The law says how much client money must be in the bank.
It does not say how often to check.

Here is a position we hear often enough to be worth working through. An institution reconciles its client money every day, comparing what its ledger says it owes clients with what its own records say it holds. Separately, once a week, it compares those records with the balances the banks report. Asked whether that is compliant, the institution says yes, and adds that it looks at every account during the day anyway. Both halves of that answer are stronger than they first appear. Even so, they do not answer the question a liquidator would ask.

Start with what the rules say about frequency

Most people assume the safeguarding rules prescribe how often client money must be reconciled. As far as we can find, they do not. The Payment Services Law and the Central Bank's directive for electronic money institutions set the obligation this way: client money still held by the institution at the end of the business day after it was received must sit in a separate account at a bank, protected from the claims of other creditors, in particular if the institution fails. Both say when the money has to be in the account. Neither says how often the institution has to check. Licence conditions are a separate matter. Some Cyprus licences name the individuals who sign a daily reconciliation, and an institution should read its own before relying on any of this.

The Payment Services Law mentions reconciliation once, in a provision added in 2025 that asks an institution seeking access to a payment system to hold a description of its reconciliation procedure, and says nothing about how often it should run. The place frequency is addressed is the annex to the Central Bank's circular that set the scope of the independent safeguarding review. It asks the reviewer to sample client fund reconciliations for each bank, including ones that are not at a month end, and then to verify that the reconciliation methodology and frequency are consistent with the institution's approved policies and procedures, and that discrepancies are promptly identified, appropriately justified and resolved without undue delay. Read that carefully. The benchmark for frequency is the institution's own policy. If the policy says weekly and the institution reconciles weekly, then on the words of the annex it is consistent, and the reviewer has nothing to report on frequency. An institution arguing that weekly is compliant is, on the text, right, and that is where most discussions of this stop.

Nothing we have read makes the safeguarding condition a periodic test with a reporting date, a reference period or an average. On any given Tuesday, either the right amount of client money is sitting in the right accounts or it is not. So the useful question is what frequency the control needs in order to show that a condition which binds every day was actually met.

Watching the accounts is not the same as reconciling them

The second half of the institution's answer deserves to be taken seriously, because it is usually true. An institution watching its accounts during the day will see its payments land and its settlements arrive, and it will record those movements as they happen. There is, though, a specific category of entries that an internal ledger cannot generate, because the bank originates them rather than the institution: bank charges, interest debited or credited, a payment returned or rejected by the receiving bank, a settlement that was expected and did not arrive, a posting error at the bank, and at the far end fraud. None of these begins life as an instruction in the institution's system, so no amount of watching that system will surface them. They appear first, and sometimes only, on the bank's statement. The gap is narrower than "anything could happen and nobody would know", and it is exactly this: entries the institution did not originate are invisible until someone looks at the bank's own record of the account.

Watching the accounts confirms what the institution already knows about. Reconciling confirms what it does not.

Why the size of the amounts is not the point

In most institutions the recurring items in that category are modest relative to the balances held. Measured by what you expect to find, the exposure between one weekly comparison and the next looks immaterial, and in the ordinary course it is. A control, though, has to be sized for the worst thing it could miss. You compare your records against the bank's for the small chance of finding that a client account is short, and for the cost of not finding it for six more days. Direction matters too. A difference where the institution's system shows more than the bank holds is the one that counts, because the daily safeguarding calculation is usually struck on the system figure. A board should know how often that happens and for how long.

Two requirements in the circular that do bite

Two other requirements in the annex are measured against a standard of their own rather than against the policy, and both depend on how often the comparison with the banks runs. The first is in the same paragraph. Discrepancies must be promptly identified and resolved without undue delay, and promptness is a separate standard that is not measured against the policy. A weekly comparison means a discrepancy the bank originated cannot be identified inside seven days, whatever the policy says. The second sits in the governance part of the annex and is easy to miss. Client fund information must be kept so that it can be provided immediately on request, and its availability must be monitored. If the supervisor asks on a Thursday and the last figure verified against the banks is from the previous Friday, the institution can produce a number, but that number rests on six days of its own records.

What the regime is for

It helps to remember why any of this exists. The safeguarding rules protect client money against the claims of other creditors if the institution fails. In that situation, the figure that matters is the balance at the bank. A liquidator does not open the institution's core system and take its word for it. The number that decides whether clients are made whole is the one the bank confirms, so an institution that tests its internal figure every day and the bank's figure every week has its priorities in the wrong order.

What proportionality allows

The circular says the extent of the review is set by the nature, scale and complexity of each institution, and that smaller and less complex institutions are expected to keep proportionately simpler procedures. That is a real defence, and it cuts both ways. An institution with two client accounts at one bank, low volumes and simple flows can defend a weekly comparison without much difficulty. Its exposure to bank-originated items is thin, and a daily comparison would cost more than it would ever find. An institution running daily settlement across several banks in several currencies is in a different position, and not because of its size. Its exposure to the category of item only the bank knows about is continuous. The same weekly interval carries a very different risk in the two cases, which is what proportionality is meant to capture.

Three things worth doing

First, state the frequency in the policy and mean it. Since the circular measures frequency against the institution's own document, a policy that is silent, or that says something the operation does not do, gives the reviewer an inconsistency to report where there need not have been one. Second, set the comparison with the banks at the frequency the flows demand rather than the one inherited from when the institution was smaller. The test is whether the institution can show the safeguarding condition held on a given day using a figure it did not produce itself. Third, write down what the circular's "without undue delay" means for you: a time limit for investigating and resolving a discrepancy, and a rule that any shortfall in a safeguarding account is made good from own funds within a stated period. Most of the argument in this area is about frequency, and these two points get far less attention than they deserve.

Because, as far as we can find, the rules are silent on frequency, the choice sits with the institution, which then has to defend the choice it made, to an auditor, to the regulator and to a liquidator. Weekly may well be the right answer, provided the board has examined why. And whatever the answer is, it needs to be written down, because a frequency that exists in practice and not in the policy is the first thing the review will report.