At a glance
CASS 15 is the safeguarding chapter of the FCA Handbook: the rules that govern how UK payment institutions and e-money institutions protect their customers' money, in force since 7 May 2026. It turns what used to be guidance into enforceable rules: daily reconciliation, a resolution pack, monthly reporting to the FCA and an annual safeguarding audit.
Key distinction: CASS 15 does not change what firms must protect. It changes how continuously they must prove it, which makes the account structure holding client funds a compliance question, not just an operational one.
The rules were introduced by the FCA's policy statement PS25/12, published in August 2025, and the FCA calls them the Supplementary Regime. As of November 2026, firms are six months in: monthly returns are routine, and the first annual safeguarding audits are being scoped.
What is CASS 15?
CASS is the Client Assets Sourcebook, the part of the FCA Handbook that sets out how regulated firms hold money and assets that belong to their clients. Investment firms have followed CASS 6 and CASS 7 for years. CASS 15 extends the same discipline to the payments and e-money sector.
Before May 2026, safeguarding sat in the Payment Services Regulations and the Electronic Money Regulations, with the detail in FCA guidance. CASS 15 keeps that legal basis but adds Handbook rules on top, so the FCA can supervise and enforce them directly.
It does not work alone. The resolution pack rules sit in CASS 10A, the monthly return in SUP 16.14A and the audit in SUP 3A. Together they make up the regime most firms simply call "CASS 15".
Why the FCA introduced CASS 15
The trigger was what happened when payment firms failed. Of the payment and e-money firms that became insolvent between 2018 and 2023, there was an average shortfall of 65% in the funds owed to their customers, according to the FCA's consultation paper CP24/20.
The FCA pointed to weak reconciliation, poor record keeping and client funds mixed with the firm's own money, which left insolvency practitioners slow to identify whose money was whose.
CASS 15 addresses each of those. It makes reconciliation daily, record keeping prescriptive, and reporting monthly, so the FCA can see problems while a firm is still trading rather than after it has failed. The wider background is set out in our guide to client money safeguarding.
What CASS 15 requires
The core obligations, all live since 7 May 2026:
- Daily reconciliation. Firms must perform internal and external reconciliations at least once every reconciliation day, which excludes weekends, bank holidays and days when a relevant foreign market is closed.
- A resolution pack. Under CASS 10A, firms keep a current set of documents an insolvency practitioner would need to return client funds, retrievable within 48 hours.
- Acknowledgement letters. Each bank holding safeguarded funds signs a letter in the FCA's prescribed form confirming it has no claim over the money. Letters are reviewed at least annually.
- A responsible individual. A single director or senior manager is responsible for operational compliance with the rules and reports on it to the board.
- A monthly return. Firms file a safeguarding return through My FCA within 15 business days of each month end, covering amounts held, reconciliations and breaches.
- An annual audit. A qualified auditor reports on the firm's safeguarding each year, unless the firm qualifies for the small-firm exemption.
Firms can still safeguard either by segregating funds into designated accounts or by covering them with an insurance policy or comparable guarantee, as the FCA explains.
How the CASS 15 safeguarding audit works
The safeguarding audit is the requirement firms ask about most. It must be carried out by a qualified auditor, and the report goes to the FCA as well as the firm.
Firms that have not safeguarded more than £100,000 at any point over the audit period are exempt, but must document that they qualify. For everyone else, the first audit report is due within six months of the end of the first audit period, and later reports within four months.
The audit tests whether the controls above actually work: that reconciliations ran every reconciliation day, breaks were resolved, acknowledgement letters are valid and the resolution pack is current. A firm on a pooled structure will spend much of its audit proving how a ledger maps to a bank balance. Our regime overview covers the preparation steps.
CASS 15 requirements at a glance
| Requirement | Where it sits | Frequency or deadline |
|---|---|---|
| Reconciliation | CASS 15 | Every reconciliation day, internal and external |
| Resolution pack | CASS 10A | Kept current, retrievable within 48 hours |
| Acknowledgement letters | CASS 15 | In the FCA's prescribed form, reviewed at least annually |
| Responsible individual | CASS 15 | One named director or senior manager |
| Safeguarding return | SUP 16.14A | Monthly, within 15 business days of month end |
| Safeguarding audit | SUP 3A | Annual; first report within six months, then four |
| Firms covered | PS25/12 | Authorised PIs and EMIs, small EMIs, e-money credit unions |
Small payment institutions are not covered automatically but can opt in. Firms that hold both payments and investment permissions apply CASS 15 to the payments business and CASS 7 to the investment business, with separate records for each.
Compliance by account structure
CASS 15 rewards structures that make the answer to "whose money is this?" obvious. When client funds sit in pooled accounts, every reconciliation, return and audit depends on matching an internal ledger to an aggregate bank balance, every single reconciliation day.
When each client's funds sit in a named account, the question becomes whether each account holds what it should. The resolution pack becomes a list of accounts, and the audit tests a structure rather than a database. The trade-off is set out in named vs pooled accounts, and the EU is moving the same way under PSD3.
Lorum is the correspondent institution for banks and fintechs, providing access to global clearing, named accounts, and treasury, on a non-lending, 100% reserve model. The fintech and PSP page shows how named accounts fit a safeguarding programme.
Frequently asked questions
Who does CASS 15 apply to?
CASS 15 applies to authorised payment institutions, authorised e-money institutions, small e-money institutions and credit unions that issue e-money in the UK. Firms providing only payment initiation or account information services are excluded, and small payment institutions can opt in.
Does CASS 15 require a safeguarding audit?
Yes. Firms must have a qualified auditor report on their safeguarding every year and send the report to the FCA. Firms that have not safeguarded more than £100,000 at any time during the audit period are exempt, provided they document that they qualify.
What is the difference between CASS 7 and CASS 15?
CASS 7 sets the client money rules for investment firms. CASS 15 sets the safeguarding rules for payment and e-money firms, modelled on the same approach. A firm with both kinds of permission applies each chapter to the relevant part of its business.
What is PS25/12?
PS25/12 is the FCA policy statement, published in August 2025, that introduced CASS 15 and the related rules on resolution packs, monthly returns and audits. The FCA calls these rules the Supplementary Regime, and they took effect on 7 May 2026.
What is a safeguarding resolution pack?
A safeguarding resolution pack is a set of documents, required under CASS 10A, that lets an insolvency practitioner identify and return client funds quickly if the firm fails. It must be kept current and be retrievable within 48 hours.
