CASS 15 is the new FCA Handbook chapter that sets out exactly how UK electronic money institutions (EMIs) and payment institutions (PIs) must safeguard customer funds, and it came into force on 7 May 2026. In practice it requires firms to reconcile their safeguarding position against their own books and against bank or custodian statements every single business day, not just at month end.
What CASS 15 actually is
CASS 15 (Payment services and electronic money: relevant funds) is the FCA's dedicated safeguarding chapter for EMIs and PIs, introduced alongside changes to CASS 10A and SUP 16.14A through FCA Handbook Instrument 2025/38. It supplements, rather than replaces, the underlying safeguarding duties already set out in regulation 20 of the Electronic Money Regulations 2011 and regulation 23 of the Payment Services Regulations 2017. Before CASS 15, those regulations gave the broad legal obligation to safeguard "relevant funds". CASS 15 is where the FCA finally wrote down the operational detail: how to calculate what should be safeguarded, how often to check it, what counts as an acceptable safeguarding account, and what a firm must do when the numbers do not match.
The chapter applies to authorised EMIs, authorised PIs, small EMIs and small PIs that have opted in to safeguarding, and credit unions issuing e-money. If your firm holds customer funds under the PSRs or EMRs, CASS 15 is now the rulebook you are measured against, and the FCA's supervisory approach document has been updated accordingly to reflect the new safeguarding and resolution pack regime.
The daily reconciliation requirement, in plain terms
This is the part that catches firms out, because it is a genuine change in cadence from how many EMIs and PIs operated before. CASS 15.8 requires a safeguarding institution to perform an internal safeguarding reconciliation "as frequently as necessary and no less than once each reconciliation day". A reconciliation day is any UK business day, so weekends, bank holidays, and days when relevant foreign markets are closed are excluded, but every other working day is in scope.
Two separate checks sit inside the daily cycle:
- Internal reconciliation: comparing the safeguarding resource (what the firm's own records show it is actually safeguarding) against the safeguarding requirement (what it should be safeguarding based on client liabilities). This uses the firm's own ledgers and records, not bank statements, and the two sides must be genuinely independent, meaning a firm cannot reuse one internal record to represent both sides of the check.
- External reconciliation: comparing those internal records against third party evidence, meaning statements or confirmations from the banks, account providers and custodians actually holding the relevant funds and relevant assets. This is done account by account and currency by currency.
Where applicable, firms also run a D+1 comparison: the D+1 segregation requirement (what should be sitting in a relevant funds bank account or in relevant assets by the next business day) against the D+1 segregation resource (what is actually there). This is the practical "did yesterday's inflows actually land in the safeguarding account" check, and it is where timing gaps between receiving customer funds and physically moving them into a segregated account get caught.
Daily matters specifically because CASS 15 removes any materiality floor. There is no threshold below which a small discrepancy can be left for the next cycle. A shortfall identified on a reconciliation day generally needs to be topped up by the end of that day; an unresolved external discrepancy needs to be investigated without undue delay. A firm reconciling weekly or monthly can be wrong for weeks without knowing it; a firm reconciling daily finds the break the day it happens, while it is still cheap and simple to fix.
The monthly safeguarding return (REP027)
From 7 May 2026, safeguarding institutions also face a new monthly regulatory return, commonly referred to in industry commentary as REP027, established under SUP 16.14A and SUP 16 Annex 29BR. It is submitted electronically via the FCA's RegData platform within 15 business days of each calendar month end, with the first returns due from July 2026. The return covers the safeguarding method used, balances held, where funds are held, the resource versus requirement position, the D+1 segregation check, reconciliations performed during the period, account level record keeping, and any notifiable CASS breaches. Firms should verify the exact form reference and current field requirements directly in the live SUP 16.14A handbook text and their RegData schedule, since the FCA can and does adjust reporting templates, but the substance of what gets reported is well established: it is a monthly summary of exactly the daily reconciliation data described above.
The annual safeguarding audit and the resolution pack
CASS 15 also brings an annual independent audit requirement: firms must arrange for an auditor to review their compliance with the safeguarding rules each year, similar in spirit to the existing CASS audit regime for investment firms. The practical implication is that audit readiness becomes an ongoing state rather than an annual scramble, since the auditor will expect to see consistent daily evidence (dated reconciliations, signed off breaks, remediation records) covering the whole audit period, not a tidy pack assembled the week before the visit.
Alongside this sits the resolution pack requirement under the new CASS 10A chapter: firms must maintain and keep current a defined set of documents and information (account structures, acknowledgement letters, governance records, third party due diligence, reconciliation methodology) so that, in the event of insolvency, an administrator or the FCA can quickly understand where customer funds are, who holds them, and how to return them without unnecessary delay. A resolution pack that is stale or incomplete defeats the purpose of the whole regime, which is faster, more certain client money return.
What to actually automate, concretely
The honest version of "automate CASS 15" is narrower than most vendor pitches suggest. What needs to run daily, reliably, and leave an evidence trail is:
- Pulling the previous day's client ledger movements and recalculating the safeguarding requirement per client, excluding negative balances rather than netting them.
- Pulling bank and custodian statement data for every safeguarding account, by currency, and comparing it line by line against internal records.
- Calculating the D+1 position where relevant funds are received before being placed into a safeguarding account.
- Flagging breaks automatically, with an owner, a cause, and a deadline, rather than relying on someone noticing a number looks wrong.
- Keeping a dated, immutable record of every reconciliation run and every break resolution, because that evidence trail is exactly what both the auditor and the monthly return draw on.
The breaks that actually show up in practice are rarely dramatic. They are timing differences between a payment hitting the customer ledger and the bank settling it, fees the bank deducted that never made it into internal records, FX conversion lags, or a batch of inbound funds that sat in an operating account overnight before being swept into the safeguarding account. None of these are scandalous on their own. What makes them dangerous is leaving them undetected, because CASS 15's entire design assumes a firm always knows, to the day, whether customer money is where it should be.
This is also the area where Novafin's EMI safeguarding automation work is focused: building the daily reconciliation engine, break management workflow, and evidence trail that feeds both the monthly return and the annual audit from one controlled source, rather than reconstructing the numbers by hand each time a deadline approaches. If you are still choosing which bank or e-money institution to use for the safeguarding account itself, our piece on choosing a safeguarding institution covers the practical criteria worth weighing before you commit.
If your daily reconciliation process still relies on spreadsheets and manual bank downloads, get in touch at team@novafin.co or through the safeguarding page for a safeguarding reconciliation review.