In short
A CASS 15 resolution pack, required under CASS 10A, is the current set of records that lets an insolvency practitioner or the FCA identify relevant funds and the customers entitled to them quickly enough to make a distribution practicable. A compliant safeguarding evidence pack is the broader record set, tying together reconciliation results, correction records, breach timelines and governance sign-offs for a defined period, in a form that lets an external auditor test the SUP 3A opinion and lets a firm assemble the resolution pack on demand. Evidence generated at the point each action occurs is materially stronger than evidence reconstructed for a scheduled audit or a sudden resolution pack request, because the latter is tested for gaps by the very people relying on it.
Two ways of arriving at the same file
A firm can produce its evidence pack in one of two ways. It can operate its safeguarding programme through the year and then, in the weeks before the SUP 3A audit or a supervisory request, go back through reconciliation files, correspondence and sign-off records to reconstruct what happened. Or it can capture the record at the moment each action takes place, so that by the time the audit is scheduled, the pack already exists and only needs to be scoped to the relevant period.
The distinction matters because of when the evidence was created relative to when it is tested. A record assembled under audit pressure is being built by the same people whose work it is meant to corroborate, often weeks or months after the events it describes. Gaps surface at exactly the point they are least convenient: a reconciliation from an earlier quarter without a recorded reviewer, a breach resolution with no note of who approved the funding used to correct it, a sign-off that happened by email and was never logged in the system of record.
Reconstruction is not dishonest, but it is weaker evidence. An auditor forming the SUP 3A opinion, or the FCA reviewing a firm's response to an incident, is entitled to ask whether a record was created at the time of the underlying event or afterwards, and the answer changes how much weight the record carries. This is the strongest practical argument for building evidence continuously rather than assembling it periodically: it is not about convenience, it is about the credibility of what ends up in the pack.
What the SUP 3A audit is actually testing
Under SUP 3A.9.2R, the external safeguarding auditor must state whether the firm complied with the relevant funds rules at the reporting date and whether it maintained systems and controls adequate to secure that compliance throughout the period under review, not only at the period end. That second limb is the one periodic evidence assembly struggles with, because a snapshot taken at year end says nothing about whether reconciliation was performed correctly every business day in between.
In practice this means the auditor will sample across the period, not just at the boundary. They will want to see reconciliation results for specific dates chosen by them rather than by the firm, the correction records for any shortfall or excess identified in that sample, and the governance record showing who reviewed and approved each step. A firm that can produce any date's evidence with the same completeness as year end has answered the throughout-the-period question directly. A firm that has to go and find it has already raised a question about reliability before the substance is even examined.
The audit report itself becomes part of the following year's evidence base. Where the auditor qualifies the opinion or notes a limitation, the firm's response to that finding, what changed, when, and who signed it off, is exactly the kind of record that needs to exist as a discrete, attributable event rather than a paragraph added retrospectively to a board minute.
The CASS 10A resolution pack: what it must contain and why documents drift
CASS 10A requires firms in scope of the supplementary safeguarding regime to maintain a resolution pack. Its purpose is narrow and practical: to let an insolvency practitioner, stepping into a failed firm with no prior knowledge of its systems, identify relevant funds and the customers entitled to them quickly enough for a distribution to be practicable. Speed after failure is the entire point; a pack that is accurate but takes weeks to interpret has not really served its purpose. For the wider regulatory context behind this obligation, see our guide to the regime at CASS 15 and PS25/12: The Complete Safeguarding Guide.
What must be current, specifically, is: signed mandates and account details for every bank and safeguarding institution holding relevant funds; counterparty and agent details, including any distributor or sub-agent chain; customer entitlement data sufficient to calculate who is owed what; a plain description of the safeguarding method or methods in use, including which relevant funds sit in which arrangement; and the key personnel and systems an insolvency practitioner would need to contact or access to actually locate and release the funds. A pack missing any one of these forces a practitioner to go looking, which is exactly the delay CASS 10A exists to prevent.
The standard the rule sets is that the pack must be kept current and producible on request, not merely reviewed periodically. That is a materially higher bar than an annual refresh. A signatory who leaves, a safeguarding account that is closed and replaced, or a new distributor coming onto the platform are all events that make the previous pack wrong from that day, not from the next scheduled review.
This is where an assembled document set and a pack generated from live operational data diverge sharply. A document assembled once and updated on a calendar cannot help but drift, because nobody remembers to open it the day an account changes; it describes how things used to be arranged rather than how they are arranged now. A pack derived directly from the same configuration and reconciliation data that drives day-to-day safeguarding cannot drift in the same way, because there is no separate static artefact to fall behind: updating the operating record updates the pack. For the audit engagement that tests the same underlying evidence, see The CASS 15 Safeguarding Audit: What SUP 3A Tests and How to Prepare.
What a compliant evidence pack actually contains
A defensible pack for a given period contains reconciliation results for each cycle, including matched items, unmatched items and the variance analysis performed on them; the correction record for every shortfall or excess, showing when it was identified, what was funded or withdrawn to resolve it, and who authorised that action; the governance sign-offs attached to each of these steps; and, where relevant, the policy or procedure the firm was applying at the time, because rules and internal thresholds change and a record needs to show which version applied on a given date.
The internal consistency of these elements matters as much as their individual completeness. Reconciliation results that do not match the figures behind a monthly safeguarding return, or a correction record that references a shortfall not visible in the reconciliation output, are the most common findings in both audit engagements and supervisory reviews, and they are findings about record-keeping rather than about the underlying safeguarding, which does not make them less serious.
The evidential weight of a correction record specifically deserves attention. CASS 15 requires prompt correction of any shortfall or excess identified through reconciliation, and the FCA's stated expectation is that this happens each business day. The record that matters here is not just that the correction happened, but the interval between detection and correction, who approved the funding, and whether that approval followed the firm's own escalation policy. A pack that shows the correction occurred but not the interval or the authority behind it has not actually evidenced compliance with the correction obligation.
Where evidence packs fall apart in practice
The most frequent gap is missing attribution: the reconciliation happened, but there is no record of who reviewed it, only that the compliance team did. Regulators and auditors treat unattributed review as equivalent to no review, because there is no way to test whether the review was independent of the person who prepared the reconciliation.
A second recurring gap is the breach record that stops at detection. The pack shows a shortfall was identified but the trail goes cold before the resolution: no note of the amount funded, no timestamp for when it cleared, no record of the individual who authorised it. Auditors sampling this kind of record will treat the absence of a resolution trail as a control gap regardless of whether the shortfall was, in fact, corrected promptly.
A third is version drift between the reporting figures and the underlying reconciliation. Where a monthly safeguarding return, a board pack and the audit sample disagree on the same balance for the same date, the finding is about the integrity of the records rather than about which number happened to be correct. Our guide to safeguarding regulatory reporting at /platform/report covers why returns should be generated from the same reconciled position rather than assembled separately, and the same principle applies to evidence packs.
How Safeheld supports evidence pack production
Safeheld records reconciliation results, correction actions and governance sign-offs as they happen, with user attribution and a timestamp attached to each. Because the underlying record is captured continuously rather than compiled for an audit, an evidence pack for any period, or a point-in-time extract for a CASS 10A resolution pack, can be produced by selecting the scope rather than by rebuilding the trail from source systems.
Each record is hash-sealed at the point of creation, which lets a firm or its auditor confirm that a record produced for review matches what was captured at the time, rather than relying on assurances that nothing was edited afterwards.
Frequently asked questions
What must a CASS 15 resolution pack contain?
It must contain current bank and safeguarding institution mandates, counterparty and agent details, customer entitlement data, a description of the safeguarding arrangements in use, and the key personnel and systems needed to locate and release relevant funds, so an insolvency practitioner can act on it without first reconstructing the firm's records.
How current must a CASS 10A resolution pack be?
It must be kept current and producible on request, not merely reviewed on a periodic cycle. Any change to a safeguarding account, signatory, counterparty or safeguarding method should be reflected in the pack from the date it happens, which is only practical when the pack is derived from live operational data.
Does an evidence pack need to be produced for every reconciliation cycle?
No. The pack is assembled for a defined review period, whether that is a SUP 3A audit, a supervisory request or a point-in-time resolution pack extract. What needs to happen at every cycle is the capture of the underlying record, so that any later period can be evidenced without gaps.
What does the SUP 3A audit actually test that a snapshot would not?
SUP 3A.9.2R requires the auditor to opine on whether the firm maintained adequate systems throughout the period, not only at the period end. That requires evidence sampled across the period, which a single year-end snapshot cannot provide.
Is the CASS 10A resolution pack the same document as the audit evidence pack?
No. The resolution pack is a live, point-in-time record intended to let an administrator or the FCA identify and distribute relevant funds promptly on failure. The audit pack demonstrates compliance over a historic period. They draw on overlapping data but serve different purposes.
What is the single most common finding in evidence pack reviews?
Missing or unattributed review of reconciliation results, closely followed by correction records that show a shortfall was identified but not when or by whom it was resolved.