If you’re responsible for corporate cash flows, bank-grade security for client funds is not just a technical detail – it’s board-level risk. High FX spreads, rising fraud, and the occasional insolvency of a payments provider have all made one question urgent: how safe are the balances you hold with banks, fintechs, and FX partners?
At the same time, regulators are tightening expectations around client fund safeguarding and operational resilience, especially for payment and e-money firms.(FCA) For CFOs, treasurers, and finance leads, it’s no longer enough to assume “the bank will sort it out” if something goes wrong. You need to understand how your providers protect client funds, where the limits are, and what “bank-grade” really means in 2025.
This guide breaks that down in plain language, with a practical checklist you can use to benchmark your current providers – and to evaluate specialist FX and payment partners such as Kazzius Capital.
Table of Contents
What “bank-grade security” really means today
The phrase “bank-grade security” gets thrown around constantly in marketing copy. In practice, it should mean two things working together:
- Protection of client funds themselves
- Where are they held?
- Are they mixed with the firm’s own assets?
- What happens if the provider fails?
- Protection of the systems and data controlling those funds
- Cybersecurity, access controls, and monitoring.
- Governance, audit trails, and incident response.
Regulators now expect payment and e-money firms to operate a CASS-style safeguarding regime that mirrors many of the protections historically seen in securities and banking.(FCA Handbook) The UK’s Financial Conduct Authority (FCA), for example, is moving towards clearer rules requiring firms to:
- Keep client funds in segregated accounts with approved institutions.(FCA Handbook)
- Perform frequent reconciliations to ensure the safeguarded balance matches client liabilities.(FCA Handbook)
- Have robust wind-down and exit plans so client funds can be returned quickly if the firm fails.(FCA)
Real “bank-grade security for client funds” is not just about strong tech. It’s about a full framework of legal, operational, and technical controls working together.
The threat landscape: why this matters for CFOs and treasurers
Even the most conservative treasury teams are facing a very different risk environment today:
- Financial service firms experience far more cyberattacks than other sectors – some studies suggest up to 300x more attempts per year.(knowbe4.com)
- Banks and financial institutions still take months on average to detect and contain breaches.(The Hacker News)
- Large incidents – from ransomware at outsourcers to operational near-misses inside major banks – show how a single failure in controls can affect millions of customers.(The Times)
For example, Reuters reported on a major global bank that accidentally credited a customer with around $81 trillion instead of a small payment, before reversing the error. The incident was contained, but it exposed control weaknesses and drew further regulatory scrutiny:
(According to reporting from Reuters: https://www.reuters.com/business/finance/citigroup-mistakenly-credits-customer-account-with-81-trillion-near-miss-ft-2025-02-28/). (Reuters)
In parallel, scam activity keeps climbing, especially fraud that tricks customers into sharing one-time passcodes or authorising transfers themselves.(The Guardian)
The Financial Times regularly highlights how regulators are stepping up their focus on cyber-resilience and potential fines for institutions that fail to protect client data and assets:
(See the FT’s cyber security coverage: https://www.ft.com/cyber-security). (Financial Times)
Put simply:
- Attack volume is higher.
- Threats are more sophisticated.
- Regulators are less tolerant of weak controls.
If you’re moving large FX flows, funding overseas payroll, or collecting global receipts, you need to be sure your providers’ controls are robust enough for this environment, not last decade’s.
How banks vs payment providers protect client funds
A common assumption is: “If it’s with a bank, it’s safe. If it’s with a fintech, it’s risky.” The reality is more nuanced.
FSCS protection vs safeguarding
In the UK, retail deposits held with banks and building societies may be protected by the Financial Services Compensation Scheme (FSCS) up to a certain limit per person, per institution.
For payment institutions and e-money firms, client balances are generally not covered by FSCS in the same way. Instead, these firms must follow strict safeguarding rules:
- Client funds must be segregated from the firm’s own assets as soon as practicable and placed in designated client accounts, or
- Covered by an appropriate insurance or guarantee, depending on the model.(FCA)
The FCA has been clear: safeguarding is a key focus area and rules are being strengthened to make them closer to the CASS regime used for investment firms.(PwC)
For a corporate treasurer, the takeaway is:
- FSCS is mainly about smaller retail balances.
- Safeguarding is about making sure your larger, operational balances sit in clearly protected accounts, separate from the provider’s own funds.
Both can be robust. The difference is in how protection works and what evidence you can see.
What segregated client accounts actually do
“Segregated” is another word that can become marketing fluff, so it’s worth being precise.
Under client asset rules like the FCA’s CASS 7.13, firms must:
- Deposit client funds in a separate, labelled account at an approved bank or central bank.
- Keep that account distinct from their own operational accounts.
- Reconcile records so that client balances match what is held in those accounts.(FCA Handbook)
The idea is simple:
If the firm fails, client funds should not be available to its creditors and should instead be returned to clients as a priority.(sunandoroy.org)
This is the backbone of client fund safeguarding. When combined with strong governance, regular reconciliations, and credible banking partners, segregated accounts are one of the most powerful tools for protecting your balances.
The core pillars of bank-grade security for client funds
Let’s break down what you should expect from any provider that claims to offer bank-grade security for client funds.
Safeguarding and segregated accounts
At minimum, you should expect:
- Properly titled safeguarding accounts:
- Account names clearly indicate “client” or “safeguarding” status, not just operational labels.(Addleshaw Goddard)
- No commingling:
- The provider’s own working capital is not mixed with client funds.(client.money)
- Regular reconciliations:
- Daily (or better) reconciliations comparing client liabilities with safeguarded balances.
- Documented safeguarding policies:
- Policies and procedures that are reviewed, tested, and updated as rules change.
These requirements are not optional; they’re wrapped into evolving FCA safeguarding rules and similar regimes globally.(LawNow)
Counterparty selection and diversification
It’s not enough to segregate client funds – you also need to ask where they are held. Strong providers will:
- Maintain client funds with regulated, well-capitalised banks.
- Apply counterparty limits so exposure is spread across multiple institutions, where appropriate.(ARQ)
- Periodically review those banks for credit quality and risk indicators.
When you’re assessing a FX or payments partner, ask:
- Which banks hold client funds?
- How do you monitor those institutions?
- Do you use any e-money or payment firms as safeguarding agents, and if so, how do you manage that risk?(PKF Logo)
Cybersecurity and access control
Even perfect segregation is compromised if attackers can control accounts and initiate transfers. Modern payment institution security needs to look a lot like a tier-one bank’s control environment:
- Encryption in transit and at rest for sensitive data.(XE)
- Multi-factor authentication (MFA) for staff and clients accessing dashboards or APIs.
- Least-privilege access control, so staff only see and do what’s necessary for their role.
- Real-time monitoring of unusual login locations, device fingerprints, or transaction patterns.(picussecurity.com)
- Regular penetration tests and vulnerability scanning.
As attackers get more creative – often using social engineering and AI-generated content – these controls become critical. Regulators and security researchers alike highlight how lack of MFA and weak internal controls continue to enable breaches.(ScienceDirect)
Governance, audits and regulation
Bank-grade security is ultimately about culture and oversight:
- A clear risk and compliance function with authority, not a box-ticking role.
- Documented policies for safeguarding, information security, vendor management, and incident handling.
- Regular internal and external audits on both financial and operational controls.
- Transparent regulatory status (for example, whether the firm is authorised and supervised for payment services in its home jurisdiction).
Look for evidence that senior leadership spends real time on these topics. Regulators repeatedly criticise firms where safeguarding is treated as an afterthought rather than a core part of the business model.(PwC)
Operational resilience and incident response
Even the best-run firms can face issues – system outages, third-party incidents, or fraud attempts that slip through net controls. What matters then is how they respond:
- Documented incident response plans with clear roles and escalation paths.
- Ability to switch to backup providers or infrastructure if a primary system fails.(XE)
- Regular testing through table-top exercises and simulations.
- Clear communication plans for clients, regulators, and partners.
From your perspective as a corporate client, the key question is:
“If this provider had an outage or breach, how quickly would we be told, and how quickly would we regain access or receive our balances back?”
Checklist: is your provider truly bank-grade?
Use this practical checklist to review your current banks, FX partners, and payment providers.
1. Governance and transparency
- Do they clearly explain where and how client funds are safeguarded?
- Can they provide policy documents or high-level summaries of their safeguarding and security frameworks?
- Is their regulatory status easy to verify with official registers?
2. Segregation and safeguarding
- Are client funds held in dedicated, clearly labelled safeguarding accounts?
- Do they avoid mixing operational funds with client balances?
- How often do they reconcile those balances, and can they describe the process in simple terms?
3. Counterparty and concentration risk
- Which banks or institutions hold segregated funds?
- Is exposure concentrated in one institution, or diversified where appropriate?
- How do they monitor credit risk and regulatory developments affecting those banks?
4. Cybersecurity controls
- Is MFA mandatory for client access and internal admin functions?
- Do they talk about encryption, intrusion detection, and regular testing in more than just buzzwords?
- Have they ever had a material breach or incident, and how did they handle it?
5. Operational resilience
- Do they maintain documented business continuity and disaster recovery plans?
- Can they operate from secondary locations or cloud infrastructure if needed?
- How will they communicate with you during an incident, especially out of hours?
6. Client experience and support
- Do you have access to genuine human support when something urgent happens, or just chatbots and email forms?
- Are support teams trained to recognise and escalate potential fraud?
If your current provider struggles to answer these questions in a clear, confident way, it’s time to reassess whether their client fund safeguarding really meets the standard your board expects.
Why a specialist FX and payments partner can feel safer than a traditional bank
At first glance, a large universal bank looks like the safest possible choice. In many ways, it is a strong anchor in your funding stack. But for cross-border flows and FX exposure, a specialist provider can actually enhance your security posture:
- Focused business model
- Specialist FX and payments firms focus on moving and safeguarding client funds, not on lending, trading, and dozens of other activities.
- That focus can translate into tighter operational controls around the services you actually use.
- Modern technology stack
- Many newer providers operate on cloud-native, API-driven platforms with built-in observability and real-time monitoring.
- That can make it easier to detect unusual activity quickly and respond before it becomes a serious incident.(picussecurity.com)
- Enhanced visibility
- Specialist dashboards often give you real-time visibility over balances and flows, making reconciliation easier on your side too.
- Strong reporting and alerting helps finance teams spot errors or suspicious behaviour early.
- End-to-end risk management
- The best FX partners help you align security, liquidity, and currency risk management.
- That might include tools for hedging exposures or using forward contracts to stabilise key rates, integrated with secure payment workflows.
When you combine a strong primary banking relationship with a well-governed FX and payments specialist, you can often achieve:
- Better pricing on FX and cross-border transfers.
- Stronger operational controls specifically tuned to international flows.
- More flexible tooling that grows with your business.
To explore how a specialist can complement your existing banks, you can learn more about Kazzius Capital’s FX and payment solutions here:
👉 Explore the Kazzius Capital platform
How Kazzius Capital approaches client fund protection
Kazzius Capital is built around three core principles: client focus, security, and efficiency. While specifics will always evolve with regulation and scale, the guiding approach to bank-grade security for client funds typically includes:
1. Institutional-style safeguarding
Kazzius Capital’s model is designed around segregated client accounts with reputable banking partners, ensuring:
- Client funds are held separately from operational balances.
- Clear account titling that reflects safeguarding status.
- Ongoing reconciliation and monitoring to keep safeguarded balances aligned with client liabilities.
This approach takes the spirit of established CASS-style protections and applies it to FX and payment flows in a way that is practical for fast-moving corporate treasuries.(FCA Handbook)
2. Security by design
From onboarding through to settlement, a modern FX provider should treat security and compliance as design constraints, not afterthoughts. In practice, that means:
- Strong KYC and onboarding checks to keep bad actors out of the ecosystem.
- Role-based access control across internal systems and client portals.
- Use of industry-standard encryption, network segmentation, and monitoring to reduce attack surface.(Thales Cyber Security)
For clients, the result is a platform that feels straightforward to use, but with a control framework aligned to the expectations of global regulators and institutional partners.
3. Human support for real-world incidents
Kazzius Capital’s brand is intentionally built around “genuine human support”. That matters when:
- You need to verify a suspicious instruction.
- Your team has received a convincing email or call that might be a scam.
- You’re executing a large, time-sensitive FX trade for a transaction like an acquisition or overseas investment.
Having direct access to knowledgeable support – not just generic call centres – can be the difference between a near-miss and a serious loss.
4. Integrated risk and efficiency
Security is not just a cost. Done well, it actually supports efficiency:
- Better visibility over balances reduces manual reconciliation work.
- Clear workflows and approvals reduce errors on high-value transfers.
- Integrated tools for hedging and forward contracts can help stabilise FX exposures without adding operational risk.
If you’re reviewing how your organisation handles FX exposure and cross-border flows, it’s worth looking at how secure operating models and risk tools fit together:
👉 Read more on FX risk tools such as hedging here: https://kazziuscapital.com/hedging/
Practical next steps for your business
Here’s how to turn this into action in the next quarter.
1. Map your providers and balances
List every institution where you hold:
- Operational balances in multiple currencies.
- Funds waiting to be paid out (e.g. overseas payroll, supplier runs).
- Receivables collected from overseas clients.
For each, note:
- Regulatory status (bank, payment institution, e-money, etc.).
- Location and legal entity.
- Typical peak balance in that relationship.
2. Request safeguarding and security summaries
For any non-bank provider, ask for:
- A safeguarding statement that explains how client funds are segregated and where they’re held.
- A security overview covering encryption, access control, fraud detection, and incident handling.
Well-run firms will already have client-friendly summaries and will welcome the conversation. If a provider can’t supply basic information, treat that as a warning sign.
3. Run the checklist with your risk and treasury teams
Bring together treasury, finance, and risk / compliance and step through the bank-grade security checklist in this article. For each provider:
- Mark controls as Strong, Adequate, or Needs work.
- Capture specific questions to take back to the provider.
- Prioritise where exposure is highest.
4. Consider re-balancing exposure
Once you’ve seen where the gaps are, you might decide to:
- Reduce balances held with providers that have weaker controls or opaque structures.
- Increase usage of specialist platforms that offer clearer safeguards and better visibility.
- Re-design payment flows so high-value transfers go through tightly controlled channels.
Kazzius Capital can help you think through how to route international flows in a way that balances cost, speed, and control:
👉 Talk to a Kazzius Capital specialist about your setup
5. Align FX risk management with security
Finally, bring your currency risk strategy and your security framework together:
- If you’re using forward contracts or hedging programmes, ensure they’re executed and settled through channels that meet your highest security standards.
- Make sure limits, approvals, and payment workflows are consistent across banks and FX partners.
For ongoing thought leadership on FX risk, payment trends, and safeguarding, you can follow:
👉 Kazzius Capital news and insights
Final thoughts: make security a standing agenda item
In 2025, bank-grade security for client funds is about far more than a logo or a marketing slogan. It’s about:
- Knowing exactly where your balances sit at any point in time.
- Understanding how those balances are protected in law and in practice.
- Ensuring your providers’ cybersecurity, governance, and resilience are strong enough for the threat environment they operate in.
Traditional banks will continue to play a central role. But combining them with a well-governed specialist FX and payments partner can strengthen your overall position: better pricing, better tooling, and security that is genuinely tuned to global flows.
The important part is not to leave any of this to assumptions. Treat client fund protection as a standing board-level item, review it regularly, and make sure your providers are genuinely operating at the standard you expect.
If you’d like an outside perspective on how your current FX and payment setup compares, the team at Kazzius Capital is ready to help you review it in detail and suggest practical improvements – in language your board will understand.