Under the interim safeguarding regime delivered through the CASS 15 sourcebook, the annual safeguarding audit has become the principal external test of whether a payment institution or e-money institution is actually protecting relevant funds, as opposed to describing how it intends to.
The audit is uncomfortable for firms whose processes rely on manual workarounds, because it tests operation across a period rather than position on a date.
What the audit is
It is an assurance engagement performed by a qualified auditor, resulting in an opinion on the firm's compliance with the safeguarding requirements over the audit period. The opinion is provided to the firm and submitted to the FCA. Two outcomes matter.
Unqualified opinion. The auditor concludes that the firm complied with the requirements in all material respects throughout the period.
Qualified or adverse opinion. The auditor identifies breaches or is unable to obtain sufficient evidence. This is visible to supervision and will generate follow-up.
What auditors test
| Area | What is tested | Typical evidence |
|---|---|---|
| Organisational arrangements | Governance, roles, senior manager ownership, policy currency | Safeguarding policy, board minutes, responsibilities map |
| Identification of relevant funds | Whether all in-scope funds are identified at receipt | Product and flow mapping, system configuration |
| Segregation | Timeliness of transfer into a safeguarding account | Transaction level testing across the period |
| Records and accounts | Ability to reproduce the position at any date | Relevant funds records, historic extracts |
| Internal reconciliation | Frequency, method, completeness | Daily reconciliation files with preparer and reviewer |
| External reconciliation | Agreement to third-party statements | Bank and institution statements, matching evidence |
| Discrepancy handling | Identification, funding, escalation, resolution | Exception log with dated entries |
| Third-party arrangements | Acknowledgement letters, account designation | Signed letters, account naming evidence |
| Wind-down and distribution | Ability to return funds promptly | Distribution plan, tested extract |
The audit is period-based. A firm that performed reconciliations correctly for ten months and inconsistently for two has a finding.
Where firms fail
Records that cannot be reproduced. If the relevant funds position as at a date three months ago cannot be regenerated from the system, the record is not adequate.
Reconciliations without evidence of review. A completed reconciliation with no preparer, no reviewer and no timestamp cannot be relied on.
Discrepancies left open. An exception log with items open for weeks, without escalation, demonstrates that the resolution process is not operating.
Late segregation. Funds transferred to the safeguarding account on a delayed basis, even briefly, are tested transaction by transaction.
Missing or defective acknowledgement letters. Letters that are unsigned, out of date, or that do not correctly describe the account and the firm's interest are a recurring finding.
Agent and distributor flows. Funds received through agents or distributors are frequently outside the primary reconciliation, and that omission is normally material.
How to prepare
Run a readiness review one quarter before period end covering four questions.
- Can we reproduce the relevant funds position for any date in the period, from system records, without manual reconstruction?
- Does every reconciliation in the period have evidence of preparation, review and resolution of exceptions?
- Are all safeguarding accounts correctly designated, with current acknowledgement letters on file?
- Are all product and distribution flows, including agents, in scope of the reconciliation?
Where the answer to any is no, remediate before period end rather than during fieldwork. Our PS25/12 safeguarding compliance checklist and our CASS 15 reconciliation guidance set out the control detail, and the safeguarding software buyer's guide covers tooling.
Governance around the opinion
The board should receive the audit report, the management letter and a tracked remediation plan. Where the opinion is qualified, the board should record its consideration, the root cause and the corrective action, and should expect supervisory contact. Firms that self-report a qualified opinion with a credible plan are in a materially stronger position than firms that wait to be asked.
About Regulatory Counsel
Regulatory Counsel advises UK and international financial services firms on authorisation, prudential and conduct requirements, governance, financial crime and regulator engagement.
Our safeguarding work covers readiness reviews ahead of the annual audit, records and reconciliation design, discrepancy and exception frameworks, acknowledgement letter review, agent and distributor flow mapping, remediation of audit findings and board reporting.
Contact our regulatory team at info@regulatorycounsel.co.uk.
This article is provided for general information and does not constitute legal or regulatory advice. Firms should confirm the current position against FCA publications and take advice on their specific circumstances.
Frequently Asked Questions
It is an assurance engagement in which a qualified auditor forms an opinion on whether the firm complied with the safeguarding requirements throughout the audit period. The opinion is provided to the firm and submitted to the FCA.
The most common causes are records that cannot reproduce the historic relevant funds position, reconciliations without evidence of review, unresolved discrepancies, late segregation of funds, and missing or defective acknowledgement letters.
A period. The auditor tests the design and operating effectiveness of controls across the whole audit period, so inconsistent performance in any part of the period can produce a finding.
Issues can be corrected, but reconstructing records or reconciliations during fieldwork does not remove the finding, because the evidence is no longer contemporaneous. Remediation should be completed before period end.
Receive the report and management letter, record its consideration and challenge, approve a tracked remediation plan with owners and dates, and where the opinion is qualified, consider self-reporting to the FCA with that plan.