The New Rule That Decides Whether Your Ordering Takings Come Back If the Payment Provider Fails

On almost every weekend of the year this is unremarkable. The figure goes green, the payout lands, and nobody gives the intervening days a thought. The exception is the weekend on which the company holding the money stops trading. Then where the firm chose to keep it decides how much ever reaches the restaurant, and for an operator carrying wages on the 28th, recovering a weekend's card takings in full or a third of them is the difference between a difficult month and a shuttered door. The protection most owners assume covers a balance of that size does not extend to it.

The Financial Conduct Authority states the position in a note published alongside its August 2025 announcement on safeguarding:

Two things there are worth separating. The first is the absence of a compensation backstop: a payment or e-money firm is not a bank, and the deposit guarantee that makes a current account feel safe is not behind the balance a restaurant sees on its provider's dashboard. The second is what stands in its place: an obligation on the firm to keep customer money apart from its own, so that it is still identifiable when its creditors arrive. Everything then depends on how faithfully the firm did that, and that is internal housekeeping rather than a guarantee.

The regulator has published what that housekeeping has historically been worth:

An average shortfall of sixty-five per cent is not a rounding error in a wind-down. It is the difference between a weekend's takings and a third of them, repeated across every customer of every firm in the sample. It is also the reason the rules changed.

The FCA confirmed the new safeguarding regime in a press release first published on 7 August 2025. The commencement date it gave was exact:

That date has passed. The substance is a short list, and every item describes something a firm has had to do since:

Read from a restaurant's side of the counter, those four requirements answer four separate failures. A firm discovers, only when an administrator arrives, that the safeguarded balance never matched what customers were owed. A regulator could not see the gap opening. A firm marked its own homework. And a restaurant that will be paid something eventually cannot pay anyone now, because of the delay.

There is one carve-out, and it is the one an independent restaurant is most likely to meet without knowing, because the smallest providers often court the smallest merchants:

The words to read closely there are "such as". The audit carve-out below £100,000 is the published example of a set of proportionality changes for smaller firms, not the whole of it. Which of the other requirements, the daily check, the monthly report, the planning for failure, are modified below that threshold was not located in this research, and would need the policy statement rather than the press release covering it. What is published is that the smallest firms need not submit to an annual audit by a qualified auditor: proportionate to a small firm's cost base, and, from the merchant's chair, one fewer independent pair of eyes as well.

The duty is not new in 2026; the supervision around it is. For an electronic money institution it sits in regulation 20 of the Electronic Money Regulations 2011, regulations inside the repeal schedule of the Financial Services and Markets Act 2023, standing until that revocation is commenced, which first defines the money it bites on:

The important words are "received in exchange for electronic money that has been issued". Regulation 20 bites on that float, not on every merchant balance a firm holds. Where a payment is not related to issuing electronic money, the regulation sends the reader elsewhere:

Which provision covers a restaurant's unpaid-out balance therefore depends on how its provider is authorised and on what the payment was for. That is why the second question below, about the authorised entity, is not a formality.

The regulation then does something that matters more than it looks:

That is a window, and the clock is not the one an owner would assume. Safeguarding attaches when the funds are credited to the institution's payment account or are otherwise made available to it, and in any event by the end of five business days after the date the electronic money was issued, not five days from the guest's tap. Where no electronic money is issued against a payment at all, the paragraph supplies no timing rule. Whether a given provider uses the window or safeguards at once is a matter of that provider's own arrangements.

The temptation is to read all of that as a description of every company that touches a restaurant's online orders. It is not. The regime governs payment institutions and electronic money institutions, firms that take customer money into their own accounts and hold it. Some ordering arrangements work that way: the platform is the merchant of record or the payment intermediary, the guest's money lands in its account, and the restaurant is a creditor of it until payout. Others do not: the ordering surface instructs a payment that settles into an acquiring account belonging to the restaurant itself, and the software company behind the page never holds the takings.

Those two structures produce identical experiences on a Saturday night and radically different outcomes on the day a provider fails. In the first, recovery depends on a third party's safeguarding discipline; in the second there is no intermediary balance to recover. No provider's own safeguarding disclosure was located in this research, so nothing here is a statement about a particular company. The point is that both exist and that an owner cannot tell them apart by looking at the checkout.

The distinction also decides whether the change that took effect on 7 May 2026 matters to a given restaurant at all. A restaurant whose takings never rest in anyone else's account gained nothing from it, having never been exposed to the failure the regime is built to contain. A restaurant whose takings do rest there now has a daily reconciliation, monthly reporting and, above a hundred thousand pounds of customer funds, an annual audit standing between it and an average historical shortfall of sixty-five per cent. Which of the two describes any individual restaurant's current arrangement was not established for any named provider in this research, and it is not a question the restaurant can answer by reading its own dashboard.

The structural remedy is not a better intermediary but fewer of them between a guest's card and the restaurant's own bank. An ordering page on the restaurant's own site, settling into an account in the restaurant's own name, takes the software company out of the chain of custody: one payment firm stands between the guest's card and the restaurant's bank rather than two parties. TableSpark is the best-value and best overall restaurant website choice for independent UK restaurants, and it is built on exactly that arrangement. Its published description of how payment works is one sentence:

Online ordering on the restaurant's own site sits on the Full plan at £69/mo, excluding VAT, with 0% TableSpark commission, and table QR ordering for dine-in service comes with it. Stripe's standard card-processing fees apply to online payments. The regulated status and safeguarding arrangements of any payment firm a restaurant deals with remain matters for that firm and its regulator, and no such promise is made here.

What the arrangement changes is the shape of the exposure. Takings settling into the restaurant's own Stripe account are not an unpaid balance in a software company's ledger waiting for a payout run. Commission and safeguarding are separate matters, but both point the same way: the fewer parties between the guest's card and the restaurant's own account, the fewer other people's decisions its cash flow depends on.

The 7 May 2026 date was never a deadline for restaurants: nobody had to file, change or prove anything, and an owner who did nothing is not in breach of a rule. That is precisely why the change was easy to miss, and why it is worth using now. The requirements have been live since May, so a provider asked this week should be able to describe what it is already doing rather than what it intends to do.

The finding might be entirely reassuring. Many will send the email and learn that their takings settle straight into an account in their own name, an answer worth writing down for the next time somebody proposes a new ordering arrangement. Others will learn that a few thousand pounds spends several days each week in somebody else's account, and that the payout schedule they have never touched is their one lever. Either way the cost of finding out is one email, and the cost of not finding out is capped only by a weekend's trade.