CASS 15: Why e-money and payment firms need to act now to meet FCA requirements

With the requirements now in force, businesses must ensure they have the right systems, controls and reporting processes in place to protect customer funds and avoid potential action from the Financial Conduct Authority (FCA).

Understanding the new CASS 15 requirements

Introduced in May 2026, CASS 15 sets out new safeguarding requirements for electronic money institutions and payment services firms. These businesses are not banks, but provide services such as issuing electronic money and facilitating payments. The rules are designed to strengthen the protection of customer funds, ensuring money held by these firms is appropriately safeguarded and can be identified and returned if a business fails.

Lindsay Manson, Audit Partner, said:

The FCA’s Client Asset (CASS) 15 rules for e-money and payment firms – who are not banks, but issue electronic money and handle payments – came into effect in May 2026. Firms who have yet to fully implement processes to comply with CASS 15 need to do so as soon as possible

The introduction of CASS 15 represents an important development for the payments sector, which has grown considerably as businesses and consumers increasingly rely on digital payment platforms and electronic money services.

As the sector expands, regulators are placing greater emphasis on ensuring firms have appropriate safeguards in place. This is particularly important where customers may be holding significant sums with payment providers rather than traditional banks.

What do firms need to do to comply?

CASS 15 introduces specific obligations around how firms manage and protect customer funds. Compliance is not simply a matter of having policies in place; businesses must be able to demonstrate that their processes operate effectively.

Key requirements include:

• Regular reconciliations: Firms must reconcile customer funds to ensure records are accurate and that the money held is properly accounted for
• Safeguarding customer funds: Businesses must ensure customer money is protected in accordance with the regulatory requirements
• Safeguarding returns: Firms must submit the required regulatory returns, providing the FCA with information about their safeguarding arrangements
• Independent CASS audits: Firms that have safeguarded £100,000 or more during the previous 53 weeks must engage an auditor to conduct a CASS audit

The FCA may follow up and could take action against a firm if they have not been compliant with CASS 15. To be compliant, firms must conduct reconciliations, safeguard their customers funds, file safeguarding returns and engage an auditor to conduct CASS audits if they have safeguarded £100,000 or more during the previous 53 weeks.

For businesses, these requirements have operational as well as regulatory implications. Firms may need to review existing finance processes, invest in improved systems and ensure responsibility for safeguarding is clearly established across their organisation.

Importantly, compliance should not sit solely with the finance or compliance team. Senior management needs sufficient oversight to understand whether controls are working and whether any weaknesses could expose the business or its customers to risk.

Is there still time to address compliance gaps?

Although the rules came into effect in May, firms that have not yet fully implemented the necessary processes should not assume that it is too late to address shortcomings.

The CASS audit opinions cover compliance during the period and at the period end, therefore for some firms there may still be time to rectify any breaches for the purposes of their period end CASS opinion. Some firms have already implemented the correct systems and controls, either in anticipation of rule changes or for good governance; but other firms may have fewer controls in place.

This highlights the importance of taking a proactive approach. Businesses that identify weaknesses early may have an opportunity to improve their processes before their reporting period ends. However, addressing an issue does not necessarily remove the implications of any earlier breach, making timely professional advice important.

Why good governance matters beyond regulatory compliance

CASS 15 should not be viewed simply as another regulatory hurdle. Effective safeguarding arrangements are fundamental to maintaining customer confidence, protecting businesses from operational risks and supporting the long-term stability of the payments sector.

For customers, stronger safeguarding requirements provide greater protection over money held with electronic money and payment services providers. For businesses, demonstrating that customer funds are properly protected can help strengthen relationships with clients, banking partners, investors and regulators.

Lindsay concluded:

The sector continues to evolve and bring new challenges, and I value the opportunity to work with clients as they address these. I am excited to have joined Blick Rothenberg and look forward to working with a great team to deliver high-quality services to the financial services sector

What should payment and e-money firms do next?

With CASS 15 now in force, firms should take the opportunity to review their current arrangements and establish whether they meet the new requirements.

Businesses should consider:

1. Reviewing existing controls: Assess whether current safeguarding arrangements, reconciliations and internal processes meet CASS 15 requirements.

2. Identifying compliance gaps: Establish where processes are missing, insufficient or not operating effectively, and prioritise remedial action.

3. Checking reporting obligations: Ensure safeguarding returns are being prepared and submitted accurately and on time.

4. Assessing audit requirements: Determine whether the £100,000 safeguarding threshold has been met during the previous 53 weeks and whether a CASS audit is required.

5. Seeking specialist advice: Engage experienced audit and regulatory advisers to help assess compliance, address weaknesses and prepare for upcoming audit requirements.

Ultimately, firms should not wait for regulatory scrutiny to identify problems. Taking action now can help reduce the risk of FCA intervention, strengthen governance and ensure customer funds remain appropriately protected.

Would you like to know more?

If you have any questions about the above, please get it touch with your usual Blick Rothenberg contact or Lindsay using the form below.