If you move other people's money, the most consequential design decision is not your payment rail. It is where the cash legally sits while it is in your care, and whose books are the source of truth for who owns what. Get that wrong and a customer's balance can vanish into a gap between two ledgers that nobody is forced to reconcile. The Synapse failure made that abstract risk concrete for more than 100,000 people.
This is the safeguarding layer. It sits beneath the license question and license rental from the earlier modules, and it is where regulatory theory turns into account structures, contracts, and a daily numbers check.
The core idea: customer money is not your money
When you hold funds that belong to your customers, those funds should never be commingled with your operating cash and should never be reachable by your own creditors. The mechanism differs by jurisdiction, but the goal is the same: if your company fails, customer balances are ring-fenced and returned, not swept into the bankruptcy estate.
In the US, the dominant pattern is the FBO account, short for "for benefit of." In the UK and EU, the equivalent discipline is statutory safeguarding under the e-money and payments regimes. Both answer the same question. Whose money is this, and where does it live?
What an FBO account actually is
An FBO account is a single account opened at an FDIC-insured bank, owned and controlled by the bank, that pools funds belonging to many end customers. The fintech does not own the account. It manages a sub-ledger that tracks each customer's share of the pooled balance.
So you get a one-to-many structure. The bank sees one large account at the aggregate level. The fintech (or its program manager) keeps the detailed records of who owns which slice. Funds at rest are in the bank's custody; the fintech's job is to know, at all times, exactly how that pool divides.
Pass-through insurance, and what it does not cover
The reason this structure matters for the end customer is pass-through deposit insurance. FDIC coverage of up to $250,000 per depositor can "pass through" the FBO account to each underlying beneficial owner, as if they held the account directly, but only if specific conditions hold.
Two conditions do the work. The funds must be legally owned by the end customer, not the intermediary. And the records, whether kept by the bank or a third party, must clearly identify each owner and their balance.
Here is the part teams miss. Pass-through insurance covers a bank failure. It does nothing for a records failure. If the bank is solvent but the sub-ledger is wrong, or two ledgers disagree about who is owed what, there is no shortfall for the FDIC to cover and no automatic mechanism to make customers whole. That is precisely the gap Synapse fell into.
A worked example
Picture a neobank, Northstar, running an FBO account at a partner bank with $80 million pooled across 40,000 customers. Northstar's program manager keeps the ledger of individual balances.
Now the program manager and the bank stop agreeing on the totals. The bank's record of the pool says $80 million. The sub-ledger says customers are collectively owed $83 million. Where did the $3 million difference come from, and who eats it? Nobody can answer, because the two systems were never reconciled to the cent each day.
This is not hypothetical. When Synapse collapsed in April 2024, the bankruptcy trustee estimated a shortfall between roughly $65 million and $95 million between fintech ledgers and bank-held funds, and tens of millions in customer deposits could not be cleanly accounted for across partner banks including Evolve. Customers were frozen out for months. The Consumer Financial Protection Bureau later alleged Synapse failed to keep adequate records of where consumer funds were and failed to ensure those records matched the banks' records.
Reconciliation is the actual control
The account structure is necessary but not sufficient. The control that decides whether customers get their money back is daily reconciliation between the internal sub-ledger and the bank's record of the pool, with any shortfall fixed immediately.
US regulators moved directly at this gap. In September 2024 the FDIC proposed a rule on custodial deposit accounts with transactional features that would require banks (or a third party with the bank's unrestricted access) to maintain beneficial-owner records and reconcile them against the account no less than daily, with an annual compliance certification. As of early 2025 that rule remained a proposal rather than final law, but the direction is set: daily reconciliation is becoming a hard requirement, not a best practice.
The UK reached the same conclusion through its own route. The FCA's safeguarding reforms, applying from 7 May 2026, impose a D+1 segregation check: at the end of each reconciliation day a firm compares the relevant funds that should be safeguarded against what is actually held, rectifies any shortfall immediately, and withdraws any excess. UK firms must also keep a resolution pack retrievable within 48 hours so an insolvency practitioner can return funds fast.
What the rules want you to be able to prove
Strip away the jurisdictional detail and three requirements recur. The safeguarding or FBO account is in the institution's own name and holds nothing but customer money. You can produce, on demand, the exact split of the pool by beneficial owner. And you reconcile your ledger to the bank's at least daily, closing any gap the same day.
If you cannot do all three today, that is the work, regardless of which regulator you answer to.
The takeaway
Safeguarding is not a compliance checkbox you bolt on before launch. It is an operating discipline you run every business day. The FBO account or safeguarding account tells the world the money is not yours; pass-through insurance protects customers against a bank failure; but only relentless daily reconciliation protects them against the failure that actually tends to happen, which is two ledgers quietly drifting apart until someone goes looking and the money is gone. Build the reconciliation first, then the rest of the structure is worth something.