CASS 15, the FCA's detailed safeguarding chapter for payment institutions (PIs) and electronic money institutions (EMIs), came into force on 7 May 2026 under Policy Statement PS25/12. Safeguarding means keeping customer money separate from the firm's own money so that it can be returned if the firm becomes insolvent. Since May, every firm in scope has been running daily reconciliations, filing a monthly return to the FCA and building towards its first safeguarding audit.
The question has therefore moved on. In the run-up to May it was whether a firm had a compliant policy, a reconciliation process and the right bank letters. Now it is whether those controls produce the right answer every reconciliation day, and whether the firm can prove it. This article sets out what a PI or EMI should be doing now, in the order the regime asks for it: daily, monthly, continuously and annually. For the full rulebook, see our CASS 15 explainer.
CASS 15 applies to authorised payment institutions that hold customer money, authorised EMIs, small EMIs, credit unions issuing e-money and any small payment institution that has opted in to safeguarding. Firms that provide only payment initiation or account information services hold no customer money and are outside it. The statutory duty to safeguard still comes from the Payment Services Regulations 2017 and the Electronic Money Regulations 2011; CASS 15 adds the detailed rules on how that duty is met and evidenced.
Before May, safeguarding rested on a few paragraphs of legislation and the FCA's guidance in its Approach Document. From 7 May 2026 it rests on detailed Handbook rules that an auditor tests and a supervisor reads every month. The table shows the shift for the main controls.
| Control | Before 7 May 2026 | Now |
|---|---|---|
| Reconciliation | Expected by guidance, frequency set by the firm | Internal and external, at least once each reconciliation day, with records |
| Reporting to the FCA | Safeguarding figures in periodic returns | Monthly REP027 within 15 business days of month end |
| Audit | Expected under FCA guidance, with no set report form or deadline | Annual audit for authorised firms above the £100,000 threshold |
| Resolution planning | No specific requirement | CASS 10A resolution pack, retrievable within 48 hours |
| Bank and custodian oversight | General expectations | Documented due diligence, periodic review and acknowledgement letters |
| Accountability | Not specified | A single director or senior manager under CASS 15.2.4R |
The FCA also made clear when the safeguarding duty begins: as soon as the firm receives the funds. That matters for payment chains, collection accounts, card acquiring, agents, distributors and firms using several banks, because money can become relevant funds earlier than a firm's ledger records it. Safeguarding has become a shared control across operations, finance, treasury, technology, compliance and senior management, not a finance reconciliation alone.
A firm that runs CASS 15 well treats it as a calendar of controls with named owners. The table sets out the core cycle.
| Task | When | Rule |
|---|---|---|
| Internal and external reconciliations, D+1 comparison, shortfall correction | Each reconciliation day | CASS 15.8 |
| Break and breach log updated; notification decision recorded | Each reconciliation day | CASS 15 |
| REP027 monthly safeguarding return filed through My FCA | Within 15 business days of month end | SUP 16.14A |
| Board or committee safeguarding management information | At least quarterly; monthly for larger firms | CASS 15.2 |
| Resolution pack updated after a material change | Within 5 business days of the change | CASS 10A |
| Acknowledgement letters reviewed | At least annually and on any change | CASS 15.7 |
| Third-party due diligence and diversification review | On appointment and periodically | CASS 15.6 |
| Report to the governing body on resolution pack compliance | At least annually | CASS 10A |
| Safeguarding audit report to the FCA | Within 6 months of the first period end, then 4 months | SUP 3A |
The board reporting frequency is the firm's own decision; the rule requires the responsible director or senior manager to report to the governing body. Quarterly is a sensible minimum for most firms, and monthly is appropriate where volumes are high or the reconciliation shows recurring breaks.
Internal and external safeguarding reconciliations must each run at least once on every reconciliation day. A reconciliation day is any day except a Saturday, a Sunday, a UK bank holiday or a day on which a relevant foreign market is closed. The internal reconciliation compares the amount the firm should be safeguarding, calculated from its own customer and transaction records, with what its books show as safeguarded. The external reconciliation compares the firm's records with those of its banks and custodians.
Each day the firm also compares its D+1 segregation requirement, the amount that should be in safeguarding accounts, with its D+1 segregation resource, the amount actually there. A shortfall must be paid in as soon as possible and in any case by the end of the day on which the reconciliation is performed, from the firm's own money if the relevant funds themselves are not available. An excess can be withdrawn. Every step is recorded with its time and date.
A reconciliation is only as reliable as the requirement it tests against. The calculation is hardest where volumes are high or the firm handles several currencies, refunds, chargebacks, unsettled card transactions, fees deducted at source, agents or several banks. Incomplete or misclassified transaction data can produce a reconciliation that balances but is wrong. The firm should be able to trace the requirement from customer records to the final figure and explain what is included, what is excluded and why.
Our guide to internal and external safeguarding reconciliations sets out the calculation and break process in detail.
Every safeguarding institution files the monthly safeguarding return, REP027, through My FCA within 15 business days of the end of each calendar month. It reports relevant funds held, the safeguarding method, the accounts and institutions used, whether every reconciliation was completed, any shortfalls and how they were corrected, and breaches. A firm does not file for the month in which it first becomes a safeguarding institution.
REP027 gives the FCA a monthly view of each firm's safeguarding position for the first time. Supervisors can compare firms with their peers, see unusual movements early and follow recurring issues from month to month. A firm should therefore treat the return as a control in its own right.
Our practical guide to the monthly safeguarding return takes each section of REP027 in turn.
A firm must carry out documented due diligence before it places relevant funds with a bank, custodian, insurer or guarantor, and review it periodically. The review covers the institution's financial standing, expertise, reputation and the concentration of the firm's money with it. The firm must also consider periodically whether to spread relevant funds across more than one institution.
Each safeguarding account must be designated as held for safeguarding relevant funds and used for nothing else. The bank or custodian must sign an acknowledgement letter confirming that it holds the money for safeguarding purposes and has no right of set-off, lien or counterclaim against it. Letters must be reviewed at least annually and whenever something they refer to changes, and kept for five years after the last related account closes.
Firms should treat their safeguarding banks as part of the regulatory control environment, not as ordinary suppliers. Opening a replacement safeguarding account takes time, so a firm with one bank should begin a second relationship before it needs it.
CASS 10A requires a resolution pack: the documents an administrator or liquidator needs to identify and return customer money quickly. Each document must be retrievable as soon as practicable and in any event within 48 hours of an insolvency appointment or a request from the FCA or the Bank of England. A material change must be reflected within five business days.
The useful test is practical. Could someone who has never worked at the firm find, within the 48-hour limit, where every pound is held, how the safeguarding requirement is calculated, who the contacts at each bank are and what is needed to return the money? The pack matters most for firms with several banks, agents, outsourced technology or a cross-border structure. Firms should run a retrieval test at least once a year and after any significant change. Our article on the CASS 10A resolution pack lists every required document.
Authorised PIs and authorised EMIs must have a qualified auditor report on their safeguarding each audit period, unless they have not been required to safeguard more than £100,000 of relevant funds at any time over at least 53 weeks. The first report is due within six months of the end of the audit period and later reports within four months. An audit period can end no more than 53 weeks after the previous one, and the firm can choose whether to align it with its financial year end.
| First audit period ends | First report due by |
|---|---|
| 31 December 2026 | 30 June 2027 |
| 31 March 2027 | 30 September 2027 |
| Subsequent periods | Four months after the period end |
The audit tests whether controls operated throughout the period, not only whether the money was there on one date. Auditors look at the reconciliation method, segregation, account documentation, acknowledgement letters, due diligence, records, breach handling, governance and the resolution pack, including IT general controls such as access to systems and data, backup and recovery and incident management. The Financial Reporting Council's interim guidance for safeguarding auditors, published on 17 March 2026, applies until a dedicated standard is issued, expected in 2027.
A readiness review two to three months before fieldwork gives the firm time to correct what it finds. A weakness that management identified and fixed is far easier to explain than one the auditor finds first. Our guide to FCA safeguarding audits under CASS 15 covers scoping, auditor selection and evidence.
A shortfall or breach is handled as a sequence of recorded steps. The firm that follows the same sequence every time can show the auditor and the FCA that it acted promptly and proportionately.
The FCA has not defined materiality for notifications, so each firm should set documented thresholds, approved by the board, and apply them consistently. A breach register that captures every step above is the single most useful document in the audit file.
CASS 15.2.4R requires a single director or senior manager with enough skill and authority to hold responsibility for operational compliance with the safeguarding rules and to report on it to the board. Payment institutions and EMIs are not under the Senior Managers and Certification Regime, so this is a CASS 15 allocation. Safeguarding should not sit with compliance alone; in most firms the responsible person is the finance director or chief operating officer, with compliance providing independent challenge.
| Management information | Why it matters |
|---|---|
| Reconciliations completed and any missed days | Shows the core control ran every reconciliation day |
| Breaks by value, age and root cause | Separates one-off timing items from structural issues |
| Shortfalls and how they were corrected | Evidences prompt correction and use of own funds |
| Breaches and FCA notifications | Confirms notification decisions were made and recorded |
| Concentration by safeguarding bank | Supports the diversification decision |
| Manual adjustments and workarounds | Shows reliance on people rather than systems |
| Audit findings and overdue remediation | Tracks correction to closure |
A strong framework separates three roles: the people who run the daily process, the people who review and challenge it, and the senior manager who is accountable for fixing what they find. Repeated operational fixes that never reach the board, or are never analysed for cause, point to weak governance even where the procedures look complete.
For a firm that implemented CASS 15 before 7 May 2026, the next step is an assurance phase: testing that controls work as designed, rather than rewriting policies. The table sets out where to look and what good evidence looks like.
| Area | Test | Evidence of a sound control |
|---|---|---|
| Reconciliation | Trace a sample of days from transaction data to the requirement, balances and adjustments | Each step recorded, timed and reviewed |
| Relevant funds | Check the treatment of fees, FX, refunds and unsettled items against the policy | Same treatment in the policy and the calculation |
| REP027 | Rebuild a recent return from daily records | Figures agree without manual bridging |
| Banks | Match every account to its letter and due diligence file | Letters current; reviews dated |
| Resolution pack | Ask someone outside the team to retrieve each document | All retrieved well inside 48 hours |
| Breaches | Review the breach log against notification decisions | Every decision recorded with reasons |
| People | Run the process with the usual preparer absent | Trained cover completes it on time |
New products, currencies, banks, agents and system changes are the most common source of new safeguarding gaps. Each change should go through a safeguarding impact check before launch: does it create new relevant funds, a new flow, a new account or a new reconciliation point? Building that check into the firm's change process keeps the framework current without a periodic rebuild.
Applicants for authorised payment institution or EMI status now need to show the FCA a CASS 15 framework at the point of submission: the safeguarding method, the relevant funds analysis, the reconciliation process, the bank arrangements, the person responsible under CASS 15.2.4R, and the approach to REP027, the resolution pack and the audit. The firm plans EMI and PI authorisations at six to eight months after submission, and a complete safeguarding section is one of the elements that keeps an application on that timetable.
The firm's free safeguarding readiness checker gives a quick view of where an existing or planned framework stands against CASS 15.
Safeguarding is now far more visible to the FCA than before May. Daily reconciliations create a record of every day's position, REP027 gives the FCA monthly data, and the audit adds independent assurance. The resolution pack and third-party controls test whether customers would be protected in an insolvency. Taken together, these mean that weaknesses surface sooner than they did.
For a well-run firm that is an advantage: stronger customer protection, more confident banking partners and a clear basis for growth. The FCA has said it will review the Supplementary Regime over a full audit period before deciding whether to consult on the further Post-Repeal Regime, so the firms that operate CASS 15 cleanly now are also best placed for whatever follows.
CASS 15 is the FCA Handbook chapter with detailed safeguarding rules for payment and e-money institutions. It came into force on 7 May 2026 under PS25/12 and supplements the Payment Services Regulations 2017 and Electronic Money Regulations 2011.
Internal and external reconciliations must each run at least once on every reconciliation day. Reconciliation days exclude weekends, UK bank holidays and days when a relevant foreign market is closed.
REP027 is the FCA's monthly safeguarding return under SUP 16.14A. It is filed through My FCA within 15 business days of each calendar month end and covers relevant funds, reconciliations, shortfalls, accounts and breaches.
The first auditor's report is due within six months of the end of the firm's first audit period. Later reports are due within four months, and each period can run for no more than 53 weeks.
It is the set of documents required by CASS 10A that an insolvency practitioner needs to identify and return customer money. Each document must be retrievable within 48 hours and the pack kept current at all times.
CASS 15.2.4R requires a single director or senior manager of sufficient skill and authority to hold responsibility for operational compliance and report on it to the governing body.
Run an operational review that tests real reconciliations, the safeguarding calculation, bank letters, REP027, breach handling and the resolution pack, rather than another policy review. Correct what it finds before the auditor's fieldwork begins.
Buckingham Capital Consulting has obtained FCA authorisations for payment and e-money firms including Nexpay, Orbital and Dzing Finance since 2013, and supports them through the daily, monthly and annual controls CASS 15 requires. Its safeguarding work covers operational reviews, REP027 reporting, resolution pack testing and preparation for the first safeguarding audit.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.