By Philip Buckingham, Compliance Director, UK at IQ-EQ and Daniel Rose, Partner, Audit and Assurance at Gravita
The Financial Conduct Authority (FCA)’s proposed CASS 15 rules will impose new client money safeguarding and audit obligations on electronic money institutions (EMIs) and payment services directive firms (PSDs). Final rules are expected in Q3 2025, with implementation likely by Q1 2026. If your firm has never had a CASS audit, now is the time to assess readiness, update your systems and controls, and begin compliance planning.
The UK’s Client Assets Sourcebook (CASS) currently sets the standard for how investment firms with the relevant permissions are obliged to hold, safeguard and reconcile client money and assets. Traditionally, the most robust client money safeguarding standards have applied to investment firms under existing CASS 7 rules. But the lighter touch previously extended to e-money firms is changing.
The FCA’s proposed CASS 15 framework will bring client money safeguarding standards for e-money institutions and payment services firms toward parity with investment firms, introducing a significantly higher level of scrutiny than many of these firms have faced before. While final rules are still pending (following the close of FCA Consultation Paper CP24/20), the CASS 15 implementation date is expected to be no later than 1 January 2026. Once confirmed, firms are likely to have only a few months to be compliant with the new rules.
For those who haven’t previously been subject to a CASS audit, the arrival of CASS 15 represents a fundamental shift in what regulators will expect from your safeguarding systems, documentation, and reporting processes. In this article, we’ll cover the FCA’s proposed changes and what e-money firms should do now to prepare.
What is a CASS audit?
A CASS audit is an independent review of how your firm holds, safeguards and reports client money and assets. The FCA requires that these audits are undertaken by appropriate and regulated firms to ensure that:
- Your books and records correctly reflect and substantiate the clients for whom cash is held and reconciles to the cash held in a client account
- You have robust systems and controls in place to operate the cash as well as safeguard those funds throughout the period
Historically, e-money and payment firms haven’t needed to undergo CASS audit reports – or any audit reports – with the FCA. But under CASS 15, requirements are about to change. Audit reports and a Breaches Schedule will be reportable to the FCA at least on an annual basis, so your audit findings will soon matter more than ever.
What are the new safeguarding requirements under CASS 15?
CASS 15 introduces a substantive operational shift, aligning client money safeguarding requirements for e-money and payment providers with existing CASS 7 requirements for investment firms.
Under CASS 15, e-money firms will need to:
- Build stronger internal systems and controls to safeguard client money
- Create and maintain a CASS Resolution Pack, a set of records that lay out how client money is held and protected
- Align their operational set-up with current expectations for investment firms (e.g. continuous documentation, real-time audit readiness and enhanced FCA reporting capability)
- Appoint a suitable auditor with CASS experience and formally report that auditor to the FCA
While the final policy statement has yet to be released, these changes are expected to be finalised later this year, giving firms a very tight implementation window once the rules are applied. Understanding how CASS 15 will impact your firm – and planning sooner rather than later – is key to staying on the right side of regulators.
How can EMIs and PSDs prepare for CASS 15?
The firms that thrive under CASS 15 will be the ones that start preparing now, not just a few weeks before implementation.
Your compliance roadmap should include:
- Impact assessment: Understand which parts of your firm will be affected and how the new rules align with your current processes
- Gap analysis: Identify where your current safeguarding systems fall short of the expected standards
- Process and tech review: Evaluate whether your current tech stack and workflows are audit-friendly or require improvements
- Resolution pack preparation: Compile the required documents, including safeguarding structure, account details, reconciliations, client agreements and failure resolution protocols, so you’re ready for inspection
- Engage an auditor: Partner with a CASS-experienced auditor early to plan the process and avoid bottlenecks or last-minute surprises, ensuring your report is submitted within four months of the period end
Every action you take ahead of the finalised rules will help prevent rushed remediation, failed audits, or FCA interventions, reducing your risk and sending a strong readiness signal to clients and partners.
How Gravita and IQ-EQ can help prepare for CASS 15 audits and safeguarding compliance
Together, we help firms prepare, comply with and align to the updated CASS 15 requirements.
We provide regulatory support and compliance consulting:
- CASS 15 impact assessments
- Gap analysis and remediation planning
- Process design and improvement for safeguarding systems and controls
- Resolution Pack setup
Gravita delivers independent CASS audits:
- Plan and undertake a smooth audit to confirm compliance with CASS 15
- Client money audit report confirming compliance (or non-compliance) with CASS 15 throughout the period and the period end
- Identification and formal documentation of breaches, either firm- or auditor-identified
- Reporting and submitting audit results to the FCA
With our combined expertise, we can help you transition to CASS 15 smoothly, stay compliant and show regulators your safeguarding environment is built to last.
Ready to get ahead of CASS 15? Contact us to start your readiness plan today.
