New CASS 15 Safeguarding Rules: A Guide for EMIs and Payment Firms
The Financial Conduct Authority (FCA) has recently finalized its overhaul of the safeguarding regime for payments and e-money firms. Introduced under Policy Statement PS25/12, the new rules represent the most significant shift in the sector’s regulatory landscape in years, moving firms toward a rigorous framework under CASS.
For many firms, the transition to the new CASS 15 chapter will require a major rethink of their internal controls, governance, and audit arrangements.
Why the change?
The FCA’s primary goal is to address long standing weaknesses in how firms safeguard client funds. By strengthening these rules, the regulator aims to ensure that if a firm fails, customer money can be returned more quickly and in full. The new regime is designed with failure in mind, meaning firms must prove they can identify and segregate client funds at any given moment.
Key Milestones: The Roadmap to Compliance
The transition is split into two distinct stages:
The Supplementary Regime (Interim Rules):
Taking effect from 7 May 2026, these rules strengthen existing requirements around record keeping, monitoring, and reporting.
The Post-Repeal Regime (CASS 15):
This is the end state where the current Electronic Money Regulations (EMRs) and Payment Services Regulations (PSRs) are replaced by the prescriptive CASS 15 rules in the FCA Handbook.
What is Changing for Audit and Assurance?
Perhaps the most critical change for senior management is the shift in how safeguarding is audited.
Statutory Auditor Requirement:
Under the new rules, safeguarding audits can no longer be conducted by general regulatory consultants. They must be performed by statutory auditors where EMIs and payment firms hold more than £100k. This brings safeguarding assurance in line with other regulated client asset regimes (like MiFID firms).
Reporting Breaches:
Auditors will likely be required to report all safeguarding breaches to the FCA, regardless of materiality. This removes management discretion over what is escalated to the regulator.
Strict Reconciliation:
The new rules mandate daily internal and external reconciliations. Auditors will look for robust, automated processes rather than manual, error-prone spreadsheets.
Statutory Trust:
CASS 15 introduces a statutory trust over relevant funds. This creates a more robust legal protection for customers but requires precise accounting and legal documentation to be in place.
Who is affected?
The rules apply to:
- Authorised Payment Institutions (APIs)
- Authorised E-Money Institutions (EMIs)
- Small EMIs (SEMIs)
- Credit Unions issuing e-money
Small Payment Institutions (SPIs) are not mandated to follow the full regime but can choose to “opt-in” to bolster their credibility and consumer protection.
How to Prepare: A Checklist for Firms
With the May 2026 deadline approaching, firms should begin their gap analysis immediately:
Review Governance:
Ensure there is clear senior management accountability for safeguarding (specifically under the SM&CR framework).
Audit Your Tech:
Evaluate whether your current reconciliation engines and sub-ledgers can handle the requirement for daily, granular reporting.
Document the ‘Flow of Funds’:
Create a detailed map of how money enters and leaves your business, identifying every point where funds are “relevant” and must be protected.
Engage Your Auditors Early:
Because the new rules require a specialist statutory audit, you should speak with your auditors now to ensure they have the capacity and expertise to meet the new FRC CASS assurance standards.
How MAH Can Help
At MAH, we specialise in helping FinTech and financial services firms navigate complex regulatory audits. As the FCA increases its scrutiny of the payments sector, having a robust, compliant safeguarding framework is no longer optional, it is a prerequisite for survival.
We can assist your firm with:
- Pre-audit readiness reviews to identify gaps before the May 2026 deadline.
- Statutory safeguarding audits compliant with the new CASS 15 standards.
- Internal control advisory to help automate and secure your reconciliation processes.
