Guardexia › Blog › Regulatory analysis
SUP 16.14A and REP027: requirements, data and reconciliation
Guidance · April 2026 · 4 min read · Sources: FCA PS25/12, SUP 16.14, CASS 15, FCA RegData
A lot of energy goes into remediation plans and auditor appointments. The monthly SUP 16.14A safeguarding return is still easy to underweight — but it is the primary instrument the FCA uses for supervision. If the return is wrong, or cannot be tied to the same month’s reconciliation, you do not have a “forms” problem: you have a documented, dated gap the regulator can see without visiting your office.
Fields in scope that need data assembled from more than one system — or manually reconciled — before the return can be signed.
Tolerance for material inaccuracy in a return that the SMF is asked to stand behind. “Directionally right” is not a supervisory category.
Firms referenced in recent FCA Final Notices and supervisory outcomes where data, reconciliation, and reporting misalignment was a first-order finding. The pattern repeats.
What the return requires
The RegData template is the operational hard part: the same month can require ledger, bank, reconciliation stack, and product to agree before anything is “final.” The FCA is not testing whether you can write policy. It is testing whether you can make the month hang together in one return.
| Field (illustrative) | What it requires | Where the risk sits |
|---|---|---|
| Safeguarding requirement | Total relevant funds vs. amount safeguarded for the period (per your method). | Reconciliation error where sub-ledgers, FX, and cut-offs disagree. |
| Safeguarding method | Whether funds are segregated, insured / guaranteed, or otherwise held in line with your permission. | Audit trail failure if method in the return is not the method operationally in force. |
| Internal reconciliation | Date and outcome of the last internal reconciliation relevant to the month. | Audit trail discrepancy if the return month does not match sign-off and evidence pack. |
| Shortfalls | Any shortfalls identified in the period and how they were addressed. | Reconciliation failure (including failure to pick up a shortfall that existed). |
| Breach details | Action taken to identify, rectify, and close relevant breaches in period. | Audit trail discrepancy with breach / incident log and board visibility. |
| Unused credits (where applicable) | Any unused credit balances in in-scope client money or safeguarding accounts. | Audit trail discrepancy with operational handling and CASS 15 account mapping. |
| Account arrangements | Institutions, identifiers, and account architecture supporting safeguarding. | Audit trail failure (live banking vs. recorded arrangements). |
| Insurance / guarantee (where used) | Provider, policy number, in-force dates, and coverage line-up to the month. | Audit trail failure (policy lapsed, wrong entity, or wrong amount). |
| SMF confirmation | Name and sign-off of the Senior Manager attesting to the return. | Personal liability exposure if the record will not support the attestation under challenge. |
The cross-reference problem
The FCA cross-references the SUP 16.14A return against the same story told in: monthly reconciliations, the breach and shortfall record, the annual safeguarding audit (where in cycle), and management information. When those artefacts disagree, the mismatch is the opening move of a formal investigation — you have given the regulator two incompatible answers with the same date.
Case study (simplified pattern)
A small EMI was sanctioned where monthly MI in the return did not match the subsequent annual audit report. The issue was not a rounding difference; it was treated as a data and control-integrity failure — the kind of inconsistency supervisors read as a fundamental governance gap.
How it connects to existing obligations
The final return (SUP 16.14A) is not a standalone “extra” obligation. It is the summary output of the whole stack — the point where the month must be coherent across policy, operations, and evidence.
If the return is prepared without threading through the prior nodes, the firm is not “late on reporting.” It is reporting a month that was never true in one system.
The SMF attestation carries personal weight
Under the Senior Managers & Certification Regime (SMCR), the SMF signing the return is personally attesting to the accuracy and completeness of structured supervisory data — not to “best efforts.” A nominal, rather than substantive, line of ownership for safeguarding (where the SMF cannot explain how the return was built) is exactly how individual accountability becomes visible to the FCA in a data mismatch scenario.
Three questions to answer for each live monthly return
- Field mapping
Does your reconciliation system output map directly to the SUP 16.14A fields you must submit, without a lossy “translation layer” in a spreadsheet? - Shortfalls and breaches
Does your shortfall and breach register capture root cause and remediation dates in a way that the return can be reconciled in one pass? - The data cliff
Is there a cliff between the person preparing the data and the SMF signing it — i.e. a sign-off that is real, or only procedural?
Guardexia — automated & auditable
Guardexia generates SUP 16.14A-ready figures from the same engine that runs daily reconciliations — so the monthly return, the rec record, and the management trail are one story, with a documented audit path the SMF can stand behind (subject to your internal governance design).
The mismatch argument still matters under the live regime: if REP027 monthly safeguarding return software is fed from a different month than the CASS 15 reconciliation workflow, the firm has given the regulator two incompatible answers with the same date.
Next steps
Tighten the cross-reference path for each live monthly return. Confirm the applicable deadline in RegData and against your permissions.
This page is for general information. It is not legal, regulatory, or professional advice. Confirm all obligations, dates, and field requirements against the current FCA Handbook, RegData technical specifications, and your firm’s individual permissions.