Key takeaways
- CASS 15 requires payment and e-money firms to perform an internal and an external safeguarding reconciliation at least once on every reconciliation day.
- The internal reconciliation compares what the firm owes customers (the safeguarding requirement) with what it holds for them (the safeguarding resource) at a fixed time of day.
- Where customer funds are not received directly into a safeguarding account, a second internal check, the internal deposit reconciliation, is also required.
- The external reconciliation compares the firm's own record of each safeguarding account with the statement from the bank or custodian.
- Any shortfall must be funded and any excess withdrawn by close of business on the day the reconciliation is performed, and certain failures must be notified to the FCA without delay.
What CASS 15 requires
CASS 15 is the chapter of the FCA Client Assets Sourcebook that governs how payment institutions and e-money institutions safeguard customer money. It came into force on 7 May 2026 through policy statement PS25/12. Section 15.8 sets out the records, accounts and reconciliations every safeguarding firm must keep.
The rules replace a looser expectation. Before CASS 15, firms were expected to reconcile as often as was necessary. Under CASS 15, the frequency and the method are fixed: an internal and an external reconciliation on every reconciliation day, calculated in a set way, with a record of each one. For the wider regime, see our guide to PS25/12 safeguarding.
Reconciliation days and the reconciliation point
A reconciliation day is a business day, excluding weekends, UK public holidays and days on which a relevant foreign market is closed. A firm holding US dollars, for example, should treat a US market holiday as a day on which its dollar balances cannot be confirmed in the normal way.
The reconciliation point is the fixed time of day at which the firm takes its figures, for example 17:00 UK time. Using the same time each day matters because customer balances and bank balances both move during the day. A reconciliation that compares a ledger at 09:00 with a bank statement at 17:00 will always show differences that are not real. Short answers on reconciliation days and points are collected in CASS 15 questions answered.
The internal safeguarding reconciliation
The internal safeguarding reconciliation answers one question: at the reconciliation point, was the money the firm held for customers at least equal to the money it owed them? The amount owed is the safeguarding requirement. The amount held is the safeguarding resource.
For an e-money institution, the requirement is usually the total of customer e-money balances in its own ledger, plus any funds received for unrelated payment services that have not yet been paid out. For a payment institution, it is the funds received from or for customers that have not yet reached the payee. The resource is the balance in each designated safeguarding account, plus the value of any secure liquid assets held for customers, plus any insurance or guarantee cover where that method is used.
E-money funds and payment services funds are two separate pools. A firm that runs both must calculate, reconcile and report each pool on its own, and must not use a surplus in one to cover a shortfall in the other.
| Component | Safeguarding requirement (owed) | Safeguarding resource (held) |
|---|---|---|
| E-money institution | Outstanding e-money per the ledger | Designated safeguarding account balances and secure liquid assets |
| Payment institution | Funds received and not yet paid to the payee | Designated safeguarding account balances and secure liquid assets |
| Insurance or guarantee method | Funds covered by the policy | Amount of cover in force |
The internal deposit reconciliation
Many firms do not receive customer money directly into a safeguarding account. Card settlements, for example, often land in an operating or collection account first and are moved across later. Where that happens, CASS 15 requires a second internal check, the internal deposit reconciliation.
Its purpose is to confirm that every amount of customer money received outside a safeguarding account has been identified and moved into safeguarding within the time allowed, which is the end of the business day after receipt. It is the check that catches the most common real shortfall: a settlement that arrived in the wrong account and was never swept. In the final rules this check is made through the D+1 comparison in CASS 15.8.35R, explained in our guide to D+1 segregation timing.
The external safeguarding reconciliation
The external reconciliation compares the firm's own record of each safeguarding account with the record held by the third party: the bank statement, custody statement or other confirmation. It tests whether the firm's books are right, not whether the firm holds enough. Insurance policies and guarantees are not subject to the external reconciliation.
The two checks depend on each other. An internal reconciliation is only reliable if the account balances it uses have been confirmed externally. A firm that reconciles internally against its own unconfirmed records can report a balanced position while the bank holds less.
Worked example: an external difference
An e-money institution holds customer funds at two banks and reconciles at 17:00 UK time. Its external reconciliation on a Tuesday produces the following result.
The difference sits at Bank 1. The investigation finds an outbound payment of £15,000.00 to a customer's beneficiary that the bank processed at 16:40 but that the firm's ledger recorded at 17:10, after the reconciliation point. The bank figure is correct and the firm's account record was late. The firm records the timing difference, its cause and the reviewer's approval, and confirms the item clears in the next day's reconciliation. Because customer balances were reduced by the same payment, the internal reconciliation is unaffected once both records reflect it.
A timing difference with a documented cause is acceptable. The same £15,000.00 with no cause, or a timing difference that recurs every day without a fix to the cut-off, is what an auditor reports.
| Account | Firm's record (GBP) | Bank statement (GBP) | Difference (GBP) |
|---|---|---|---|
| Safeguarding account, Bank 1 | 30,105,220.40 | 30,090,220.40 | 15,000.00 |
| Safeguarding account, Bank 2 | 18,103,150.02 | 18,103,150.02 | 0.00 |
| Total | 48,208,370.42 | 48,193,370.42 | 15,000.00 |
Correcting differences and notifying the FCA
When the internal reconciliation shows a shortfall, the firm must pay the difference into safeguarding from its own funds. When it shows an excess, the firm must withdraw it. Both must happen as soon as possible and no later than close of business on the day the reconciliation is performed. Our guide to correcting safeguarding shortfalls and excesses covers the causes and the correction process in detail.
The firm must notify the FCA without delay if it cannot perform an internal or external reconciliation, cannot fund a shortfall or withdraw an excess, or cannot resolve a discrepancy found in the external reconciliation. Each trigger is set out in notifying the FCA of a safeguarding breach.
What auditors test
The annual safeguarding audit under SUP 3A samples individual reconciliation days. For each one, the auditor expects to see the figures at the reconciliation point, the source of each figure, every difference with its cause and approval, and evidence that shortfalls were funded on time. The monthly safeguarding return must agree to the same records. Our guide to the CASS 15 safeguarding audit sets out the tests in order.
Safeheld runs the internal safeguarding, internal deposit and external reconciliations on every reconciliation day, keeps e-money and payment services pools separate, and carries each difference through investigation to approved resolution. See Safeheld reconciliation and safeguarding reconciliation software.
Frequently asked questions
How often must CASS 15 reconciliations be performed?
At least once on every reconciliation day, for both the internal and the external safeguarding reconciliation.
What is a reconciliation day?
A business day, excluding weekends, UK public holidays and days on which a relevant foreign market is closed.
What is the difference between the internal and external reconciliation?
The internal reconciliation tests whether the firm holds enough for customers. The external reconciliation tests whether the firm's records of its safeguarding accounts agree with the bank or custodian.
When is an internal deposit reconciliation required?
When customer funds are received into an account that is not a designated safeguarding account, for example an operating or collection account.
How quickly must a shortfall be corrected?
As soon as possible and no later than close of business on the day the reconciliation is performed.
References
- FCA, PS25/12: Changes to the safeguarding regime for payments and e-money firms
- FCA, Policy Statement PS25/12 (full text)
- FCA Handbook, CASS 15.8 Records, accounts and reconciliations
- FCA Handbook, SUP 16.14A Safeguarding return
- The Electronic Money Regulations 2011
- The Payment Services Regulations 2017
About Safeheld
Safeheld reconciles client money every day, resolves every difference and prepares every regulatory return for sign-off, for regulated firms in the United States, the United Kingdom, the European Union, Canada, Australia, Singapore and Hong Kong. To discuss your operations, contact us at safeheld.com/contact.
This article is for general information and does not constitute legal or regulatory advice.