In short
A safeguarding breach detection capability has to do three things: identify a shortfall or excess at the point the reconciliation reveals it, route it to a named individual under a threshold the firm has actually calibrated, and leave a record showing when it was found, who was told, and what they did. Speed matters because CASS 15 requires prompt correction of any discrepancy, and the interval between a shortfall arising and its correction is the period during which client money is genuinely at risk.
Detection is not the same thing as a dashboard
A surprising number of firms describe their breach detection as a report that shows red when a reconciliation does not balance. That is monitoring after the fact, not detection. Detection means the moment a variance appears, it is classified, sized against a materiality threshold, and pushed to someone with the authority to act, without waiting for a person to open a spreadsheet and notice.
The distinction matters because CASS 15 does not simply require a firm to reconcile. It requires prompt correction of any shortfall or excess identified through internal and external reconciliation, and CASS 15.2.4R requires the firm to allocate to a director or senior manager of sufficient skill and authority responsibility for oversight of safeguarding compliance and reporting to the governing body. A dashboard nobody is accountable for reviewing on a defined cadence does not satisfy either point. An escalation path with a named owner, a trigger, and a clock does.
This is also the seam an annual safeguarding audit tests. Under SUP 3A.9.2R the auditor is required to form and report an opinion on whether the firm's systems and controls were adequate to ensure compliance with the safeguarding rules throughout the period covered, not merely on the day of the visit. A firm that can produce one clean reconciliation on request but cannot show that every discrepancy in the preceding twelve months was found, escalated and closed has not answered the question the auditor is asking.
Setting materiality thresholds that actually do something
Every reconciliation of real payment or e-money flows produces small differences that are timing, not risk: a settlement in transit, a fee posted a day early, a scheme reporting net where the ledger records gross. Treating every one of these as an escalation trains staff to ignore alerts, and an ignored alert is worse than no alert because it evidences a control the firm demonstrably does not operate.
The alternative is not a single blanket tolerance. It is a threshold structure that reflects how a variance actually behaves: a value below which an item is logged and aged rather than escalated, a value above which a named individual is notified within a defined interval, and a value or persistence condition above that which escalates to the senior manager accountable under CASS 15.2.4R and, where the firm judges the position material, informs its consideration of a Principle 11 notification to the FCA. Persistence should sit alongside value in the design, because a small variance that has not cleared after its expected ageing window is a different risk from a small variance that clears the same day.
Thresholds calibrated once and never revisited are a common failure. As transaction volume, counterparty mix or settlement corridors change, a threshold set for a smaller book either escalates constantly or stops catching anything meaningful. The threshold structure should be reviewed by the senior manager with oversight responsibility, and that review should itself be evidenced, because it is exactly the kind of live oversight SUP 3A.9.2R examines.
A worked example: the difference an hour makes
Consider an EMI whose external reconciliation depends on a daily acquirer settlement file that normally lands by seven in the morning. On one occasion the file arrives four hours late, and when it does, it shows a shortfall against the ledger that has existed since a settlement failure the previous evening.
Under a batch process where reconciliation runs once, at a fixed time, on whatever data has arrived, that shortfall is discovered whenever the operator next looks, which in a lean team can easily mean the following business day. Under an event-driven process, the late arrival of the file itself is a flagged exception the moment its expected delivery window passes, and the shortfall it eventually reveals is tested and routed within minutes of the file landing rather than at the next scheduled review.
The regulatory obligation is identical in both cases: correct the shortfall promptly from the firm's own resources and evidence the correction. What differs is how long client money sits short before anyone with authority knows about it, and how the firm can answer a supervisor who asks what happened between the failed settlement and the funding transfer. A firm relying on scheduled batch review is answering that question from memory and a workbook. A firm with event-driven detection is answering it from a timestamped record.
What a detection event has to leave behind
A detection event that cannot be reconstructed afterwards is of limited value at audit, however fast it was in the moment. The record should tie together the reconciliation run that produced the variance, the classification applied to it, the threshold it triggered, the individual notified, the time of notification, the decision taken, and the eventual resolution with its own timestamp.
Firms frequently capture the identification well and lose the response. A break is logged in a workbook, a message is sent to a manager, a transfer is made from treasury, and none of those three steps refers back to the others. Reconstructing the sequence for an auditor then depends on institutional memory rather than a record, which is precisely the weakness SUP 3A.9.2R is designed to surface.
The more resilient design treats the variance, the escalation, and the correction as one linked object rather than three separate systems that happen to relate to the same event. Whether that object lives in a workbook with disciplined cross-referencing or in a purpose-built platform, the test is the same: can the full sequence be produced for an arbitrary historic date without anyone reconstructing it from memory.
Interrogating a vendor's detection claims before you buy
Vendors describe detection capability in similar language, and the differences only show up under specific questioning. Ask to see what happens when a data source stops reporting rather than when it reports a bad value: a platform that treats a missing file as a clean reconciliation over an incomplete population has a coverage gap, not a detection capability.
Ask whether internal and external reconciliation are detected and escalated as distinct events. CASS 15 treats them as separate obligations, and a platform that collapses both into one match run cannot tell an auditor whether a variance originated in the firm's own records or in a third party's confirmed balance, which changes whether it is a bookkeeping matter or a shortfall requiring immediate correction.
Ask whether escalation thresholds and recipients are configurable by the firm or fixed by the vendor. A firm's accountability map is specific to it, and CASS 15.2.4R requires a named senior manager, not a generic alert list. Ask how the platform documents the review of those thresholds over time, since a threshold set once at onboarding and never revisited is itself a finding waiting to happen.
Finally, ask what the platform produces when asked for evidence of every detection event in the preceding twelve months, not just the current quarter. That request is a reasonable proxy for what an annual safeguarding audit will ask, and a vendor that needs an engineering effort to answer it is telling you something about how the underlying data is organised.
How Safeheld structures detection and escalation
Safeheld tests every reconciled event against firm-configured materiality and persistence thresholds at the moment the underlying data arrives, rather than at a scheduled batch time, and treats a source that has stopped reporting as an exception in its own right rather than an absent line in a clean-looking reconciliation.
Escalations route to the individuals the firm has named against its own accountability map, with the trigger, the recipient, the time of notification, and the eventual resolution recorded against the reconciliation run that produced the variance. Each run is sealed at the point it executes, so the sequence from detection to correction can be produced for any historic date without reconstruction.
Frequently asked questions
How fast does the FCA require a safeguarding breach to be detected?
The CASS 15 rules do not specify a detection speed in hours. They require prompt correction of any shortfall or excess identified through the required internal and external reconciliations, with CASS 15.2.4R placing oversight of safeguarding compliance with a named director or senior manager. Firms should not assert a specific notification deadline that is not stated in the rules; the safer framing is that the interval between a shortfall arising and its correction is the period of genuine risk, and shorter is always better evidenced.
What is the difference between a materiality threshold and an escalation trigger?
A materiality threshold sizes a variance to decide whether it warrants attention at all. An escalation trigger determines who is told and how quickly once that threshold is crossed. Firms that only set the first end up with a list of flagged items nobody owns; the second is what turns detection into action.
Does the annual safeguarding audit test detection, or just correction?
Both. SUP 3A.9.2R requires the auditor's opinion to cover whether the firm's systems and controls were adequate throughout the period, not on a single sampled date. That means the auditor can reasonably ask for evidence that every discrepancy across the year was detected, escalated to the right person, and closed, not just that the firm's reconciliations balance today.
When does a detected shortfall become something the FCA needs to know about?
That is a judgement for the firm's senior management under its own escalation framework and, where relevant, Principle 11's requirement to deal with the regulator in an open and cooperative way. The detection system's job is to make sure that judgement is made promptly by the right person, with the facts in front of them, rather than discovered too late for it to be made at all.