2026 safeguarding compliance report: UK audits

28 safeguarding audits | 77 findings | UK payment and e-money institutions

Our second annual report, with year-on-year safeguarding insights.

Between July 2025 and June 2026, fscom finalised 28 safeguarding compliance audits across UK-authorised payment and e-money institutions. The findings show progress, alongside recurring issues in governance and monitoring:

Positive opinions rose from 15% to 43%, and average findings per audit fell from 3.72 to 2.75.
First-line governance accounted for 34 findings, 44% of the total.
Insufficiently granular risk registers and monitoring plans that were not proportionate to risk each affected 13 audits.

See how your arrangements compare across six review areas, with practical recommendations and context on the transition to CASS 15.

2026 findings data

A statistical overview of 77 findings across 28 safeguarding audits, including 12 high-impact, 33 medium-impact and 32 low-impact findings.

Year-on-year comparison

A comparison with the previous reporting period, showing changes in audit opinions, average findings and the proportion of high-impact issues.

First-line governance and oversight

Analysis of the largest area of findings, including the role of granular risk assessments in your safeguarding framework.

Compliance monitoring

Second-line findings and recommendations to help you align monitoring plans, control testing and sample sizes with safeguarding risk.

Protection of relevant funds

Findings on the identification and protection of relevant funds, with practical considerations for documentation and counterparty due diligence.

Reconciliations and client communications

Review-area insights to help you assess reconciliation processes and the information you provide to clients about safeguarding.

CASS 15 context

An explanation of the transition from legacy safeguarding provisions, with a forward look at daily reconciliations, monthly returns and audit changes.

Practical next steps

Recommendations to help you prioritise remediation, refresh safeguarding documentation and strengthen your compliance maturity.

What does the report cover?

You will find analysis across six safeguarding review areas: first, second and third-line governance and oversight; identification and protection of relevant funds; reconciliations; and client communications. The report combines statistical findings with practical recommendations to help you review controls and prioritise improvements.

Which audits informed the findings?

The report draws on 28 safeguarding compliance audits finalised by fscom between July 2025 and June 2026. The audit population comprises 14 UK-authorised payment institutions and 14 UK-authorised e-money institutions. You can compare the results by institution type and against the previous year's reporting period.

What has changed since the previous report?

Positive opinions increased from 15% to 43%, while average findings per audit fell from 3.72 to 2.75. High-impact findings represented 16% of the total, down from 30%. You can also examine recurring root causes, including insufficiently granular risk registers and monitoring plans that were not proportionate to risk.

Were these audits assessed against CASS 15?

Most audits were conducted wholly or substantially against the legacy EMRs, PSRs and FCA Approach Document. CASS 15 came into force on 7 May 2026, during the final weeks of the reporting period. Where relevant, the report explains how findings are expected to be affected by the transition.

How can I use the recommendations?

You can use the recommendations to inform your risk assessment, compliance monitoring and remediation planning. The report highlights priorities around daily reconciliation, safeguarding documentation and audit preparation. Review the findings against your own arrangements and seek specific advice where your institution's circumstances require a tailored assessment.

Can I discuss my findings with a safeguarding specialist?

Yes. You can contact fscom to discuss your safeguarding arrangements, audit priorities or support with addressing control gaps. Nicola Hanratty, Head of UK Audit, is the report's named contact. Email nicola.hanratty@fscom.co to discuss your institution's circumstances and the practical support you may need.

About the 2026 safeguarding compliance report

Our second annual safeguarding compliance report draws on 28 audits finalised between July 2025 and June 2026 across UK-authorised payment and e-money institutions. It examines findings across six review areas, compares results with the previous reporting period and sets out practical recommendations for improving your safeguarding arrangements.

At fscom Compliance Maturity Specialists™, we help you measure, master and maximise compliance maturity. We benchmark your arrangements against regulatory requirements and peer practice, then support practical improvements through audit, advisory and training.

This publication provides a general overview for informational purposes and is not comprehensive or definitive advice. Specific advice tailored to your circumstances should be sought from a qualified professional where necessary.

Benchmark your safeguarding framework with audit findings from UK payment and e-money institutions.

2026 safeguarding compliance report

Download the 2026 safeguarding compliance report