Since 7 May 2026, the FCA’s Supplementary Regime (CASS 15, introduced by Policy Statement PS25/12) requires most authorised payment institutions and e-money institutions to arrange an annual FCA safeguarding audit by an independent qualified auditor. The exemption is narrow: firms that have not been required to safeguard more than £100,000 in relevant funds at any point over a continuous 53-week period. The first audit report is due to the FCA within six months of the firm’s first relevant period end, and within four months in subsequent years.
Who is in scope
The safeguarding rules apply to firms that receive relevant funds from customers:
- Authorised payment institutions (excluding firms providing only payment initiation or account information services, which hold no client funds)
- Authorised and small e-money institutions
- Credit unions issuing e-money
The obligation to safeguard isn’t new — it comes from the Payment Services Regulations 2017 and the Electronic Money Regulations 2011. What changed on 7 May 2026 is how those obligations must be met: prescriptive rules replaced high-level guidance.
What changed on 7 May 2026
Under CASS 15, in-scope firms must now:
- Reconcile daily. Internal and external safeguarding reconciliations at least once every business day. Non-standard reconciliation methods require an independent auditor’s report and disclosure in monthly returns.
- Report monthly. A new monthly safeguarding return (REP027) submitted electronically to the FCA.
- Maintain a resolution pack. Living documentation that lets an insolvency practitioner trace where relevant funds are held, who the agents and distributors are, and how records and transfers are controlled — so customers get their money back quickly if the firm fails.
- Diversify and vet third parties. Due diligence on credit institutions holding safeguarded funds, with concentration risk considered.
- Plan for insurance expiry. Firms using the insurance or guarantee method must have a contingency plan in place at least three months before cover expires.
- Undergo an annual safeguarding audit — the subject of this guide.
The FCA safeguarding audit requirement in detail
All authorised firms in scope must arrange an independent annual audit of their safeguarding arrangements unless they qualify for the small-firm exemption: not having been required to safeguard more than £100,000 in relevant funds at any time over a continuous period of at least 53 weeks. Senior management must reassess the exemption on an ongoing basis and appoint an auditor as soon as the firm no longer meets it.
- First report deadline: within six months of the firm’s first relevant period end under the new regime
- Subsequent reports: within four months of each relevant period end
- Who performs it: an independent qualified auditor. In March 2026 the Financial Reporting Council published interim guidance for safeguarding auditors, modelled on the existing CASS assurance standard; a dedicated safeguarding assurance standard is expected to follow consultation in 2027
- What the auditor examines: whether your safeguarding arrangements, records and reconciliations met the rules throughout the period — not just at the year-end date
Work through our CASS 15 audit readiness checklist to see where you stand.
What safeguarding auditors will look for
Based on the FRC’s interim guidance and the CASS assurance approach it borrows from:
- Daily reconciliation records — complete, dated, with discrepancies investigated and resolved
- Clear segregation between relevant funds, fee income and own funds in the ledger
- Designated safeguarding account documentation and acknowledgment letters from credit institutions
- A current resolution pack, not a stale one assembled for the audit
- Governance evidence: who owns safeguarding, and how breaches are escalated
- Board-level awareness — safeguarding is a senior management responsibility under CASS 15, not an operations detail
The regime is two-stage — what’s still coming
The Supplementary Regime is stage one. The FCA has confirmed it will consult again before implementing stage two — the Post-Repeal Regime — which would replace the safeguarding provisions of the PSRs and EMRs with a full CASS-style regime, including receipt of funds directly into designated safeguarding accounts held under statutory trust. Firms building systems now should design for that direction of travel rather than the minimum current requirement.
Getting audit-ready with AccTek
AccTek prepares payment and e-money firms for the safeguarding audit as part of our fintech accounting service:
- Design daily reconciliation processes and ledger structures that separate relevant funds cleanly
- Build resolution pack documentation and REP027 reporting workflows
- Run a pre-audit gap analysis against CASS 15 so your first audit has no surprises
- Keep your books audit-ready year-round on Xero, so evidence exists when the auditor asks
FCA safeguarding audit FAQs
What is the £100,000 safeguarding audit exemption?
A firm is exempt from the annual safeguarding audit if it has not been required to safeguard more than £100,000 in relevant funds at any time over a continuous period of at least 53 weeks. It is a rolling test — crossing the threshold at any point triggers the audit obligation, and senior management must monitor this on an ongoing basis.
When is the first FCA safeguarding audit report due?
Within six months of the firm's first relevant period end under the regime in force from 7 May 2026. Subsequent reports are due within four months of each relevant period end.
Who can perform an FCA safeguarding audit?
An independent qualified auditor. The Financial Reporting Council published interim guidance for safeguarding auditors in March 2026, based on the existing CASS assurance standard, with a dedicated standard expected after consultation. Your accountant can prepare your records and evidence for the audit, but cannot audit their own work.
Does the safeguarding audit replace our statutory accounts audit?
No — they are separate engagements. The safeguarding audit examines compliance with the FCA's safeguarding rules over the period; the statutory audit (where required) covers the financial statements. A firm can be exempt from one and not the other.
What is a resolution pack?
A maintained set of documents that would let an insolvency practitioner quickly identify where safeguarded funds are held, which agents and distributors handle them, and how records and transfers are controlled. CASS 15 requires it to be kept current — it exists to speed up returning customer money if the firm fails.
Godwin Pinto ACA (ICAI) is the founder of AccTek and a member of ICPA, with 20+ years of experience in accounting and tax for contractors, startups and SMEs. Previously at PwC.
Official guidance: the safeguarding rules are set out in the FCA’s Policy Statement PS25/12, and the FRC’s interim guidance for safeguarding auditors covers the first audit cycle. AccTek Ltd is an independent accountancy practice and is not affiliated with the FCA, the FRC, HMRC or GOV.UK. This guide is general information, not advice on your firm’s specific position.
Your first safeguarding audit shouldn’t be your first look at the rules
Reconciliations, resolution pack, REP027 and audit-ready books — prepared before the auditor asks. Get a fixed monthly quote in about two minutes.
