The Commingled Pot: Sanctions Risk in Britain's E-Money Safeguarding Accounts

Britain's e-money institutions and payment firms are often described as the plumbing of modern finance: wallets, prepaid cards, merchant acquiring, remittance rails and embedded payments. Less discussed is the account at the end of that plumbing — the safeguarding account where customer funds are pooled. For sanctions compliance, that account is not a vault. It is a commingling point, and the quality of the ledger behind it matters as much as the ring-fence around it.

A pool, not a vault

Under the Electronic Money Regulations 2011 and the Payment Services Regulations 2017, relevant funds must be safeguarded. Firms typically segregate customer money in a account with a credit institution, or use an insurance policy or guarantee. The purpose is prudential: if the firm fails, customers should get their money back. The safeguarding account is therefore designed around shortfall risk, not financial-crime risk.

That distinction is easy to lose. A bank holding a pooled safeguarding account sees one corporate customer and one aggregate balance. It does not necessarily see the thousands of individual wallet holders behind that balance. The e-money firm is the party that must know who owns each slice. If its internal ledger is weak, or its reconciliation is aggregate rather than customer-level, the bank's view and the firm's obligations diverge.

Where the ledger ends and the risk begins

Sanctions risk in e-money does not stop at onboarding. A customer screened in 2022 may be designated in 2026. A corporate wallet holder may change beneficial ownership without telling the firm. A payment may be routed through an agent or distributor whose own customer base is only lightly overseen. The firm's obligation is not merely to check names at sign-up; it is to maintain a defensible position on who holds the money now.

Pooled accounts complicate that position. If a designated person holds an e-money balance, the firm must identify and freeze the economic resource, report to OFSI, and prevent dealing. But in an omnibus account, the freeze happens in the firm's ledger first. If the ledger cannot isolate the customer's share quickly — or if the firm has been reconciling only the total — the practical effect can be a delayed freeze, an inaccurate report, or a shortfall that only becomes visible when the bank account and the customer records are compared.

High-risk money can sit in several familiar patterns. A wallet may be opened with thin identity evidence and used as a pass-through for funds from a higher-risk jurisdiction. A corporate account may front for an owner who would fail screening if named. An agent network may onboard customers the principal firm rarely reviews. None of these requires the safeguarding account itself to be badly run; they require only that the sub-ledger beneath it is incomplete.

The audit problem

The FCA's safeguarding reforms, consulted on in 2023, have pushed firms towards stronger reconciliation and records. In 2026, the direction of travel is clear: supervisors want firms to demonstrate that they can identify relevant funds, reconcile them against the safeguarding account, and produce records on demand. But safeguarding audits often remain focused on prudential shortfall risk. Sanctions testing is frequently a separate exercise, run by a separate team, against a separate data set.

That separation is the gap. A firm may be able to show that its safeguarding account covers customer liabilities in aggregate while being unable to show, line by line, that no designated person sits inside the pool. It may reconcile daily at portfolio level but struggle to produce a customer-level breakdown within the hours OFSI expects. It may screen new customers but not re-screen the existing book when designations change. It may monitor payments at the bank but not at the wallet.

What 2026 should demand

Compliance teams should start with the sub-ledger. Can the firm map every customer balance in the safeguarding pool to an identified customer, with beneficial ownership records and sanctions screening results attached? Can it do so for agents and distributors? Can it reconcile that sub-ledger to the bank account at customer level, not just in total?

Second, sanctions screening should be event-driven as well as periodic. Designations change; ownership changes; adverse media emerges. Firms should be able to re-screen the existing book against updated lists and explain how alerts are cleared, escalated and documented.

Third, transaction monitoring should fit e-money. Rapid in-and-out flows, multiple wallets controlled by one person, cross-border remittance corridors and crypto on-ramps are not ordinary retail banking patterns. Rules tuned to high-street accounts will miss them.

Fourth, governance should be explicit. Board reports should cover safeguarding reconciliation exceptions and sanctions alerts together, not in separate silos. Internal audit should test whether a designated person's funds could be identified and frozen within a stated timeframe. Outsourced providers and programme managers should be held to the same standard.

The supervisor's question

The question for the FCA is no longer simply whether customer money is safeguarded. It is whether the firm can prove whose money it is, and that none of it belongs to a designated person. Safeguarding protects against insolvency. Sanctions controls protect against financial crime. Britain's e-money sector needs both ledgers to agree — and in 2026, firms that cannot show that agreement should expect closer scrutiny.