CASS 15 is the chapter of the FCA Handbook that sets out how payment institutions and e-money institutions must protect customer money. Safeguarding means keeping the money customers hand over for a payment, or in exchange for e-money, separate from the firm's own money, so that it can be returned to those customers if the firm becomes insolvent. CASS 15 turns that long-standing legal duty into detailed, testable rules on records, reconciliation, reporting, audit and resolution planning.
The FCA published the final rules in Policy Statement PS25/12 on 7 August 2025, after consulting in CP24/20 in September 2024. The FCA extended the implementation period from six to nine months, and the rules came into force on 7 May 2026. Every firm in scope is now operating under them: the daily reconciliations, the monthly return and the annual audit are live obligations, not future ones.
The FCA calls the current rules the Supplementary Regime because they supplement, rather than replace, the safeguarding provisions in the Payment Services Regulations 2017 (regulation 23) and the Electronic Money Regulations 2011 (regulations 20 to 22). A firm must comply with both: the regulations still set the core duty, and the Handbook rules set out how the FCA expects that duty to be met and evidenced. The FCA's Approach Document, chapter 10, was amended at the same time and explains how the combined framework fits together.
The rules are spread across four parts of the Handbook. Reading CASS 15 alone gives an incomplete picture, so the table below maps each obligation to its source.
| Handbook reference | What it covers |
|---|---|
| CASS 15 | Organisational requirements, the segregation and insurance methods, third-party selection, acknowledgement letters, records and reconciliations |
| CASS 10A | The resolution pack: the documents an insolvency practitioner needs to return customer money |
| SUP 3A | The annual safeguarding audit and the auditor's report to the FCA |
| SUP 16.14A | The monthly safeguarding return (REP027) |
The FCA's case rests on what happened when payment and e-money firms became insolvent. PS25/12 records that firms which entered insolvency between the first quarter of 2018 and the second quarter of 2023 had an average shortfall of 65% in the funds owed to their customers. Customers waited a long time for what was returned, and insolvency practitioners spent much of that time reconstructing records that should already have existed.
The sector holds a large and growing amount of customer money. E-money safeguarded funds rose to about £26 billion in 2024, from £11 billion in 2021, and payment institutions safeguarded about £6 billion on a typical day in 2024. The share of consumers using a payments firm for a payment account rose from 1% in 2017 to 12% in 2024. These customers have no Financial Services Compensation Scheme cover, so safeguarding is the only protection they have.
The FCA concluded that broad, principle-based duties in the regulations had produced uneven practice in record keeping, reconciliation, the treatment of relevant funds and oversight. Its answer was detailed rules that an auditor can test and a supervisor can apply consistently, moving payments safeguarding towards the standard that investment firms have operated under CASS 6 and CASS 7 for many years.
CASS 15 applies to every firm that the FCA calls a safeguarding institution. In practice that means any firm that receives customer money for payment or e-money services and is required, or has chosen, to safeguard it.
| Firm type | Position under CASS 15 |
|---|---|
| Authorised payment institution (API) | In scope, unless it provides only payment initiation or account information services and never holds customer money |
| Authorised e-money institution (EMI) | In scope, for both its e-money and any unrelated payment services |
| Small e-money institution | In scope |
| Credit union issuing e-money | In scope |
| Small payment institution (SPI) | Not required to safeguard; in scope if it opts in to safeguarding |
| Bank or building society | Outside CASS 15; customer deposits are covered by deposit protection instead |
Many SPIs choose to safeguard because it makes their banking partners more comfortable and prepares them for full authorisation. An SPI that opts in takes on the full regime, including the monthly return, and must tell the FCA when it starts or stops safeguarding. SPIs and small EMIs also state in their annual returns whether they safeguard.
Group structures and mixed business models need a documented scope decision. An EMI that also offers payment services unrelated to e-money must treat the two as separate pools of money. A firm that holds both payments and investment permissions applies CASS 15 to its payments and e-money business and CASS 7 to its investment business, with separate records and reconciliations. Where the boundary is unclear, for example funds held through agents or distributors, the firm should write down where it has drawn the line and why, because the auditor and the FCA will ask.
The money a firm must protect is called relevant funds. There are three categories: sums received in exchange for e-money issued; sums received from, or for the benefit of, a payment service user to carry out a payment transaction; and sums received from another payment service provider to carry out a payment transaction. The definition is short, but applying it to a real business model takes careful judgement.
Each of these decisions belongs in the written safeguarding policy, and the daily reconciliation must apply exactly the same treatment. A difference between what the policy says and what the reconciliation does is one of the first things an auditor tests.
The regulations allow three methods, and a firm can combine them as long as it can show that every pound of relevant funds is covered by one method or another at all times.
Most firms segregate. Relevant funds still held at the end of the business day after the day of receipt must be placed in a separate account with an authorised credit institution or the Bank of England. The account must be designated as held for safeguarding relevant funds and used only for that purpose. The bank must sign an acknowledgement letter confirming that it holds the money for safeguarding purposes and has no right of set-off or counterclaim against it. Banks treat the opening of a safeguarding account as a separate onboarding decision, so it belongs early in any authorisation plan.
A firm can instead invest relevant funds in secure, liquid assets approved for the purpose and hold them in a designated account with an authorised custodian. The assets must remain accessible if many customers redeem at once or the firm becomes insolvent, and the custodian also signs an acknowledgement letter.
A firm can cover relevant funds with an insurance policy from an insurer, or a guarantee from a credit institution, outside its own group, paying out to customers if the firm becomes insolvent. The policy may contain no condition other than certification of the insolvency event. The firm must notify the FCA at least two months before it first relies on this method, changes the amount of cover or changes its insurer or guarantor. It must decide at least three months before the policy expires whether it will renew, and if it will not, show how it will move to segregation in time.
The operating rules in CASS 15 turn the duty to safeguard into a set of daily, monthly and annual controls. The table summarises them; the sections below explain each in plain terms.
| Requirement | Frequency | Source |
|---|---|---|
| Internal and external safeguarding reconciliations | At least once each reconciliation day | CASS 15.8 |
| D+1 segregation comparison and correction of any shortfall | Each reconciliation day | CASS 15.8 |
| Monthly safeguarding return (REP027) | Within 15 business days of each month end | SUP 16.14A |
| Resolution pack kept current | Continuously; retrievable within 48 hours | CASS 10A |
| Acknowledgement letters reviewed | At least annually and on any change | CASS 15.7 |
| Third-party due diligence and diversification review | On appointment and periodically | CASS 15.6 |
| Annual safeguarding audit | Each audit period of up to 53 weeks | SUP 3A |
| Notifications to the FCA | Without delay when a trigger occurs | CASS 15 |
A reconciliation day is any day other than a Saturday, a Sunday, a UK bank holiday or a day on which a relevant foreign market is closed. CP24/20 had proposed reconciling on every business day; the final rules moved to reconciliation days because firms working across several currencies cannot always obtain third-party data when an overseas market is shut. A firm should fix its calendar in advance, record which foreign markets it treats as relevant and why, and reconcile more often where the volume or complexity of its business calls for it.
The internal reconciliation checks the firm's own records: that the amount it should be safeguarding, calculated from its customer ledgers, matches what its books show as safeguarded. It must use the firm's internal records, not bank statements. Its purpose is to test the accuracy of records the firm already keeps; a firm that only works out what each customer is owed by running the reconciliation has not met the rule.
The external reconciliation compares the firm's internal records with the records of the banks and custodians that hold the money and assets. Both reconciliations are required each reconciliation day. Supervisors and auditors look closely at firms whose internal process is daily and rigorous but whose external check is a periodic look at a bank statement.
The final rules replaced the deposit test proposed in CP24/20 with a simpler comparison. The D+1 segregation requirement is the amount of relevant funds that should be held in safeguarding accounts, or as relevant assets, on the day; the D+1 refers to the regulatory deadline of the end of the business day after receipt. The D+1 segregation resource is the balance actually held. If the resource is lower, the firm must pay in the shortfall as soon as possible and in any case by the end of the day on which the reconciliation is performed (CASS 15.8.51R), using its own money where the relevant funds themselves are not available. If the resource is higher, the excess can be withdrawn. The calculation, the result and any action must all be recorded, with the time and date.
Funds received for e-money must be safeguarded separately from funds received for payment services unrelated to e-money, and each pool is reconciled and reported separately. For an EMI with a payments business this changes the design of the reconciliation, not just its presentation.
Where the standard internal reconciliation does not fit a business model, a firm can use a different method. It must first document how that method meets its obligations, and an independent auditor must review it and confirm in a written report that it does.
Records made under CASS 15 must be kept for five years from the later of the date they were created or last modified. For each reconciliation the record must show when it was carried out, what was found and what was done.
Our detailed guide to internal and external safeguarding reconciliations works through the calculation, break handling and evidence step by step.
Every bank or custodian holding relevant funds or assets must sign an acknowledgement letter in the form the FCA sets. It confirms that the account holds money for safeguarding purposes, that the institution has no right of set-off, lien or counterclaim against it, and that the account will not be combined with any other account. Letters obtained in the form set out in the Approach Document before 7 May 2026 can continue to be relied on, but every letter must be reviewed at least annually and whenever something it refers to changes. Each countersigned letter is kept for five years after the last related account closes.
A firm must carry out and document due diligence when it appoints a bank, custodian, insurer or guarantor, and review it periodically. The FCA leaves the frequency to the firm, depending on the type of firm and third party. The firm must also consider periodically whether it should spread relevant funds across more than one institution to reduce concentration. Many larger firms use two or more safeguarding banks, which also helps with multi-currency flows.
A firm must tell the FCA in writing and without delay if its internal records of relevant funds are materially out of date, inaccurate or invalid; if it cannot carry out an internal or external reconciliation; if it cannot correct a reconciliation discrepancy; or if at any point in the preceding 12 months the amount it safeguarded differed materially from the amount it should have safeguarded. The FCA has not defined materiality, so the firm should set and document its own thresholds. A breach register recording each event, its cause, value, correction and notification supports both the audit and any supervisory enquiry.
Every safeguarding institution submits a monthly safeguarding return, form REP027, through My FCA within 15 business days of the end of each calendar month. It reports the relevant funds held, split between e-money and unrelated payment services where both apply, the safeguarding requirement and resource, whether every reconciliation was completed, any shortfalls and how they were corrected, the accounts, institutions and assets used, the safeguarding method and any breaches. A firm does not file for the month in which it first becomes a safeguarding institution. Our practical guide to the monthly safeguarding return takes each section of REP027 in turn.
Authorised payment institutions and authorised EMIs must have a qualified auditor report on their safeguarding each audit period, and the report goes to the FCA. A firm that has not been required to safeguard more than £100,000 of relevant funds at any time over a period of at least 53 weeks is exempt; senior management must keep that position under review and document it. An audit period can run for no more than 53 weeks after the end of the previous one, and the firm can choose whether to align it with its financial year end. The first report is due within six months of the end of the audit period, and later reports within four months.
The Financial Reporting Council published interim guidance for safeguarding auditors on 17 March 2026, which applies until a dedicated safeguarding assurance standard is finalised, expected in 2027. Auditors are testing whether the firm's records correctly identify the customers it holds money for, whether those records reconcile to the money actually held, and whether systems and controls, including IT general controls such as access to systems and data, backup and recovery and incident management, worked throughout the period. Our guide to FCA safeguarding audits under CASS 15 covers scoping, auditor selection and evidence.
CASS 10A requires a resolution pack: the set of documents an administrator or liquidator would need to identify and return customer money quickly. Each document must be retrievable as soon as practicable and in any event within 48 hours of an insolvency appointment or a request from the FCA or the Bank of England. The pack must exist and be current at all times; a material change must be reflected within five business days, and the governing body receives a report on compliance at least annually. Our article on what the CASS 10A resolution pack must contain lists every required document.
CASS 15.2.4R requires a firm to give a single director or senior manager, with enough skill and authority, responsibility for operational compliance with the safeguarding rules and for reporting on it to the board. Payment institutions and EMIs are not under the Senior Managers and Certification Regime, so this is a CASS 15 allocation rather than a senior manager function. In most firms the role sits with the finance director or chief operating officer, with the compliance officer providing independent challenge.
The FCA expects the role to carry real oversight: direct access to the reconciliation position, sight of every break and breach, and the authority to require correction. The board should approve the safeguarding policy, the choice of auditor and any change of safeguarding institution or method, and receive regular management information covering the monthly return figures, breaks, breaches and audit findings. A firm should be able to show how that oversight works in practice, not only who holds the title.
The firm's safeguarding and client assets practice designs these governance arrangements alongside the policy and reconciliation framework.
PS25/12 changed several proposals from CP24/20 after industry feedback. Firms still working from consultation-stage material should check their procedures against the final position.
| Topic | CP24/20 proposal | Final rule |
|---|---|---|
| Reconciliation frequency | Every business day | Each reconciliation day, excluding days a relevant foreign market is closed |
| Reconciliation test | Detailed deposit requirement and resource | Higher-level D+1 segregation comparison |
| First audit deadline | Four months after the period end | Six months for the first report, then four months |
| Implementation period | Six months | Nine months, to 7 May 2026 |
| Statutory trust | Proposed for a later stage | Post-Repeal Regime not taken forward without further consultation |
Five months into the regime, the firms that operate CASS 15 smoothly share three habits. They treat evidence as the deliverable, they run every output from one record, and they remove dependence on any single person.
A correct reconciliation is not enough on its own. Each reconciliation, comparison, break, correction and approval needs a record of what happened, who did it and when, created as the control runs. The audit tests whether controls operated throughout the period, and records rebuilt afterwards do not show that.
The monthly return, board reporting, resolution pack and audit evidence should all come from the same signed daily record. When they are compiled separately from different spreadsheets they drift apart, and auditors and supervisors see the differences.
If the reconciliation, the return and the audit evidence all depend on one person's workbook, that person's absence becomes a compliance event. Documented procedures, trained cover and system-based controls address this.
Safeheld, the firm's own safeguarding platform, runs the daily reconciliations, the D+1 comparison, break management, the REP027 return and the resolution pack from a single record. More detail is on the Safeheld page.
Firms applying to become an authorised payment institution or EMI now need to show the FCA a safeguarding framework built for CASS 15 at the point of submission. The application should set out the safeguarding method, the relevant funds analysis, the reconciliation process and tooling, the bank or custodian arrangements, the person responsible under CASS 15.2.4R, the approach to the monthly return and resolution pack, and the audit plan.
A safeguarding section written to this standard shortens the FCA's questions during assessment. Building the framework into operations from the start also costs less than retrofitting it after authorisation, when the firm is already filing returns and preparing for its first audit.
PS25/12 described a second stage, the Post-Repeal Regime, under which the safeguarding provisions of the PSRs and EMRs would be repealed and replaced by a full CASS-style regime with relevant funds held on statutory trust, as client money is for investment firms. The FCA has said it will not implement those proposals without further consideration and consultation, and that it will first review how the Supplementary Regime works over a full audit period.
The practical position is that CASS 15 is the framework for the foreseeable future. A firm that designs its controls for the trust-based end state, with clean daily records and a well-documented relevant funds analysis, will need little change if the FCA proceeds. The EU is reforming safeguarding separately through PSD3 and the Payment Services Regulation, so a UK group with an EU subsidiary should set one consistent group standard that meets both.
CASS 15 came into force on 7 May 2026. The FCA published the final rules in PS25/12 on 7 August 2025 and allowed a nine-month implementation period.
No. CASS 15 sits alongside regulation 23 of the Payment Services Regulations 2017 and regulations 20 to 22 of the Electronic Money Regulations 2011, and firms must comply with both.
PS25/12 is the policy statement that explains the final rules and the FCA's response to consultation. CASS 15 is the Handbook chapter containing the rules, with related requirements in CASS 10A, SUP 3A and SUP 16.14A.
Only if they opt in to safeguarding. An SPI that safeguards becomes subject to the regime, including the monthly REP027 return, and must notify the FCA when it starts or stops.
Internal and external reconciliations must each run at least once on every reconciliation day. Reconciliation days exclude weekends, UK bank holidays and days when a relevant foreign market is closed.
A firm that has not been required to safeguard more than £100,000 of relevant funds at any time over a period of at least 53 weeks is exempt. Senior management must keep the exemption under review and document it.
The requirement is the amount that should be held in safeguarding accounts or as relevant assets. The resource is the balance actually held; a lower resource is a shortfall to correct and a higher one is an excess that may be withdrawn.
No. A statutory trust was part of the proposed Post-Repeal Regime, which the FCA will not implement without further consideration and consultation.
Buckingham Capital Consulting has obtained FCA e-money authorisations for firms including Dzing Finance, Hryze and HFS since 2013, and designs the safeguarding policy, reconciliation framework and resolution pack that CASS 15 requires. Its safeguarding practice supports authorised payment institutions and EMIs through the monthly REP027 return, auditor appointment and the annual safeguarding audit.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.