This checklist covers what a payment or e-money institution should have in place before its first FCA safeguarding audit under CASS 15 (in force from 7 May 2026): daily reconciliation evidence, ledger segregation, safeguarding account documentation, a current resolution pack, REP027 reporting workflows, and governance records. Work through it well before your relevant period end — the first audit report is due to the FCA within six months of that date.
Not sure whether the audit applies to you? Start with our FCA safeguarding audit requirements guide.
Scope and governance
- Confirmed the firm’s audit position: over or under the £100,000 / 53-week exemption — with the assessment documented and dated
- Senior management owner for safeguarding named, with the responsibility minuted
- Exemption status on a recurring review cycle (it’s a rolling test — crossing £100,000 at any point triggers the obligation)
- Board has seen and approved the safeguarding policy since 7 May 2026
- Breach escalation route documented: who is told, when, and what gets reported to the FCA
Reconciliations
- Internal reconciliation (own records: what should be safeguarded) performed at least every business day
- External reconciliation (records vs safeguarding account balances) performed at least every business day
- Each reconciliation dated, preserved, and signed off — with discrepancies logged, investigated and resolved
- If using a non-standard reconciliation method: independent auditor’s report obtained and the method disclosed in monthly returns
- Shortfall/excess funding process documented, with evidence it has been followed
Ledger and records
- Chart of accounts separates relevant funds, fee income and own funds — separable on demand, not by year-end analysis
- Agent and distributor flows identifiable in the ledger
- Records sufficient to show the safeguarding position at any point in the period, not just month ends
Safeguarding accounts and third parties
- Designated safeguarding account(s) properly named and documented
- Acknowledgment letters from each credit institution on file
- Third-party due diligence documented, with concentration risk considered and reviewed
- If using the insurance or guarantee method: contingency plan in place at least three months before cover expires
Resolution pack
- Resolution pack exists and identifies where relevant funds are held, agents and distributors, and how records and transfers are controlled
- Kept current — with a named owner and an update trigger list (new bank, new agent, new product), not assembled retrospectively for the audit
Reporting and audit logistics
- Monthly safeguarding return (REP027) workflow live, with submissions on time and reconciled to the ledger
- Relevant period end date confirmed and the six-month first-report deadline diarised (four months in subsequent years)
- Independent qualified auditor identified and engaged early — the audit ecosystem is still gearing up under the FRC’s interim guidance, and capacity is limited
- Evidence pack pre-assembled: policies, reconciliations, resolution pack, board minutes, breach log
Where firms actually fall down
Three patterns worth calling out from the first audit cycle: reconciliations that exist but aren’t evidenced (performed daily, saved nowhere); resolution packs written once at authorisation and never touched; and ledgers where client money is only separable by manual analysis. All three are findable and fixable months before an auditor finds them.
CASS 15 checklist FAQs
How often must safeguarding reconciliations be performed under CASS 15?
At least once every business day — both an internal reconciliation of the firm's own records and an external reconciliation against safeguarding account balances. Non-standard methods require an independent auditor's report and disclosure in the firm's monthly returns.
What records should we keep for the safeguarding audit?
Dated evidence of every daily reconciliation with discrepancies investigated and resolved, ledger records that separate relevant funds from fee income and own funds throughout the period, safeguarding account acknowledgment letters, third-party due diligence, the resolution pack with its update history, REP027 submissions, and governance records such as board approvals and the breach log.
When should we start preparing for our first safeguarding audit?
Before the relevant period starts, ideally — the auditor examines whether arrangements met the rules throughout the period, not just at the year end. A gap found late in the period is already a finding; a gap found before the period starts is just a fix.
Godwin Pinto ACA (ICAI) is the founder of AccTek and a member of ICPA, with 20+ years of experience in accounting and tax for contractors, startups and SMEs. Previously at PwC.
Official guidance: the safeguarding rules are set out in the FCA’s Policy Statement PS25/12. AccTek Ltd is an independent accountancy practice and is not affiliated with the FCA or GOV.UK. This checklist is general information, not advice on your firm’s specific position.
Turn the checklist into evidence
We design the reconciliations, build the resolution pack workflows and keep your ledger audit-ready year-round — as part of our fintech accounting service.
