (banks/custodians).
• Resolution Pack: Firms must maintain a "CASS resolution pack" containing all documents an insolvency practitioner would need to return funds quickly. These documents must be retrievable within 48 hours of an officer's appointment.

B. Enhanced Monitoring and Reporting

• Monthly Safeguarding Return: Firms must submit a new monthly regulatory return electronically to the FCA. This return covers data on safeguarded amounts, methods used, and reconciliation results.
• Annual Safeguarding Audit: Compliance with safeguarding requirements must be audited annually by an independent external auditor and submitted to the FCA.
• Oversight Allocation: Responsibility for safeguarding compliance must be allocated to a single director or senior manager.

C. Strengthening Safeguarding Practices

• Third-Party Due Diligence: Firms must exercise "due skill, care and diligence" when selecting and periodically reviewing third parties that hold client funds or provide insurance.
• Diversification: Firms must consider whether it is necessary to diversify the third parties they use to hold relevant funds to mitigate concentration risk.
• Acknowledgment Letters: Firms must obtain formal acknowledgment letters from banks/custodians using a template that puts them on notice that the account holds relevant funds.
• Insurance/Guarantee Criteria: If using this method, firms must decide on renewals at least 3 months before expiry. If no replacement is in place with 3 months remaining, the firm must move to the segregation method.

Summary Checklist for May 7, 2026:

Area	Action Required
Governance	Appoint a senior manager responsible for safeguarding oversight.
Reporting	Set up systems for the new Monthly Safeguarding Return.
Audit	Appoint an external auditor for the Annual Safeguarding Audit.
Reconciliation	Implement daily internal and external safeguarding reconciliations.
Insolvency Prep	Collate a Resolution Pack retrievable within 48 hours.
Operations	Obtain new Acknowledgment Letters for all safeguarding accounts.

Note on Wind-Down Plans: While the sources focus on safeguarding, they highlight that failing to renew an insurance policy or identify shortfalls must be factored into wind-down planning to ensure the firm can either move to segregation or enter orderly administration before client funds are at risk.

Firms should review and upgrade their safeguarding framework before 7 May 2026. In practice, this means strengthening daily safeguarding checks and reconciliations, preparing for enhanced reporting, ensuring wind-down and insolvency-return planning is robust, and assessing whether an annual safeguarding audit is required. Firms seeking authorisation should also note that applications are assessed against the new safeguarding standards. A practical implementation plan should usually cover governance, documented safeguarding procedures, segregation and reconciliation controls, reporting readiness, auditor readiness where applicable, and evidence that customer funds can be returned quickly if the firm fails. https://www.fca.org.uk/news/press-releases/payment-safeguarding-rules-changes

Entities issuing or planning to issue FRS touching Hong Kong must obtain an HKMA licence and meet reserve-backing, redemption, governance and AML/CFT requirements. Pre-existing issuers must rely on transitional provisions and apply within the prescribed window.

VASPs and token issuers operating in or from Dubai (outside DIFC) must hold the appropriate VARA licence and meet issuance-specific requirements. Stablecoin-type FRVA and real-world-asset-backed ARVA issuers are squarely in scope and had a short window to align.

Stablecoin issuers and guaranteeing banks must meet FINMA's minimum default-guarantee requirements for holder protection and apply heightened AML/CTF and sanctions controls; a bank guarantee does not remove all licensing, operational, legal and reputational risk.