When Must a Firm Notify the FCA of a Safeguarding Breach?

Key takeaways

• CASS 15.8.60R lists six circumstances in which a safeguarding institution must inform the FCA in writing without delay.
• Several triggers are forward-looking: the firm must notify when it will be unable to perform a reconciliation or correct a shortfall, not only after it has failed.
• The FCA has not defined material or set a fixed time limit, so firms need a documented way of judging both.
• Other rules carry their own notification duties, including CASS 10A.1.15R for the resolution pack and CASS 15.5 for insurance and guarantees.
• Every month, questions 29 and 30 of the safeguarding return ask whether a CASS 15.8.60R circumstance arose and whether the firm notified.

What are the key facts on breach notification?

A safeguarding institution must tell the FCA in writing, without delay, when one of the six circumstances in CASS 15.8.60R arises.

What are the six notification triggers?

The six triggers cover records, the two reconciliations, correcting differences and historical errors in the amount safeguarded.

The full text is in CASS 15.8.60R. Four of the six use the words "will be unable to", so the duty can arise before the failure. A firm that knows at 14:00 that a statement will not arrive should not wait for the reconciliation to fail before telling the FCA.

What do without delay and material mean?

Neither term is defined, so the firm must apply a reasoned, recorded judgement and act quickly.

PS25/12 confirms that firms must inform the FCA of the matters in the rules without delay, and the FCA did not define material or set a fixed period (PS25/12, paragraphs 3.3 and 3.6). In practice, without delay means as soon as the firm has enough information to describe the issue, not after the root cause analysis is complete. A short first notice can be followed by an update. Waiting for certainty usually makes the notice later without making it more useful, because the FCA's first questions are about the size of the issue and whether customer money is protected, and those can normally be answered within hours.

Materiality is a judgement about the size of the issue against the safeguarding requirement, its duration, the number of customers affected, whether it recurred and whether it reveals a control failure. A firm should set out its approach in its safeguarding policy, apply it consistently and record each decision, including decisions not to notify. A good test is whether the individual responsible for safeguarding oversight would be comfortable explaining the decision to the FCA and the auditor later.

Which other safeguarding events need notifying?

Several other rules carry their own notification duties, with different timing.

Auditors have their own channel. SUP 3A.8.10G notes that a failure to safeguard relevant funds will usually be of material significance and should be communicated to the FCA by the auditor. A firm should assume that what its auditor finds may reach the FCA independently, which is a further reason to notify promptly itself.

Which breaches are recorded but not always notified?

Many safeguarding breaches are corrected the same day and fall outside CASS 15.8.60R, but every one still belongs in the breach log.

A shortfall found at an internal reconciliation and paid in by the end of that day has been dealt with as CASS 15.8.50R requires, so trigger (3) is not met. A receipt allocated a day late, or a D+1 transfer made a day late and caught by the next comparison, are breaches of the allocation and segregation rules but are not themselves listed in CASS 15.8.60R. The firm records each one with its cause, amount, duration and correction, and reviews the log for patterns.

Patterns change the answer. Repeated late transfers can mean the firm's records or reconciliation process are not working as designed, and a review that finds the safeguarded amount was regularly too low can bring trigger (6) into play. The auditor will also see the log: the safeguarding report includes a schedule of every breach identified, whether or not it was notified. A firm that records small breaches consistently is better placed to show its notification judgements were sound.

How should a notification be made, and what should it contain?

The rule requires writing; the content should let the FCA understand the issue without a follow-up call.

• What happened, which CASS 15.8.60R limb or other rule applies, and when the firm became aware.
• The amount involved, the pools and currencies affected and the number of customers, as far as known.
• Whether customer money is at risk, and what has already been done to protect it, such as a top-up from own funds.
• The cause, if known, or the steps under way to find it.
• The remediation plan, owners and dates, and when the firm will update the FCA.
• The name of the individual responsible for safeguarding oversight and a contact for questions.

Keep a copy of every notification with the breach log, because question 30 of the monthly safeguarding return asks whether the firm complied with the notification requirements, and the auditor's schedule of breaches under SUP 3A.9.12R will draw on the same record.

What does a notification decision look like in practice?

Two examples show a forward-looking trigger and a historical one.

Example 1. On Tuesday at 08:30 an e-money institution learns that Bank B, which holds £14,602,930 of relevant funds, has a system outage and cannot provide statements for Monday or Tuesday.

Example 2. A monitoring review finds that for 3 months the firm deducted monthly fees from client balances five days before they were due. The average understatement of the safeguarding requirement was £210,000 against an average requirement of £48,000,000, about 0.44%, and the firm's own funds always covered it. The firm assesses CASS 15.8.60R(6): the error lasted months, affected every fee-paying customer and reveals a control design failure. It concludes the difference is material, notifies the FCA in writing, corrects the deduction timing and records the decision and its reasons.

What happens after a notification?

The firm corrects the issue, finds and fixes the cause, and keeps the FCA updated until the matter is closed.

CASS 15.8.55G expects a firm whose discrepancy results from a breach to take steps to prevent it happening again. The event goes into the breach log, the board report prepared by the individual responsible for safeguarding and the next monthly return. Where a shortfall was involved, our guide to safeguarding shortfalls and excesses covers the correction itself.

What should a firm check?

These controls make notification decisions fast and consistent.

• Map each CASS 15.8.60R trigger to the control that would detect it and the person who decides.
• Define the firm's materiality approach in its safeguarding policy, with worked thresholds.
• Record every decision, including decisions not to notify, with the reasons and the approver.
• Treat a known future failure, such as a missing statement, as a trigger now.
• Keep a written notification template so a first notice can go out the same day.
• Track insurance and guarantee renewal dates against the 2 month and 3 month deadlines.
• Agree questions 29 and 30 of each monthly return to the breach log.
• Diary the CASS 10A resolution pack checks, since a failure there must be notified immediately.

How does Safeheld help?

Safeheld raises every reconciliation difference as a break with a time stamp, an owner and an investigation trail, so the facts a notification needs are already recorded.

Autopilot closes routine differences and AI investigation proposes causes for the rest, with people approving the outcome. See break resolution, the safeguarding resolution pack and our CASS 15 and PS25/12 guide.

Frequently asked questions

When must a firm notify the FCA of a safeguarding breach?

Without delay, in writing, when any of the six circumstances in CASS 15.8.60R arises. Other rules, such as CASS 10A.1.15R, have their own timing.

What are the CASS 15.8.60R triggers?

Materially inaccurate records, being unable to or materially failing to perform internal or external reconciliations, correct a shortfall or excess, or resolve a discrepancy, and discovering a material difference in the amount safeguarded in the previous 12 months.

Does the FCA define a material breach?

No. PS25/12 confirms the FCA did not define material, so firms need a documented approach to judging it.

Must a firm notify before a failure happens?

Often, yes. Four triggers apply when the firm will be unable to perform a duty, so a known future failure is notifiable now.

How quickly must resolution pack failures be notified?

Immediately, in writing, under CASS 10A.1.15R.

Does the monthly return ask about breaches?

Yes. Question 29 asks whether a CASS 15.8.60R circumstance arose in the month and question 30 whether the firm complied with the notification requirement.

Will the safeguarding auditor tell the FCA about breaches?

The auditor reports breaches in its report to the FCA, and SUP 3A.8.10G notes that a failure to safeguard will usually be of material significance and should be communicated to the FCA.

References

• FCA Handbook, CASS 15.8 Records, accounts and reconciliations
• FCA Handbook, CASS 10A Payment services and electronic money: resolution pack
• FCA Handbook, CASS 15.5 The insurance or guarantee method
• FCA Handbook, SUP 3A.3 Appointment of auditors
• FCA Handbook, SUP 3A.9 Duties of auditors: safeguarding report
• FCA, PS25/12: Changes to the safeguarding regime for payments and e-money firms (PDF)

About Safeheld

Safeheld is reconciliation and regulatory financial control software for regulated firms that hold client money. It records every reconciliation, break, investigation and approval, so a firm can decide quickly whether an event must be notified to the FCA and evidence what it did. To discuss your safeguarding operations, contact us at safeheld.com/contact.

This article is general information on the UK safeguarding rules and is not legal or regulatory advice.