Hiring an FC for a Payments Firm: Safeguarding Skills

Safeguarding is the obligation that most distinguishes finance in an authorised payments or e-money firm from finance anywhere else, and it is the one most often under-tested when hiring. A Financial Controller who has never safeguarded relevant funds can produce immaculate management accounts while the firm carries a regulatory exposure nobody in the building fully understands. This guide is about the hiring question rather than the rules: what safeguarding experience actually looks like on a CV, how to test it properly at interview, where the common gaps are, and when adjacent experience is acceptable.

For the obligation itself, the FCA’s payment services and e-money pages are authoritative, and our guides to safeguarding for payments and e-money firms and e-money and payments regulation cover the framework. This page assumes that ground.

Why the finance role is different here

Three things change once a firm is authorised and holding relevant funds.

The daily reconciliation is a regulatory obligation, not a control preference. Safeguarded funds must be reconciled and any shortfall made good, and the discipline is closer to client money than to ordinary treasury. An FC who treats it as a month-end task has misunderstood the requirement.

The segregation method has to be understood, not just operated. Whether funds are safeguarded by segregation in a designated account or by an insurance or guarantee method changes what the FC must do daily, and firms sometimes use both across different products.

And the audit is different. Safeguarding audits examine the arrangement, the reconciliations, the evidence and the acknowledgement position — a set of questions a commercially-trained FC will not have encountered, and the FCA Handbook is the reference point rather than any accounting standard.

The practical consequence: safeguarding is not a bolt-on to a standard FC role. It changes the daily rhythm, the control framework and the risk profile of the seat.

What genuine experience looks like on a CV

Four markers, in rough order of usefulness.

Named regime and method. A CV that says “safeguarding under the PSRs, segregation method, daily reconciliation of relevant funds across three currencies” is describing ownership. One that says “experience of regulatory requirements including safeguarding” is describing proximity.

Reconciliation ownership. Look for who prepared it, who reviewed it, and at what frequency. Daily is the standard; anything less needs explaining.

Audit exposure. Having been the firm-side contact for a safeguarding audit is a strong signal, and the findings tell you more than the fact of it.

Scale and complexity markers. Number of safeguarded accounts, currencies, whether funds pass through a scheme or acquirer, and whether the firm operates an agent or distributor network — each adds real complexity and narrows the pool.

Qualification — ICAEW, ACCA or CIMA — is the baseline and tells you nothing about the regime. Two things that are not evidence: working at a fintech (many are not authorised, or are agents of a principal firm and therefore do not safeguard at all), and holding a qualification. Neither implies the experience.

Testing it at interview

Six questions. If you lack the expertise to assess the answers, involve your compliance lead in one stage — it is the most effective thing a non-specialist hiring manager can do.

1. Walk me through your safeguarding reconciliation, step by step. Sources, timing, what is compared to what, and where differences typically arise. Someone who has owned it describes the awkward parts — in-flight transactions, settlement timing, scheme funds — without prompting.

2. Which method does your firm use, and why? Segregation, insurance or guarantee. A candidate who does not know the method has not owned the obligation.

3. What counts as relevant funds in your business, and what does not? The scoping question, and where genuine understanding shows. Firms get this wrong at the edges — fees, own funds commingled in error, timing of when funds become relevant.

4. Tell me about a shortfall or a discrepancy. Anyone who has run this has had one. Strong answers describe identification, quantification, making good, and reporting — not a claim of a perfect record.

5. What did your safeguarding auditor raise, and what changed? Ownership of findings, and the same question that works throughout regulated finance.

6. If you joined us on Monday, what would you check first? Experienced candidates have a checklist: the acknowledgement letters, the account designation, the age and nature of reconciling items, whether own funds have ever been commingled. The answer reveals depth in about ninety seconds.

The common gaps

Fintech experience without authorisation. The most frequent mismatch. A candidate from a fintech operating as an agent of an authorised principal has never safeguarded anything, because the principal does. This is not on their CV as a caveat and it needs asking about directly.

Reviewed rather than owned. Common in larger firms where an operations team prepares the reconciliation and finance signs it. Perfectly good experience, but a different job from building and owning it in a smaller firm.

Client money conflated with safeguarding. A CASS 7 background is genuinely valuable and adjacent — the mindset transfers — but the regimes are not the same, and a candidate who uses the terms interchangeably has not worked in both. See our comparison of the client money regimes.

And crypto without the perimeter. Cryptoasset firms may or may not hold relevant funds depending on their permissions and structure; ask what was actually safeguarded rather than assuming.

When adjacent experience is acceptable

The pool is small, so pragmatism matters. Adjacent experience is usually the right hire where three things hold: the candidate has genuinely owned a daily reconciliation obligation in some regime — CASS, safeguarding elsewhere, or client money; they have been through a relevant audit; and there is existing expertise in the firm, internal or external, to support the first six months.

Where it is not acceptable: an authorised firm with no existing safeguarding expertise appointing someone without it as the sole finance resource. That places an unfamiliar regulatory obligation on an unsupported person, and it is the configuration in which breaches go unnoticed longest.

Specifying the role

Four things to state, and most specifications state none of them. Name the authorisation — API, EMI, small payment institution, or agent of a principal — because it determines whether safeguarding applies at all. Name the method. State what the role owns: preparing the reconciliation, reviewing it, owning the audit relationship, being the escalation point. And describe the operational shape — volumes, currencies, whether there is an operations team or whether finance does it all.

Doing so reaches a much smaller but far more relevant pool, and it filters out the fintech-but-not-authorised candidates before they reach interview. Our guides to building a finance function at a regulated firm and hiring for regulatory experience cover the wider specification question, and benchmarks are in the regulated-firm finance salary guide.