UK CASS 15 Safeguarding Requirements

CASS 15 is the most detailed safeguarding regime among the major payments jurisdictions, and since 7 May 2026 it is the operating reality for every authorised payment institution and electronic money institution in the UK.

It did not replace the existing obligations. The safeguarding requirements in the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 remain, and CASS 15 supplements them with detailed rules on how protection must be achieved, evidenced, reported and audited.

This article sets out what the regime requires.

Who does CASS 15 apply to?

The regime applies to:

• Authorised payment institutions holding relevant funds
• Authorised electronic money institutions
• Small electronic money institutions
• Credit unions issuing electronic money in the UK

Small payment institutions are not required to safeguard and are therefore outside the regime, but may opt in. Where they do, the regime applies to them.

Firms providing only account information services or only payment initiation services do not hold customer funds and are outside scope. Credit institutions are subject to deposit protection rather than safeguarding.

A firm holding both an electronic money authorisation and a separately regulated investment business applies CASS 7 to the investment business and CASS 15 to the e-money activity, with separate records and reconciliation processes for each.

What are relevant funds?

Relevant funds are sums received from or for a payment service user for the execution of a payment transaction, sums received from another payment service provider for the execution of a payment transaction, and, for e-money issuers, sums received in exchange for electronic money issued.

The definition is straightforward. The application is where firms have difficulty, and four questions have to be answered and documented.

When does the obligation begin? Funds become relevant funds on receipt, and the firm must be able to identify the moment of receipt for each flow.

When does it end? The obligation continues until the funds are paid out or the electronic money is redeemed. Unclaimed balances remain relevant funds.

How are fees treated? Fees once due to the firm are not relevant funds, and the point at which they become due must be determined consistently.

How is foreign exchange treated? Where currency conversion is linked to a payment service, the treatment of funds during conversion must be documented.

These determinations belong in the firm's safeguarding policy, and the reconciliation performed must be consistent with the position taken.

What does the reconciliation require?

Two reconciliations, each performed at least once on every reconciliation day.

The internal safeguarding reconciliation compares the relevant funds that should be safeguarded against the firm's own internal records. Its purpose is to confirm that the firm's books and records are accurate.

The external safeguarding reconciliation compares those internal records against third-party records: statements from the institutions holding safeguarding accounts, and records from custodians holding relevant assets.

Both feed the central comparison. The D+1 segregation requirement is the relevant funds that should be held in relevant funds bank accounts or as relevant assets. The D+1 segregation resource is the balance of those accounts. Where the resource falls short, the firm must remedy the shortfall, using its own funds where relevant funds are unavailable. Where it exceeds the requirement, the excess must be withdrawn.

Every element of that - the calculation, the comparison, the outcome and the action taken - must be recorded.

Any day other than a Saturday, a Sunday, a UK bank holiday, or a day on which a relevant foreign market is closed.

Two points follow. The firm must determine which foreign markets are relevant to its business and apply that determination consistently. And the reconciliation calendar should be defined in advance rather than decided each morning, because a missed reconciliation day is a breach whether or not anyone noticed at the time.

Funds held in respect of electronic money and funds held for unrelated payment services are separate asset pools. They must be reconciled separately and reported separately throughout.

A single combined reconciliation misstates both positions. This is one of the most common errors among firms operating mixed models.

What reporting is required?

A monthly safeguarding return under SUP 16.14A, submitted through RegData.

The return covers relevant funds held, the segregation position across the reporting period, reconciliation performance, shortfalls identified and remedied, safeguarding accounts and assets, the safeguarding method used, and breaches and notifications.

Two features are worth noting. It is monthly, so there are twelve production cycles a year. And it reports performance across the period rather than position at a date, which means a firm that does not reconcile on each reconciliation day cannot produce a credible return.

Our guide to regulatory reporting for multi-licence payment firms covers how this obligation sits alongside reporting to other regulators.

What does the annual audit require?

Authorised payment institutions and electronic money institutions must arrange an annual safeguarding audit under SUP 3A, unless the firm safeguarded less than £100,000 throughout a relevant period of at least 53 weeks.

The audit period must not exceed 53 weeks. The first report is due within six months of the end of the audit period, and subsequent reports within four months.

Two points from the guidance issued by the Financial Reporting Council are worth knowing in advance. Auditors report all breaches to the FCA, not only material ones. And IT general controls covering change management, user access and IT operations form part of the audit, which means the systems producing the safeguarding records are examined alongside the records themselves.

What is the resolution pack?

A pack maintained under CASS 10A, retrievable within 48 hours, containing the records needed to enable relevant funds to be returned to customers in an insolvency procedure.

The requirement is for an existing and current pack, not one assembled on request. A pack that would take a week to compile does not meet a 48-hour retrieval requirement, however complete it is once compiled.

When must the FCA be notified?

A firm must notify the FCA without delay where:

• Its internal records are materially out of date, inaccurate or invalid
• It will be unable to perform a reconciliation
• It will be unable to remedy a discrepancy
• There has been a material difference between the amount safeguarded and the amount that should have been safeguarded at any time during the preceding year

The fourth is the one firms overlook, because it is retrospective and covers a full year rather than a current position.

What governance does CASS 15 require?

Responsibility for safeguarding compliance must sit with a director or senior manager of sufficient skill and authority.

CASS 15 does not create a defined safeguarding officer role, mandate a board-level appointment or prescribe a reporting frequency. It requires that a named individual with genuine authority owns the arrangements. Governance beyond that is good practice rather than a requirement, and should be described as such.

Firms must also carry out and document due diligence on the banks, custodians, insurers and guarantors involved in safeguarding arrangements, subject to periodic review, and consider whether diversification is appropriate.

Acknowledgement letters must be obtained from institutions holding safeguarding accounts, confirming that funds are held for safeguarding purposes, that the institution has no right of set-off or counterclaim, and that it will not combine the account with any other.

What are the safeguarding methods?

Three permitted methods.

Segregation. Relevant funds held in a designated safeguarding account with an authorised credit institution. Funds must be placed there promptly and at the latest by the close of the business day following receipt.

Secure liquid assets. Relevant funds invested in secure, liquid assets held with an authorised custodian.

Insurance or comparable guarantee. A policy or guarantee meeting specified conditions, which must not contain conditions or restrictions beyond certification of an insolvency event. Notification requirements apply at least two months before first use, on any change of cover or provider, and at least three months before expiry.

Most UK firms use segregation. Insurance is difficult to place at commercially viable pricing at scale and policy terms attract close supervisory scrutiny.

Where do firms most often have difficulty?

Six areas recur.

The external reconciliation is performed less rigorously than the internal one. Both are required on each reconciliation day, and the difference in rigour shows in the records.

The relevant funds boundary is undocumented. Judgements on fees, foreign exchange, agent funds and unclaimed balances are applied in practice without being recorded, producing inconsistency between the stated position and the reconciliation performed.

Asset pools are combined. E-money and unrelated payment services reconciled together, misstating both.

The segregation deadline is breached structurally. Sweep arrangements that assume same-day settlement push transfers past the deadline whenever settlement is delayed. Monitoring the age of unsegregated receipts, rather than only the safeguarding balance, is what catches this.

The resolution pack is maintained as a document. Assembled once and not updated, describing arrangements that have since changed.

Evidence is assembled rather than retained. The control operated, and the record demonstrating it was created afterwards from recollection. The examination tests evidence, and a control that cannot be evidenced is indistinguishable from one that did not operate.