CASS 15 and the Safeguarding Supplementary Regime: The Complete Guide for Payment and E-Money Firms
Last reviewed: July 2026
Quick answer: CASS 15 is the FCA’s new sourcebook chapter setting out detailed, mandatory rules on how payment institutions and e-money institutions must safeguard customer funds. It forms the “Supplementary Regime,” which came into force on 7 May 2026. It requires daily reconciliations, monthly regulatory returns, annual audits (for most firms), a dedicated resolution pack, and formal third-party due diligence. A second, more far-reaching stage of reform — which would introduce a statutory trust over customer funds — has been deferred pending further consultation.
If your firm holds relevant funds as a payment institution, e-money institution, small e-money institution, or credit union issuing e-money, this page is for you.
Why this matters
Safeguarding has always been a legal obligation for payment and e-money firms, under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011. What changed on 7 May 2026 is not whether firms must safeguard customer money, but how precisely they now have to prove they’re doing it.
The FCA’s own analysis of firm failures between Q1 2018 and Q2 2023 found an average shortfall of 65% between the funds firms owed customers and the funds actually safeguarded. Unlike bank deposits, money held by payment and e-money firms isn’t protected by the Financial Services Compensation Scheme — if a firm fails and its safeguarding arrangements were inadequate, customers can lose money outright or face long delays getting it back. CASS 15 exists to close that gap.
For firms, the practical consequence is straightforward: safeguarding is no longer a policy statement and a spreadsheet. It’s a supervised, auditable, reportable operational discipline — and the FCA has said plainly that it expects firms to treat 7 May as a hard go-live date, not a soft deadline.
How we got here: the timeline
| Date | Milestone |
|---|---|
| Jan 2023 | HM Treasury publishes its Payment Services Regulations Review and Call for Evidence |
| Sep 2024 | FCA publishes CP24/20, consulting on a two-stage reform of the safeguarding regime |
| Aug 2025 | FCA publishes Policy Statement PS25/12, confirming final rules for the Supplementary Regime |
| 7 May 2026 | Supplementary Regime (CASS 15 and related rules) comes into force |
| 2026 (TBC) | HM Treasury expected to consult on wider payment services law reform |
| 2027/28 (TBC) | FCA expected to consult further on the “Post-Repeal Regime” (statutory trust) |
The FCA always intended this reform in two stages. Stage one — the Supplementary Regime — is now live. Stage two, originally referred to as the “end-state rules” or Post-Repeal Regime, would go significantly further by replacing the underlying safeguarding requirements in the EMRs and PSRs with a CASS-style statutory trust regime, much closer to how client money is protected for investment firms today. Following feedback to its December 2024 consultation, the FCA confirmed it would not proceed with the Post-Repeal Regime without further consideration and consultation. That second stage now depends on wider legislative change to the PSRs and EMRs, which requires HM Treasury action first.
What this means for firms: don’t treat 7 May 2026 as the finish line. It’s the first of two steps, and firms that build flexible, well-documented systems now will be in a far better position when — not if — the statutory trust stage eventually arrives.
Who is in scope
The Supplementary Regime applies to:
- Authorised payment institutions (with one exception below)
- Authorised e-money institutions
- Small e-money institutions
- Credit unions that issue e-money in the UK
Exception: payment institutions that solely provide payment initiation services or account information services fall outside scope, because these firms never hold customer funds in the first place.
If your firm holds “relevant funds” — customer money received in the course of providing payment or e-money services — you are almost certainly affected.
What actually changed: the core requirements
The new rules sit across several parts of the FCA Handbook: CASS 10A, CASS 15, SUP 3A, and SUP 16.14A. Together, they introduce five main operational changes.
1. Daily reconciliation
Firms must reconcile safeguarded funds against their internal records every business day. If a firm uses a non-standard reconciliation method rather than the FCA’s standard approach, it now needs an independent auditor’s report confirming the method is adequate, and must disclose its use in monthly returns.
2. Monthly regulatory returns
Firms must submit monthly returns to the FCA confirming their safeguarding practices and reconciliation outcomes — giving the regulator an ongoing, granular view of a firm’s safeguarding position rather than relying on periodic reviews.
3. Annual audit
Most firms now require an annual audit by a qualified auditor, specifically assessing safeguarding arrangements. The FCA built in a proportionality carve-out: firms holding an average of less than £100,000 in relevant funds over the year are exempt from the audit requirement.
4. A dedicated resolution pack
Firms must maintain a resolution pack — separate and additional to their wind-down plan — that must be kept continuously up to date and be retrievable within 48 hours of a request. In a firm failure, this pack is what allows an administrator to identify and return customer funds quickly.
5. Third-party due diligence and improved books and records
Firms must carry out and document due diligence on any third party holding safeguarded funds on their behalf (such as banks or custodians), and maintain accurate, current records of all relevant funds received and held for customers.
What happens if firms don’t comply
The FCA has been explicit that this isn’t a box-ticking exercise. Firms that fail to implement robust safeguarding controls face a real risk of increased supervisory scrutiny, potential enforcement action and fines, and reputational damage that can outlast the initial breach. Given that safeguarding failures sit at the heart of the FCA’s rationale for this reform in the first place, this is likely to be an active supervisory priority rather than a rule that sits quietly in the background.
Frequently asked questions
Is CASS 15 the same as “CASS” for investment firms? No. Established CASS chapters (like CASS 6 and CASS 7) govern client money and custody assets for investment firms and are built around the FCA’s client money trust concept. CASS 15 is a new, separate chapter built specifically for payment and e-money firms, modelled on CASS principles but not identical to them — at least not yet. That may change if the Post-Repeal Regime eventually introduces a statutory trust for this sector too.
Does the FSCS protect customers of payment and e-money firms? No. This is precisely why safeguarding rules matter so much for this sector — safeguarding is the primary protection mechanism for customer funds, not a compensation scheme.
We hold well under £100,000 in customer funds on average — do we need to do anything? You’re likely exempt from the annual audit requirement, but daily reconciliation, monthly returns, resolution pack, and due diligence obligations still apply regardless of size.
Is the statutory trust (Post-Repeal Regime) definitely happening? Not confirmed. The FCA deferred it pending further consultation, and it depends on HM Treasury progressing wider legislative reform. Firms should watch this space rather than assume a fixed timeline.
We missed the 7 May 2026 deadline — what should we do? Treat implementation as urgent rather than optional. The FCA has indicated it expects firms to already be compliant; the priority now is closing gaps quickly and being able to evidence a credible remediation plan if asked.
This page is for general information only and does not constitute regulatory or legal advice. Firms should seek advice specific to their circumstances and refer to the FCA Handbook and PS25/12 directly for authoritative detail.
One Comment