Guardexia · Regulatory Analysis
Beyond 7 May: where the FCA is taking payments regulation next
The Supplementary Regime is not the destination. It is the measurement instrument. Understanding what the FCA intends to do with the data it is about to collect — and what that means for firms this quarter — is the question most compliance programmes have not yet answered.
Guardexia · April 2026 · 10 min read · Sources: FCA PS25/12 · FCA Payments Regulatory Priorities March 2026 · FCA 2025–2030 Strategy · FCA CP24/20
The question firms are not asking
Most compliance activity in the payments sector over the past twelve months has been calibrated to a single date: 7 May 2026. Gap analyses, reconciliation tooling, resolution packs, auditor appointments — all of it framed as a deadline to be met rather than a starting point to be understood.
That framing is understandable. The obligations are real and the enforcement exposure for non-compliance is immediate. But there is a gap between firms that are technically compliant today and firms that are likely to withstand FCA data scrutiny over the next eighteen months — and that gap is not visible in any rulebook. It becomes visible in the FCA's dataset, beginning in May.
The FCA has been unusually explicit about its trajectory in PS25/12, the March 2026 Payments Regulatory Priorities report, and its 2025–2030 strategy. Firms that read only the rulebook understand what they are required to do. Firms that read the regulatory strategy alongside it understand what they are being measured against.
Combined customer funds safeguarded by EMIs and payment institutions in 2024. From 7 May 2026, the FCA receives structured monthly data on every pound of it — for the first time.
FCA Payments Regulatory Priorities, March 2026 · FCA PS25/12
Stage one as a supervisory instrument
PS25/12 is structured in two stages. The Supplementary Regime — in force from 7 May — overlays existing obligations with codified reconciliation, reporting, and audit requirements. The Post-Repeal Regime, which would replace those with a statutory trust framework modelled on CASS, has been deferred. The FCA has confirmed it will not consult until at least Q4 2027, after reviewing a full audit cycle under the Supplementary Regime.
The deferral is conditional, not permanent. The FCA's stated intention is to review implementation after a full audit period and consult on further proposals if the regime is not achieving intended outcomes. The Post-Repeal Regime is likely to be shaped by what that data shows — which means the firms that perform well in 2026 and 2027 can expect a lighter future framework than those that do not.
The monthly return is the primary data mechanism. From 7 May, every in-scope firm submits a structured return within 15 business days of each month-end: safeguarding requirement, method, reconciliation outcomes, shortfalls and remediation, breach details, account and insurance arrangements. By the time the FCA begins its Post-Repeal consultation, it is expected to hold approximately eighteen months of structured, firm-by-firm compliance data across the full sector.
Three things the FCA's monthly data is likely to expose — sector-wide, for the first time
Reconciliation completion rates across the full population. The return requires firms to confirm whether reconciliations were completed on every reconciliation day. Across several hundred firms over eighteen months, the FCA will increasingly have a sector baseline. Firms with persistent gaps are likely to become prioritisation signals for supervision — assessed not against an abstract standard, but against each other in a dataset the FCA holds permanently.
Shortfall frequency and remediation quality. Every shortfall must be disclosed with the remediation steps taken. A one-off shortfall, well documented, is a process event. A recurring pattern — or remediation without documentation — is a systemic finding that will accumulate in the FCA's dataset. Under the supervision-led model, the FCA does not need to wait for an audit report to act on a pattern it can already see.
Method and provider concentration risk. The returns disclose safeguarding method, custodian accounts, and insurance arrangements. The FCA is expected to build a real-time picture of concentration risk across the sector that it currently has no systematic way of collecting — data that is likely to directly inform both supervisory priorities and Post-Repeal framework design.
One consequence is specific and consistently underestimated: the monthly return is likely to be cross-referenced against the annual audit report as a matter of course. A firm whose returns characterise its safeguarding position differently from what its auditor finds will have generated a compliance inconsistency in the FCA's own records — independently of any internal process error. Gaps between the two are expected to become a supervisory flag before the auditor has written a word of analysis.
The core compliance risk is not reconciliation failure in isolation — it is divergence between what your reconciliation system produces, what your monthly return states, and what your auditor subsequently finds. Guardexia eliminates that divergence by generating submission-ready return data from the same engine that produces the daily audit trail. There is no manual assembly step, and no gap between the three datasets the FCA will compare. See how safeguarding reconciliation works →
The supervision model is already different
Before examining what the FCA intends to build next, it is worth understanding how it is currently using its supervisory toolkit — because that model has already changed materially from what most firms experienced under the previous regime.
The FCA has moved away from enforcement-led outcomes. Open enforcement operations fell from approximately 220 in 2023 to 124 by October 2025. In their place: earlier intervention, faster outcomes, and requirements imposed through supervisory tools rather than formal investigations. Regulatory exposure now arises earlier, costs more in management time, and carries fewer procedural safeguards than formal enforcement action.
Voluntary requirements — effective business restrictions — are the FCA's primary instrument for firms with identified safeguarding weaknesses. Guavapay, a small EMI, entered compulsory liquidation in January 2026 following a VREQ that prohibited new customer onboarding. The restriction preceded the insolvency by four months.
BCLP analysis, February 2026 · FCA register
The FCA has confirmed publicly that it expects supervisory cases related to deficient safeguarding to increase in the short term. A safeguarding audit that returns an adverse opinion is not merely a compliance document — it is a supervisory signal that the FCA's payments team is likely to act on. Firms that treat an adverse finding as an internal remediation matter, without proactive regulatory engagement, are misreading how the system now operates.
Where firms will diverge
The Supplementary Regime is expected to produce visible differentiation across the sector within twelve months of going live. Firms will not be assessed against an abstract compliance standard in isolation — they will increasingly be compared against each other in data the FCA holds month by month. Three groups are likely to emerge.
Group 1
Daily reconciliation outputs feed directly into structured monthly returns with no manual assembly. Audit trail is continuous. Board MI reflects live safeguarding position. The three datasets the FCA will compare — reconciliation, return, and audit — are generated from a single source of record.
Likely outcome: lower supervisory intensity; stronger Post-Repeal transition position.
Group 2
Reconciliation is performed correctly but documented manually. Returns are assembled close to the 15-business-day deadline, often from spreadsheets that do not share a data model with the reconciliation output. Audit preparation is a periodic sprint rather than a continuous process. These firms are technically compliant at point-in-time — but the data patterns they generate accumulate over time.
Likely outcome: increasing supervisory friction through 2027; elevated transition cost when Post-Repeal consultation arrives.
Group 3
Reconciliation is incomplete or undocumented. Returns contain inaccuracies or omissions that are likely to diverge from audit findings. Adverse audit reports are submitted to the FCA with Breaches Schedules that indicate systemic gaps. Under the supervision-led model, these firms are expected to face VREQs and restrictions without a formal investigation ever being opened.
Likely outcome: supervisory intervention before the first full audit cycle completes.
The board implication for Group 3 firms is direct: a VREQ prohibiting new customer onboarding does not require a formal enforcement investigation. It may follow a pattern in monthly return data that the FCA identifies before any audit report is submitted. Supervisory intervention of that kind is unlikely to be survivable for a firm whose revenue depends on growth.
The distinction between Group 1 and Group 2 is not visible today. It is likely to become visible in the FCA's dataset by early 2027, when patterns across the first six to nine months of submissions begin to compound. The cost of moving from Group 2 to Group 1 is significantly lower now than it will be under active supervisory scrutiny.
What boards should assume from this
Five board-level assumptions for 2026–2027
- The monthly return is a permanent regulatory record. The FCA is expected to cross-reference returns against audit reports. Inconsistencies between the two are likely to be treated as independent supervisory flags — not simply as administrative discrepancies to be explained away.
- An adverse audit finding is a supervisory trigger, not an internal remediation document. Proactive FCA engagement after an adverse finding is not optional — it is the minimum expected response under the supervision-led model.
- The Post-Repeal Regime is likely to be shaped by what the FCA observes in 2026–2027 data. Firms that perform well in the Supplementary Regime can expect a lighter future framework. Firms that perform poorly should expect a regime designed in part around their observed failures.
- VREQs can precede insolvency. Supervisory restrictions on new customer onboarding or e-money issuance can destroy the revenue model of a payments firm within months — without requiring a formal investigation to be opened.
- The architectural decisions made in 2026 compound. How you build the reconciliation-to-return pipeline, how you structure board MI, and how you document shortfall remediation will either reduce or multiply the cost of the Post-Repeal transition when it arrives.
The regulatory horizon
Supplementary Regime live. Daily reconciliation, monthly returns, and resolution pack obligations in force. FCA begins collecting structured monthly data across the full in-scope population. Supervisory screening begins immediately on the new dataset.
First audit reports submitted. Firms with audit periods ending May 2026 submit within six months. FCA receives the first wave of Breaches Schedules. The sector-wide compliance picture becomes visible. Supervisory action is likely to begin on firms where return data and audit findings diverge.
FCA review of Supplementary Regime. After a full audit cycle, the FCA assesses whether the regime is achieving intended outcomes. FRC is expected to publish a dedicated safeguarding assurance standard — the audit scope is likely to tighten. PSD3 in force across the EU creates divergent regimes for cross-border firms.
Post-Repeal consultation, if the FCA proceeds. Proposals for statutory trust over relevant funds, direct receipt into designated accounts, and full CASS-style architecture. Timing conditional on HM Treasury legislation. Firms that have not modelled the transition are likely to face a compressed implementation window against a hard legislative deadline.
What breaks first under FCA scrutiny
The following are the specific points at which firms in Group 2 and Group 3 are most likely to generate the data patterns that become supervisory flags — ranked by the speed at which they surface in the FCA's dataset.
Critical — surface in every monthly cycle
1. Manual return assembly from reconciliation spreadsheets. When the reconciliation output and the monthly return do not share a data model, version drift is structurally unavoidable. The FCA is expected to cross-reference returns against audit outputs as a matter of course. This is the point at which divergence most commonly appears — and it appears in every monthly cycle, compounding with each submission.
Surfaces monthly from May 20262. Undocumented shortfall remediation. A shortfall corrected from own funds without a written record — root cause documented, own-funds drawdown logged, escalation trail evidenced — is likely to appear in the audit as a control gap. If the monthly return did not disclose it, the gap is expected to also be treated as a return inaccuracy. The combination becomes a Breaches Schedule entry the FCA receives directly.
Surfaces at audit, cross-referenced to returns3. Board MI assembled at audit rather than maintained continuously. The FCA expects named SMF accountability and board-level visibility between audit cycles. A board that cannot evidence it was monitoring safeguarding on an ongoing basis — rather than approving an annual report — has a governance gap the auditor is required to report on, and the SMF is required to attest against.
Surfaces at audit; SMF personal exposureSecondary — surface at audit or Post-Repeal transition
4. No proactive engagement protocol for adverse audit findings. Under the supervision-led model, the FCA's likely response to an adverse finding is supervisory rather than investigatory. Firms that wait to be contacted, rather than initiating engagement with a remediation plan already in place, are likely to receive a more restrictive supervisory outcome.
Supervisory escalation risk5. No structural modelling of the Post-Repeal transition. The statutory trust proposal requires custodian agreements, account structures, and internal ledger accounting to be redesigned. Firms that have not assessed the gap between their current arrangements and the Post-Repeal direction are likely to face a compressed implementation window — with supervisory intensity already elevated from the Supplementary Regime period.
Post-Repeal transition risk6. Cross-border firms with a single compliance framework. The UK statutory trust direction and EU PSD3 segregation model are structurally different. Firms operating in both jurisdictions that treat these as a single compliance exercise are likely to discover the gap when the Post-Repeal consultation arrives — against a timeline that does not allow for a clean rebuild.
Cross-border framework gapThe compliance risk most firms are not managing is not reconciliation failure in isolation — it is divergence between what the reconciliation system produces, what the monthly return states, and what the auditor subsequently finds. Guardexia is built to eliminate that divergence: daily reconciliation outputs feed the monthly return directly, breach registers and board MI are continuous, and the audit trail is the same dataset across all three. The compliance investment made under the Supplementary Regime does not need to be rebuilt for the Post-Repeal transition.
The firms that treat 7 May as a deadline will build for one audit cycle. The firms that treat it as the start of an eighteen-month FCA observation window will build for what comes next.
Nothing in this article constitutes legal or compliance advice. Firms should seek independent legal and regulatory counsel in connection with CASS 15 implementation and Post-Repeal Regime planning.
Sources: FCA Policy Statement PS25/12 (7 August 2025) · FCA Payments Regulatory Priorities (March 2026) · FCA 2025–2030 Strategy (March 2025) · FCA Consultation Paper CP24/20 (September 2024) · Osborne Clarke analysis of PS25/12 (August 2025) · Travers Smith analysis of PS25/12 (August 2025) · BCLP enhanced supervision analysis (February 2026) · Norton Rose Fulbright countdown analysis (March 2026) · FRC interim safeguarding auditor guidance (March 2026)