FCA Safeguarding Rules in 2026: CASS 15 Guide for EMIs and Payment Institutions

What changed on 7 May 2026

In August 2025 the FCA published Policy Statement PS25/12, its final rules on safeguarding for payments and e-money firms following consultation CP24/20. The rules came into force on 7 May 2026, after a 9-month implementation period. They add four pieces to the FCA Handbook: a new CASS 15 chapter for day-to-day safeguarding, CASS 10A for the resolution pack, SUP 16.14A for a monthly safeguarding return and SUP 3A for an annual safeguarding audit.

The FCA's reasons are in the numbers it published. E-money institutions safeguarded about GBP 26 billion of customer funds in 2024, up from GBP 11 billion in 2021, and payment institutions around GBP 6 billion on any given day. For firms that became insolvent between 2018 and mid-2023, the average shortfall in funds owed to clients was 65%.

Funds received through agents and e-money distributors are still the principal firm's relevant funds. The new rules make that visible: the resolution pack has to list every agent and distributor, and every institution appointed to receive or hold relevant funds, including through an agent or distributor.

Interim rules now, statutory trust later (maybe)

CP24/20 proposed two stages. The Supplementary Regime sits on top of the existing safeguarding provisions in the EMRs and PSRs. The Post-Repeal Regime would replace them with a CASS-style regime in which relevant funds are held on a statutory trust for customers and received directly into designated safeguarding accounts.

PS25/12 only finalised the first stage. The FCA received a lot of pushback on the statutory trust and on receiving funds directly into a safeguarding account, and said it will not implement those proposals without further consideration and consultation. It plans to review the Supplementary Regime once a full audit period has passed, and the timing of any end-state regime depends on how HM Treasury approaches revoking the PSRs and EMRs. As of October 2026, there is no statutory trust over relevant funds under the FCA rules. If an adviser or vendor tells you otherwise, ask for the rule reference.

Daily reconciliation: what CASS 15 actually requires

CASS 15 requires a firm to keep records that let it distinguish relevant funds from other funds at any time and without delay, and to check those records with two kinds of reconciliation on every reconciliation day. Reconciliation days exclude weekends, bank holidays and days when relevant foreign markets are closed. The FCA changed this from "business day" after consultation feedback, but nothing stops you reconciling more often.

• Internal safeguarding reconciliation. Compares the safeguarding resource (what you hold) with the safeguarding requirement (what you owe customers), using your own records as at a fixed reconciliation point. The standard method also compares the funds that should sit in safeguarding accounts or relevant assets (the "D+1 segregation requirement") with the balances of those accounts (the "D+1 segregation resource").
• External safeguarding reconciliation. Compares your internal records with those of the banks holding your safeguarding accounts, any other account holding relevant funds, and custodians or managers of relevant assets.
• Allocation. Each receipt of relevant funds must be allocated to an individual client promptly, and no later than the end of the business day after receipt. Until then it sits in your books as "unallocated relevant funds".
• Separate pools. EMIs and credit unions that also provide unrelated payment services must reconcile the e-money pool and the payment services pool separately.

When an internal reconciliation shows a shortfall, the firm must find the reason and pay the difference into a safeguarding account (or invest it in relevant assets) as soon as possible and in any case by the end of the day the reconciliation is performed. If relevant funds cannot be used, for example because a third party is late releasing them, the firm must top up from its own funds. An excess must be withdrawn. Discrepancies found in an external reconciliation must be investigated and resolved without undue delay, unless they are pure timing differences, and if the records disagree the firm must assume the higher requirement is right until the matter is resolved.

Firms can use a non-standard internal reconciliation method, but only after documenting how it meets their obligations and getting an independent auditor's written report confirming it. The frequency rule applies either way. Records made under CASS 15 must generally be kept for 5 years.

The FCA must be told in writing without delay if records are materially out of date or inaccurate, if the firm cannot (or materially fails to) carry out a reconciliation or fix a shortfall or excess, or if it finds that in the previous 12 months it safeguarded a materially different amount from what it should have.

The monthly safeguarding return

Under SUP 16.14A, every safeguarding institution must submit a safeguarding return within 15 business days of the end of each calendar month, electronically through the FCA's systems. There is no lighter version for small firms. The FCA removed the old safeguarding questions from the existing API, SPI, EMI and small EMI returns to avoid duplication.

The published template asks, among other things, for:

• Whether the firm is subject to the annual audit or exempt, and whether it uses a non-standard reconciliation method.
• The number of clients for whom funds are safeguarded, and the highest and lowest safeguarding requirement in the month.
• Details of accounts used under the segregation method, relevant assets and their custodians, and any insurance policy or guarantee.
• The safeguarding resource and requirement from the last internal reconciliation of the month, with their components, any excess or shortfall and the adjustments made.
• The D+1 segregation resource and requirement and any shortfall.
• Confirmation that internal and external reconciliations were carried out on every reconciliation day.
• Record-keeping questions and any notifiable CASS breaches.
• A separate set of answers for unrelated payment services where the firm is an EMI or credit union.

If your reconciliation output is stored day by day with its components, the return is mostly a query. If reconciliations live in spreadsheets, month-end becomes a reconstruction exercise.

The annual safeguarding audit

SUP 3A requires authorised payment institutions (other than pure payment initiation or account information providers) and e-money institutions, including small EMIs, to appoint an auditor to report on their safeguarding compliance every year. The report covers both the segregation and the insurance or guarantee method.

• Exemption. A firm that has not been required to safeguard more than GBP 100,000 of relevant funds at any time over at least 53 weeks is exempt. Senior management must keep checking whether the exemption still applies and appoint an auditor once it does not.
• Who is not caught. Small payment institutions and credit unions are not required to arrange the audit. The FCA notes that a voluntary audit can help them show adequate arrangements.
• Auditor. The audit must be done by a qualified auditor. The firm must take reasonable steps to make sure the auditor has the skill, resources and experience for the job. It does not have to be the statutory auditor, though it can be.
• Deadline. The first report under the new rules is due within 6 months of the end of the audit period. Later reports are due within 4 months. A period must not end more than 53 weeks after the previous one, and firms can choose whether to align it with their financial year end.
• Standard. The FRC published interim, non-mandatory guidance for safeguarding auditors on 17 March 2026 and expects to issue a dedicated safeguarding assurance standard after consultation in 2027.

Where an audit period straddles 7 May 2026, auditors assess the firm against whichever rules were in force at the time.

The CASS 10A resolution pack

The resolution pack is a set of documents that lets an insolvency practitioner, the Bank of England or the FCA find and return customer funds quickly if the firm fails. CASS 10A requires that each document can be retrieved as soon as practicable and in any event within 48 hours of an administrator's appointment, or of an FCA or Bank of England request. Some items, such as the list of banks, acknowledgement letters and insurance policies, should be retrievable immediately. The pack must be maintained continuously: the retrieval window is not the time to start writing it.

The FCA points out that the best packs it has seen under CASS 10 are "living documents" that link to the latest version of each record. Much of the content overlaps with your wind-down plan, so keep the two consistent: the wind-down plan explains how you would exit in an orderly way, and the resolution pack is what an administrator needs on day one if that plan fails.

Safeguarding accounts, banks, assets and insurance

• Acknowledgement letters. For each safeguarding bank account and each relevant assets account, the firm must send the bank or custodian an acknowledgement letter based on the FCA template in CASS 15 Annex 1 and ask for it to be countersigned. Fixed text must not be changed. Countersigned letters are kept for 5 years after the last account they cover is closed. Letters obtained before 7 May 2026 in the Approach Document form can still be relied on, subject to the review and replacement rules.
• Choosing and diversifying third parties. Firms must use due skill, care and diligence when appointing banks, custodians, asset managers and insurers, review them periodically and consider whether to diversify. There is no fixed number of banks. The firm has to make the assessment and act on it.
• Naming. Where relevant funds are held outside a designated safeguarding account, the firm should consider how to keep them clearly identifiable, using "safeguarding" in the account name where possible.
• Secure, liquid assets. Relevant funds can still be invested in the same range of secure, liquid assets as before, held with an authorised custodian. The FCA has signalled a low appetite for widening that range.
• Insurance or guarantee. The policy must pay out with no condition other than certification of an insolvency event. The FCA must be notified at least 2 months before a firm first uses this method or changes cover or provider. No later than 3 months before expiry, the firm must decide whether to continue, tell the FCA, and if no renewal is in place, submit a plan to move to segregation.

Governance and operational resilience

CASS 15 requires a firm to give a single director or senior manager of sufficient skill and authority responsibility for overseeing operational compliance with the safeguarding rules and for reporting on it to the board. That person is named in the resolution pack. In practice this is the person who signs off the monthly return process, receives exception reports from daily reconciliations and owns the relationship with the safeguarding auditor.

Payments and e-money firms are also subject to the FCA's operational resilience rules (PS21/3), which require them to identify important business services, set impact tolerances and test that they can stay within them. Safeguarding depends on the same systems as your customer-facing services: the ledger, bank connectivity and reconciliation jobs. When you map important business services, include the safeguarding processes that sit behind them, because a ledger outage that stops payments will usually also stop the day's reconciliation.

What CASS 15 means for your technology

Most of the new rules are a data problem. A firm that cannot produce client-level balances at a fixed point in time will struggle with every obligation that follows. The pieces that usually need work:

• Client-level sub-ledger. Balances per customer, split between the e-money pool and unrelated payment services, with a clear status for unallocated receipts.
• Automated daily reconciliation. Import of statements from every safeguarding bank and custodian, matching against the internal requirement at a fixed reconciliation point, and an exception queue for shortfalls, excesses and timing differences.
• Audit trail. Who approved each top-up or withdrawal, when, and why. Auditors and the FCA will ask.
• Reporting data. Stored daily reconciliation results with their components, so the monthly return and the audit can be built from records rather than recreated.
• Multi-bank view. If you diversify safeguarding banks, a consolidated position across all of them and by currency.
• Resolution pack links. Account lists, agent lists and client records that can be exported on demand, not compiled by hand.

A core banking platform such as Crassula can provide the client-level ledger and the transaction data that reconciliations and the monthly return draw on. The safeguarding policy, the bank relationships and the sign-off remain the firm's responsibility. If you want to see how the ledger side fits your licence, you can request a demo. For the licences themselves, see our guides to the UK Authorised EMI, the UK Authorised Payment Institution and the UK Small EMI and Small PI.

CASS 15 compliance checklist

This guide reflects PS25/12 and the made rules as published by the FCA, and the FRC's March 2026 interim guidance, as at 6 October 2026. It is not legal advice. Check the current FCA Handbook before relying on any detail.

FAQ