How clear are you about whether the Financial Conduct Authority’s (FCA) new safeguarding rules mean you now need an external audit?
Since 7 May 2026, new FCA safeguarding requirements have applied to payment and e-money firms. These include the introduction of CASS 15 which means there's new reconciliation, record-keeping, and resolution-pack requirements together with an external safeguarding report for firms that fall within the audit requirement.
One of the most significant changes that's come into place is who can carry out the safeguarding work. If your organisation requires an audit, you can no longer simply rely on a general regulatory consultant to provide the requisite report. The appointed auditor must meet the FCA’s eligibility, skills, resources, and experience requirements.
In this guide, we’ll explain exactly:
Here are quick links to what's covered in this post:
CASS 15 is a section of the FCA’s Client Assets Sourcebook that sets out safeguarding requirements for relevant payment and e-money firms.
It establishes a framework for how relevant funds are identified, safeguarded, recorded, and reconciled. The wider regime also introduces additional reporting and resolution-pack requirements.
These changes include:
The FCA says the safeguarding rules apply across:
Small payment institutions can opt into the safeguarding regime. There are also activity-specific exclusions, so being an FCA-regulated payment business does not automatically mean every part of the regime applies in exactly the same way.
Under SUP 3A (a chapter in the FCA Supervision Manual), relevant institutions have to appoint an external auditor unless the FCA's exemption applies. The exemption applies where the institution in question wasn't required to safeguard more than £100,000 of relevant funds at any time for at least 53 weeks.
If your firm falls within the audit requirement, an important practical change is that the auditor must meet the FCA's qualification requirements!
Firms therefore need to take reasonable steps to ensure the auditor has the appropriate skills, resources, and necessary experience to be eligible for appointment under the relevant statutory-auditor requirements.
The FCA recognised that some payment firms had previously used compliance consultants to carry out safeguarding work. Under the new regime, however, the required safeguarding report is an auditor reporting engagement rather than simply a general compliance review.
The safeguarding report required under SUP 3A is prepared as a reasonable assurance engagement.
Reasonable assurance provides a higher level of assurance than a limited assurance engagement and will typically involve more extensive work and evidence.
That distinction matters because some firms may previously have encountered safeguarding or CASS work performed on a different basis. The scope of the work required for your firm needs to be established before the engagement begins.
The safeguarding report has to address whether, in the auditor's opinion:
The report also has to identify relevant breaches if any are found.
In other words, this isn't simply a check that a reconciliation spreadsheet exists. The auditor needs sufficient evidence to form an opinion on the systems used, that they comply with the safeguarding regime, and the firm's compliance at the reporting date.
The FCA says the reporting period must end no more than 53 weeks after the relevant institution first becomes subject to SUP 3A, or after it ceases to qualify for the exemption, and the auditor must deliver the report to the FCA within four months of the period end.
If you're responsible for safeguarding within a payment or e-money firm, then consider asking yourself the following questions:
The first time you discover that your safeguarding records don't support the audit shouldn't be when the reporting deadline is approaching.
Before you appoint an auditor, consider asking:
We're a statutory firm of auditors with experience carrying out CASS assurance engagements for FCA-regulated organisations, including both limited and reasonable assurance work.
If you're unsure whether the new safeguarding audit requirements apply to your organisation, or you need to understand what an assurance engagement could involve, do get in touch with our audit team about your circumstances.
Please be aware that information provided by this blog is subject to regular legal and regulatory change. We recommend that you do not take any information held within our website or guides (eBooks) as a definitive guide to the law on the relevant matter being discussed. We suggest your course of action should be to seek legal or professional advice where necessary rather than relying on the content supplied by the author(s) of this blog.