30th March 2026Navigating the shift to CASS15: essential steps for e-money and payment institutions

The countdown to 7 May 2026 is on. For e-money and payment services institutions the implementation of the FCA’s Supplementary Regime (CASS15) is a significant shift, that aligns safeguarding requirements of client funds with the rigorous standards of CASS7.

These rules address a history of safeguarding failures that have led to significant shortfalls in customer funds during firm insolvencies. The FCA’s goal is to ensure that, should a firm fail, client money is protected and can be returned as whole as possible.

Core requirements for CASS15 readiness

The FCA’s has made it expectations clear – firms must be fully compliant by day 1. To meet this standard, your procedures should address the following:

• Fund mapping: Relevant funds to be safeguarded are identified and funds flow mapped
• Governance: Safeguarding responsibilities and policies are formally documented and approved
• Operational systems: Safeguarding systems and record keeping are operational
• Banking infrastructure: Designated safeguarding bank accounts are set up and the acknowledgement letters are in place
• Breach management: A breach register is maintained for all breaches (there is no materiality threshold)

CASS15 also places an annual safeguarding audit requirement for many E-money and payment services institutions. Statutory auditors must be appointed to provide reasonable assurance reports on firms’ compliance with CASS15.

The new audit landscape

On 17 March 2026, the FRC published interim guidance to assist firms and their auditors prepare for the implementation of the new rules. The CASS15 audit requirements are stricter than the legacy safeguarding framework. Firms should not underestimate the risks of non-compliance, which typically stem from:

• Firms’ IT systems are not robust and controls are weak and ineffective
• Internal and external reconciliations are not done at least daily
• Record of such reconciliations with evidence of Prepared by and Reviewed by is not kept
• Differences in the reconciliations are not addressed promptly or within the next day
• The source of foreign currency data is unreliable or inconsistently applied.
• Acknowledgement letters are not in place or the prescribed format not used.
• Resolution packs have not been prepared or are inadequate.

The transitional year

In this first year of the implementation of CASS15, firms have a choice of obtaining a hybrid audit assurance report covering for example the period from 1 January 2026 to 6 May 2026 under the legacy safeguarding regime and the period from 7 May 2026 to 31 December 2026 under the new regime, or obtaining separate reports for the legacy and the new regime. These reports will be due within 6 months of the reporting period end, and after the transitional year the FCA will have a shorter reporting deadline of 4 months.

Supporting your transition to CASS15

The FCA expects firms to be ‘Supplementary Regine Ready’ by 7 May if not sooner. Identifying gaps in your systems or documentation now is critical to avoiding audit failures and regulatory intervention later.

Contact our financial services audit experts today for a CASS15 Readiness assessment and support with your transition.