Key takeaways
- CASS 15 requires firms to exercise due skill, care and diligence when selecting, appointing and reviewing the institutions that hold customer funds.
- Reviews must be performed at least annually and recorded.
- Holding all customer funds at one bank creates concentration risk: if that bank fails or freezes accounts, every customer is affected.
- Firms should consider spreading funds across institutions and documenting why the chosen spread is appropriate.
The requirement
A UK payment or e-money firm that holds customer funds at a bank, custodian or other institution relies on that institution to keep the funds safe. CASS 15 requires the firm to exercise due skill, care and diligence in selecting and appointing each institution, and to review the arrangement at least once a year. The review must be recorded, and the record forms part of the evidence the annual safeguarding auditor examines.
The rule exists because the institution is the last line of protection. If it fails, freezes the firm's accounts or exits the relationship at short notice, customer funds can be inaccessible for weeks. Several UK payment firms experienced this in recent years when banks closed safeguarding accounts with little warning.
What to assess
A due diligence file for each safeguarding institution should cover the following points, refreshed at each review.
| Area | What to record |
|---|---|
| Credit standing | Credit ratings, capital position and any adverse news |
| Regulatory status | Authorisation, regulator and any enforcement action |
| Legal arrangements | Account designation, acknowledgement letter, no set-off |
| Operational capability | Statement delivery, payment cut-offs, service levels, outages |
| Exit risk | Notice period for account closure and contingency plan |
| Concentration | Share of the firm's customer funds held there |
Diversification
Concentration risk is the risk that comes from depending on one institution. A firm with all customer funds at one bank has no fallback if that bank fails, suffers an outage or closes the account. Spreading funds across two or more institutions reduces that risk, at the cost of more reconciliations and more operational work.
Diversification is not only about credit risk. Two banks in different payment systems and time zones also give the firm a second route to pay customers if one bank has an operational outage, and a second relationship that can absorb balances if the first bank decides to exit the sector.
There is no single correct split. The firm should set its own limits, for example no more than a set percentage of customer funds at any one institution, record why those limits suit its size and model, and monitor them daily. A limit that is written down but not monitored is not a control. Firms can also reduce reliance on banks by investing in approved assets; see investing relevant funds in secure, liquid assets.
Worked example
A payment institution holds £62.0 million of customer funds. Its policy sets a maximum of 60% at any one bank. On a Monday, a large inbound settlement lifts Bank 1's share to 68%.
The firm moves £5.0 million to Bank 2 the same day, bringing Bank 1 back to 60% and recording the breach of its own limit and the correction. The movement also appears in that day's CASS 15 reconciliation, which confirms both accounts agree with the banks after the transfer.
| Institution | Before (GBP m) | Share before | After (GBP m) | Share after |
|---|---|---|---|---|
| Bank 1 | 42.2 | 68% | 37.2 | 60% |
| Bank 2 | 19.8 | 32% | 24.8 | 40% |
| Total | 62.0 | 100% | 62.0 | 100% |
How Safeheld supports it
Safeheld shows the balance and share of customer funds at each institution after every reconciliation, flags breaches of the firm's own limits, and keeps the account register and due diligence dates alongside. See acknowledgement letters, PS25/12 safeguarding and how Safeheld helps safeguarding banks.
Frequently asked questions
How often must safeguarding banks be reviewed?
At least once a year, with the review recorded.
Must customer funds be spread across several banks?
Firms must manage concentration risk. Spreading funds across institutions is the usual way, with limits the firm sets and monitors.
What belongs in a safeguarding bank due diligence file?
Credit standing, regulatory status, legal arrangements, operational capability, exit risk and concentration.
What if a safeguarding bank closes the account?
The firm needs a contingency plan and, ideally, an existing second institution that can receive the funds.
References
- FCA, PS25/12: Changes to the safeguarding regime for payments and e-money firms
- FCA Handbook, CASS 15.8 Records, accounts and reconciliations
- The Electronic Money Regulations 2011
- The Payment Services Regulations 2017
About Safeheld
Safeheld reconciles client money every day, resolves every difference and prepares every regulatory return for sign-off, for regulated firms in the United States, the United Kingdom, the European Union, Canada, Australia, Singapore and Hong Kong. To discuss your operations, contact us at safeheld.com/contact.
This article is for general information and does not constitute legal or regulatory advice.