CASS 15 – Be prepared for upcoming changes to the safeguarding regime for payments and e-money firms

In September 2024, the Financial Conduct Authority published its proposed changes to the safeguarding rules for payment services and electronic money firms. The aim of the updates is to align the existing safeguarding regime with the current Client Assets Sourcebook (CASS) rules and lead to the creation of a new Chapter 15 of the Client Asset Sourcebook (CASS 15) and amendments to the Supervision Manual (SUP 3A).

These proposals have been triggered by the FCA’s continuing focus on consumer protection, as well as a number of insolvencies in the sector. The FCA estimates that for all insolvencies between Q1 2018 and Q2 2023, there was an average shortfall of 65% between customer funds and those actually being safeguarded.

In this article, Oliver Hawes, a Director in PKF Littlejohn’s Financial Services team, looks at the likely impact of the new safeguarding rules and draws on his extensive experience in CASS matters to suggest how management teams can prepare for the upcoming changes.

Who will this affect?

The proposed rules will apply to the following types of organisations:

• Authorised payment institutions
• E-money institutions
• Small e-money institutions
• Credit unions that issue e-money in the UK under the Payment Services Regulations or Electronic Money institutions.

As is the case currently, small payment institutions will be able to opt-in to comply with safeguarding requirements on a voluntary basis.

The proposed changes will be introduced in two phases: the interim state, which is expected to come into force during the first six months of 2025; and the end-state is expected to come into force during the second half of 2025.

The new regime will focus on three key aims – improved record keeping, enhanced monitoring and reporting, and strengthening safeguarding processes. Let us now take a look at each of these in turn.

• Improved record keeping

For the interim state, there are changes to the reconciliations required to be carried out by firms for the safeguarded funds held. Under the existing safeguarding rules, firms are required to carry out internal and external reconciliations at least once every business day; however this frequency is only required where a ‘potential for discrepancies exists’. Should a firm conclude that this does not exist, then it is able to determine its own frequency, provided that this is documented with reference to the risks the business is exposed to and the nature and volume of transactions occurring.

The existing regime does not provide any guidance as to the format or process that needs to be followed in order to carry out such reconciliations and largely allows firms to develop their own method; the only requirement is that processes are sufficient to show a third party the method used and its adequacy. The proposed new rules set out a clear process that the firm must follow in the carrying out reconciliation – including how to calculate the individual elements of the reconciliations, that they must be carried out at least once each business day and other elements that must be included on the reconciliation.

This change is likely to be significant to firms, particularly where they are not already carrying out daily reconciliations, or do not have an established and documented process. Firms should ensure that they have the relevant internal skills, resources and personnel to comply with this requirement.

Firms will also be required to maintain a CASS resolution pack, similar to that currently required by CASS 10. This is a collection of records and documents setting out the key personnel at the firm, the key policies and procedures in respect of safeguarding and key contacts at any third parties used by the firm. This is seen as a key document by the FCA and is designed to be readily available to assist an insolvency practitioner in locating and returning safeguarded funds back to clients in the event of the failure of the firm.

At the end state, rules around organisation requirements are expected to be introduced that will be similar to those within the existing client money rules under CASS 7. These require a firm to introduce organisational requirements to reduce the risk that safeguarded funds will not be lost as a result of fraud, poor record keeping and negligence. It is expected that most firms will already have such measures in place, but management should ensure that these are fully documented within their policies and procedures. As part of the annual CASS audit (covered below), auditors will be required to confirm compliance with these rules and will expect to see these documented.

• Enhanced monitoring and reporting

At the interim state, provisions will be introduced requiring firms to appoint an independent qualified auditor to provide an annual report to the FCA within four months of the year end. The onus will also be on the firm to take reasonable steps to ensure that it has the required skill, resources and experience to act in this role. The proposals also state that if firms do not appoint an auditor within 28 days of being requested to, the FCA will seek to appoint an auditor on behalf of the firm. It is therefore vital that firms take time to consider the appointment of their auditor in good time, rather than risk having one forcibly appointed by the regulator.

This is a significant change to the current regime, given that there is no requirement at present for the person carrying out the firm’s safeguarding audit to be qualified. There is a risk that firms may find that their current auditor does not meet this definition; they should discuss this with their auditor as a matter of urgency so that they can seek to reappoint prior to being required to by the FCA.   

There will also be a requirement to submit a monthly return to the FCA, similar to the current Client Money and Assets Reporting (CMAR) form required to be submitted by certain investment firms. This will require firms to provide the FCA with details of the amounts of funds held, where these funds are located and discrepancies on reconciliations and will be significantly more detailed that the current annual reporting requirements.

Finally, there will also be updated requirements on the use of the insurance or comparable guarantee, rather than holding funds in a segregated account. The proposals confirm that this approach will still be permitted under CASS 15. This is still expected to be an option available to firms, but will be tightened up under the new rules, requiring firms to carry out due diligence on such third parties used.

• Strengthening safeguarding requirements

The key change during the interim state will be introducing a requirement for firms to exercise skill, care and diligence in the appointment of third parties used to hold safeguarding funds. Management will be required to document the grounds upon which it has satisfied itself as to the appropriateness of the third party and to carry out a periodic review of the third party. Third parties, such as electronic money institutions under the current guidance may be used to hold relevant funds on receipt up to the end of the next day.

Guidance on what constitutes skill, care and diligence is provided within the proposals and states that firms should consider factors such as the creditworthiness and capital of the third party, as well as the proportion of safeguarded funds held on behalf of the firm, against the total funds held by that third party.

As part of the required periodic review, firms will also be required to consider the need for diversification and to ask themselves whether their current arrangements are appropriate. This will be particularly key for firms which use only one banking institution; such firms should clearly document their conclusion as to why this is considered to be appropriate. Where management identifies that changes are required, these will be expected to be implemented promptly.

At  the end state, rules will be introduced requiring firms to ensure that relevant funds are received directly into the designated safeguarding account, rather than being received into a segregated bank account. The rules will also introduce the imposition of a statutory trust over the relevant funds, which will ensure that these are held separately from the firm’s money (as opposed to the current regime where safeguarded funds are treated as creditors of the firm).

This supports the key message of the FCA in the creation of these rules. It will ensure that, in the event of an insolvency, the funds are separate, protected and able to be returned to clients, rather than the need for them to form part of the creditors pool.

New audit requirements

On top of the changes examined above, the proposals also state that an annual audit report will need to be prepared and submitted to the FCA by a qualified auditor. However, the proposals do not yet have an effective date so it is not clear when the rules will be applicable from and the first audit period covered by them. This is likely to be confirmed when the interim state proposals are finalised in the first half of 2025. It is important to note that the FCA is expected to release a new Assurance Standard in respect of safeguarding audits, which will provide guidance to auditors on the process of forming their audit opinion as well as the required format of the audit report. This is not currently the case under the existing regime, where there is no prescribed format, and firms may find that audits under CASS 15 are more rigorous and demanding than they have experienced previously.

Being prepared is the key

Having seen the impact of the introduction of the CASS Assurance Standard back in 2015, which caught many firms unaware due to the speed of its implementation, I cannot emphasise enough the need to plan and prepare for these changes.

The key lesson learnt last time was that firms should thoroughly understand how the updated rules would affect them and then have a practical plan to implement any required changes.

This time around, it is clear that the new rules will come into force relatively quickly – the interim state is expected to be finalised before June 2025 – so it is important that firms start their planning now.

There are a significant number of changes to the existing regime, some requiring more work by firms and changes to internal processes than others. Within the FCA’s consultation paper (CP24/20), elements of the proposed new rules were set out in the format they would be expected to be in when released. These provide an important clue – management teams should therefore carefully review these, consider the impact they will have on their business, staffing and internal processes, and then prepare an implementation plan with key timelines.

It is important for affected firms to get this right, and drawing on trusted advice and support could be invaluable in these circumstances. After all, it is worth remembering that the enhanced monthly reporting required by the FCA under these new rules will give the regulator much more information about the safeguarding performance of firms. We would expect it to use this information for benchmarking different firms, identifying outliers and spotting those that are not complying with the new rules. This could, in turn, potentially lead to enquires being made of management or visits to the firm by the regulator…

This article was originally published in Compliance Monitor and i-law in March 2025. For more information, please contact Oliver Hawes.

Read our series of articles on the upcoming changes to the safeguarding regime for payment services and electronic money firms.