By Philip Buckingham, Compliance Director, UK at IQ-EQ and Daniel Rose, Partner, Audit and Assurance at Gravita
The Financial Conduct Authority (FCA)’s CASS 15 rules impose new client money safeguarding and audit obligations on electronic money institutions (EMIs) and payment services directive (PSD) firms. The FCA published its final rules on 7 August 2025, allowing a nine-month implementation period with the rules coming into effect 7 May 2026. If your firm has never had a CASS audit, now’s the time to assess readiness, update your systems and controls, and begin compliance planning.
The UK’s Client Assets Sourcebook (CASS) currently sets the standard for how investment firms with the relevant permissions are obliged to hold, safeguard and reconcile client money and assets. Traditionally, the most robust client money safeguarding standards have applied to investment firms under existing CASS 7 rules. But the lighter touch previously extended to e-money firms is changing.
The FCA’s new CASS 15 framework will bring client money safeguarding standards for e-money institutions and payment services firms toward parity with investment firms, introducing a significantly higher level of scrutiny than many of these firms have faced before. In a nutshell, there are four key new standards expected of these firms:
- Annual CASS audits by qualified auditors
- Monthly reporting
- Daily checks to make sure the right amount of money is being safeguarded to protect customers
- Better planning in case the firm fails so customers receive their money back sooner
Following the publication of the final rules in FCA Policy Statement PS25/12, CASS 15 implementation will occur on 7 May 2026, giving firms nine months to prepare. For those who haven’t previously been subject to a CASS audit, the arrival of CASS 15 represents a fundamental shift in what regulators will expect from your safeguarding systems, documentation, and reporting processes. In this article, we dive into each of the new standards for EMIs and PSD firms and outline what should be done now to prepare.
What are the new safeguarding requirements under CASS 15?
1. Annual CASS audits by qualified auditors
2. Daily checks to ensure right amount of money is being safeguarded
3. Monthly reporting
4. Planning for firm failures
How can EMIs and PSDs prepare for CASS 15?
Under CASS 15, e-money firms will need to:
- Build stronger internal systems and controls to safeguard client money
- Create and maintain a CASS Resolution Pack, a set of records that lay out how client money is held and protected
- Align their operational set-up with current expectations for investment firms (e.g. continuous documentation, real-time audit readiness and enhanced FCA reporting capability)
- Appoint a suitable auditor with CASS experience and formally report that auditor to the FCA
Understanding how CASS 15 will impact your firm – and planning sooner rather than later – is key to staying on the right side of regulators. The firms that thrive under CASS 15 will be the ones that start preparing now, not just a few weeks before implementation.
Your compliance roadmap should include:
- Impact assessment: Understand which parts of your firm will be affected and how the new rules align with your current processes
- Gap analysis: Identify where your current safeguarding systems fall short of the expected standards
- Process and tech review: Evaluate whether your current tech stack and workflows are audit-friendly or require improvements
- Resolution pack preparation: Compile the required documents, including safeguarding structure, account details, reconciliations, client agreements and failure resolution protocols, so you’re ready for inspection
- Engage an auditor: Partner with a CASS-experienced auditor early to plan the process and avoid bottlenecks or last-minute surprises, ensuring your report is submitted within four months of the period end
Every action you take ahead of the finalised rules will help prevent rushed remediation, failed audits, or FCA interventions, reducing your risk and sending a strong readiness signal to clients and partners.
How Gravita and IQ-EQ can help prepare for CASS 15 audits and safeguarding compliance
Together, we help firms prepare, comply with and align to the updated CASS 15 requirements.
We provide regulatory support and compliance consulting:
- CASS 15 impact assessments
- Gap analysis and remediation planning
- Process design and improvement for safeguarding systems and controls
- Resolution Pack setup
Gravita delivers independent CASS audits:
- Plan and undertake a smooth audit to confirm compliance with CASS 15
- Client money audit report confirming compliance (or non-compliance) with CASS 15 throughout the period and the period end
- Identification and formal documentation of breaches, either firm- or auditor-identified
- Reporting and submitting audit results to the FCA
With our combined expertise, we can help you transition to CASS 15 smoothly, stay compliant and show regulators your safeguarding environment is built to last.
Ready to get ahead of CASS 15? Contact us to start your readiness plan today.
