CASS 15 safeguarding audit and monthly safeguarding return
Since 7 May 2026, every UK safeguarding institution must send the FCA a monthly safeguarding return within 15 business days of each month end. Authorised payment institutions (other than those authorised only for payment initiation or account information services) and e-money institutions must also have an external auditor deliver a safeguarding report to the FCA for each audit period of no more than 53 weeks. An institution that has not been required to safeguard more than £100,000 of relevant funds at any time over a period of at least 53 weeks (until 14 May 2027, at any time since 7 May 2026) is exempt from the audit, while the monthly return applies to all safeguarding institutions.
This page explains the rules in general terms and is not legal or regulatory advice. Check the primary source and take advice on how the rules apply to your firm.
Jurisdiction: United Kingdom · Regulator: Financial Conduct Authority
Who is in scope
- The monthly safeguarding return applies to all safeguarding institutions (SUP 16.14A.1R). The FCA lists these as authorised payment institutions, authorised e-money institutions, small e-money institutions, credit unions that issue e-money, and small payment institutions that choose to safeguard. source
- The audit chapter applies to 'relevant institutions': authorised payment institutions authorised to provide payment services other than only payment initiation or account information services, and electronic money institutions, plus their external auditors (SUP 3A.1.1R(1)). source
- An institution is exempt from the audit if it has not been required to safeguard more than £100,000 of relevant funds at any time for a period of at least 53 weeks (SUP 3A.1.1R(2)). Senior management must decide on a continuing basis whether the firm is exempt and appoint an auditor once it is not (SUP 3A.1.4G). source
- The audit applies whether relevant funds are safeguarded by segregation, by insurance or guarantee, or both (SUP 3A.1.2G). Safeguarding institutions outside the audit chapter still need adequate safeguarding arrangements, and the FCA says arranging an audit voluntarily can help them meet these obligations (SUP 3A.1.3G). source
- A firm does not have to submit a safeguarding return for the month in which it becomes a safeguarding institution (SUP 16.14A.3R(3)). source
What the rule requires
| Requirement | How often | Source |
|---|---|---|
| Submit a safeguarding return to the FCA within 15 business days of the end of each calendar month, by the electronic means the FCA provides (SUP 16.14A.3R and 16.14A.4R). The FCA says returns are submitted through My FCA using form REP027. | monthly | source |
| Appoint an external auditor, notify the FCA without delay of any actual or expected vacancy with the reason, fill any vacancy, and notify the FCA of each appointment with the auditor's name, business address and start date (SUP 3A.3.2R). The safeguarding auditor does not have to be the statutory auditor (SUP 3A.3.3G). | ongoing | source |
| The auditor prepares a safeguarding report addressed to the FCA under a reasonable assurance engagement, giving an opinion on whether the firm maintained systems adequate to comply with the relevant funds regime throughout the period and whether it complied at the end of the period (SUP 3A.9.1R and 3A.9.2R). | annual | source |
| The period covered by each safeguarding report must end not more than 53 weeks after the later of the date the firm became subject to SUP 3A, the date it stopped being exempt, or the end of the previous report's period (SUP 3A.9.6R). | annual | source |
| The auditor gives the firm a draft report with enough time to comment and sends the firm a copy of the final report at the same time as the FCA (SUP 3A.9.10R). The firm should explain the circumstances of each breach in the draft and any remedial action, before the auditor's deadline (SUP 3A.10.1G). | annual | source |
| The firm must report the final safeguarding report to its governing body (SUP 3A.10.2R). | annual | source |
Deadlines
- The auditor must deliver the safeguarding report to the FCA within 4 months of the end of the period covered (SUP 3A.9.7R). source
- Under a transitional provision, if the audit period ends within 53 weeks of 7 May 2026, the report is due within 6 months of the period end (transitional provision 3E for SUP 3A.9.7R in PS25/12). The FCA states the first audit is due within 6 months and all later audits within 4 months of the audit period end. source
- From 7 May 2026 until 14 May 2027, the audit exemption test reads 'since this rule came into force' in place of 'over a period of at least 53 weeks' (transitional provision 3D for SUP 3A.1.1R in PS25/12). source
- An auditor that expects to miss the 4-month deadline must notify the FCA before the end of that period with a full account of the reasons, and must notify promptly if it does miss it (SUP 3A.9.8R). source
- If a relevant institution fails to appoint an auditor within 28 days of being required to, the FCA can appoint one, paid for by the institution; this power does not apply where another enactment already obliges the institution to appoint an auditor (SUP 3A.3.4R). source
Records and evidence
- The safeguarding report uses the form in SUP 3A Annex 1, with Part 1 (Auditor's Opinion) and Part 2 (Breaches Schedule), and is signed in their own name by the individual with primary responsibility for the report (SUP 3A.9.3R and 3A.9.13R). It must identify each regulation or rule breached, or state that none was identified (SUP 3A.9.12R). source
- The monthly return asks for the highest and lowest safeguarding requirement in the month, and for the safeguarding resource, safeguarding requirement, their components, any excess or shortfall and the adjustments made, all taken from the last internal reconciliation in the month (safeguarding return questions 9, 10 and 16 to 21). source
- For each institution holding segregated relevant funds, the return asks for the full legal name, account type, number of accounts, total held at month end, any fixed term or notice period and the country of incorporation (question 11). It also covers relevant assets by custodian and insurance or guarantee cover, expiry and overdue premiums (questions 12 to 15). source
- The return also asks for the D+1 segregation resource and requirement, confirmation of daily internal and external reconciliations, account openings and closures with acknowledgement letter coverage, and whether any CASS 15.8.60R notification event arose (questions 22 to 30). source
- Amounts in currencies other than sterling are converted into GBP at the closing spot exchange rate for the day before the relevant date or reconciliation (safeguarding return footnotes). source
Inputs when money sits across banks, partners and wallets
| Input | What it feeds | Rule |
|---|---|---|
| Daily safeguarding requirement for every day of the month, converted to GBP | Highest and lowest safeguarding requirement in the monthly return (questions 9 and 10) | source |
| Results of the last internal reconciliation in the month: items A to D of the resource, individual balances and unallocated receipts, excess or shortfall and the adjustment made | Monthly return questions 16 to 21 (CASS 15.8.26R and 15.8.30R) | source |
| Month-end balance per bank or other institution holding relevant funds, with legal name, account type, fixed term or notice period and country of incorporation | Monthly return question 11 | source |
| Closing spot FX rate for the day before each relevant date or reconciliation, for every non-sterling currency held | GBP conversions required throughout the monthly return | source |
| Account inventory: accounts opened and closed in the month and which are covered by a countersigned acknowledgement letter | Monthly return question 28; CASS 15.7.3R requires an acknowledgement letter for each relevant funds bank account | source |
| Log of each internal and external reconciliation performed, with time, actions and outcome | Yes or no answers in return questions 26 and 27, and the auditor's assessment of compliance (CASS 15.8.9R) | source |
| Register of breaches and FCA notifications during the audit period | The auditor's breaches schedule must list each breach identified (SUP 3A.9.12R and 3A.9.14G) | source |
| Peak amount the firm was required to safeguard at any time over the test period | Determines whether the £100,000 audit exemption applies (SUP 3A.1.1R(2)) | source |
Where Polynopsis fits
Polynopsis gives finance teams one read-only, timestamped position across every bank, payout partner, exchange and wallet, which is the balance data a safeguarding reconciliation starts from. It is not safeguarding or reconciliation software, and it works alongside the tools and processes firms use to meet these rules.
Frequently asked questions
When is the first CASS 15 safeguarding audit report due?
If the audit period ends within 53 weeks of 7 May 2026, the auditor must deliver the report within 6 months of the period end. Later reports are due within 4 months of the end of the period covered.
Does the £100,000 audit exemption also remove the monthly return?
No. The exemption in SUP 3A.1.1R(2) applies only to the safeguarding audit. The monthly return in SUP 16.14A applies to all safeguarding institutions, and question 2 of the return asks whether the firm is exempt from the audit.
Does the safeguarding auditor have to be our statutory auditor?
No. SUP 3A.3.3G says the auditor appointed for the safeguarding audit does not have to be, but can be, the same auditor appointed for the statutory audit.
Which exchange rate is used for non-sterling balances in the monthly return?
The closing spot exchange rate for the day before the relevant date or reconciliation, as set out in the footnotes to the safeguarding return form.
Other rules
Sources
- SUP 16.14A Safeguarding return: safeguarding institutions · FCA Handbook
- SUP 3A.1 Application · FCA Handbook
- SUP 3A.3 Appointment of auditors · FCA Handbook
- SUP 3A.9 Duties of auditors: notification and safeguarding report · FCA Handbook
- SUP 3A.10 Review of auditor's safeguarding report · FCA Handbook
- CASS 15.7 Acknowledgement letters · FCA Handbook
- CASS 15.8 Records, accounts and reconciliations · FCA Handbook
- PS25/12: Changes to the safeguarding regime for payments and e-money firms (August 2025) · Financial Conduct Authority
- Safeguarding requirements for payment institutions and electronic (e-money) institutions (updated 7 May 2026) · Financial Conduct Authority
Know where all your money is.
Polynopsis gives cross-border payment teams one live position across every bank, payout partner, exchange and wallet, including money in flight, and warns before a corridor runs dry.