CASS 15: How new FCA rules have changed safeguarding obligations for EMIs and PSD firms

What are the new safeguarding requirements under CASS 15?

1.    Annual CASS audits by qualified auditors

A CASS audit is an independent review of how your firm holds, safeguards and reports client money and assets.

Historically, e-money and payment firms haven’t needed to undergo CASS audit reports – or any audit reports – with the FCA. But under CASS 15, audit reports and a Breaches Schedule will be reportable to the FCA at least on an annual basis.

These annual audits are required to ensure that:

• Your books and records correctly reflect and substantiate the clients for whom cash is held and reconciles to the cash held in a client account
• You have robust systems and controls in place to operate the cash as well as safeguard those funds throughout the period

The Policy Statement confirms that the audits are to be completed by qualified, regulated auditors to ensure consistent audit quality.

Firms who do not meet the threshold of safeguarding £100,000 of relevant funds within a period of at least 53 weeks are exempt from the audit requirement, but are recommended to receive a voluntary audit to ensure they meet their obligations.

2.    Daily checks to ensure right amount of money is being safeguarded

One of the key updates is that the rules now state that payment firms must conduct safeguarding reconciliations daily.

Reconciliations will be due every reconciliation day rather than business day, which is intended to ease the burden on firms. However, this does not prevent payment firms from deciding to perform a reconciliation on a business day that isn’t a reconciliation day due to the nature, volume and/or complexity of their business.

Reconciliations are intended to check the accuracy of a firm’s books and records. The FCA has therefore replaced the existing deposit resource and requirement with a higher-level comparison.

The new comparison considers relevant funds that should be held in relevant funds bank accounts, or as relevant assets in relevant assets accounts (the “D+1 segregation requirement”) against the balances of those accounts (the “D+1 segregation resource”). If the D+1 segregation resource is lower than the D+1 segregation requirement, the firm will need to remedy the shortfall.

Payment firms must document how they will meet their obligations to their clients under the safeguarding report. A firm’s policies and procedures should set out how they plan to ensure that the external safeguarding reconciliations will achieve their purpose. As such, the FCA has implemented the requirement to maintain resolution packs, with an amendment to clarify the requirement relating to client contracts. Resolution packs should include:

• Where the relevant funds are held
• A list of the firm’s agent and distributors
• The firm’s procedures for the management, recording and transfer of relevant funds and assets

Resolution packs will help ensure payment firms maintain, and can easily retrieve, information that would help achieve a timely return of relevant funds to consumers.

In order to assist firms and achieve the most efficient model, most effective resolution packs tend to be “living documents” that link directly to the latest versions of the relevant records.

3.    Monthly reporting

Under the new rules, firms will need to report to the FCA on a monthly basis regarding relevant funds safeguarded by the firm.

The reporting of regular information facilitates a targeted, proactive approach to the regulator’s supervision and assessment of risks across the portfolio. This follows the pattern of proactive monitoring taken by the FCA throughout the first half of 2025.

The FCA’s rationale for this approach includes:

• Identifying firms that use a non-standard method of reconciliation
• Determining which assets are held with custodians

The monthly return has been amended to reflect the new, higher-level comparison of the relevant funds that should be held in relevant accounts with the introduction of the D+1 segregation requirement.

Although throughout the new rules there have been thresholds implemented to avoid increasing scrutiny on smaller payment firms, this has not been applied to the monthly reporting requirements.

4.    Planning for firm failures

As detailed above, the D+1 requirement and resource are being implemented to monitor whether firms have adequate safeguarding resources. If not, the firm is expected to remedy the shortfall. The firm should have organisational arrangements in place to ensure it does not settle such payments using funds it’s required to segregate.

Within the policies and procedures, the FCA expects to see evidence of this planning, such as an instruction to return the funds to the customer in an orderly manner. In the event of failure, the firm is expected to have funds safeguarded in a range of approved, secure, liquid assets that can be easily accessible for consumers requiring reimbursement post-failure.