Key takeaways
- CASS 15.2.4R requires a firm to allocate to a single director or senior manager of sufficient skill and authority the oversight of operational compliance with the safeguarding rules.
- That person must report to the governing body on that oversight, and is named in the resolution pack under CASS 10A.2.1R(10).
- Payment and e-money institutions authorised under the PSRs and EMRs are outside the Senior Managers and Certification Regime, so this is a CASS allocation rather than a senior management function.
- The governing body receives an annual CASS 10A compliance report and the final safeguarding audit report; senior management decides the audit exemption.
- Responsibility for oversight does not move the firm's own duties: the firm remains responsible for every safeguarding obligation.
What are the key facts on safeguarding responsibility?
One named director or senior manager oversees safeguarding compliance and reports to the board.
| Item | Position |
|---|---|
| Rule | CASS 15.2.4R; related duties in CASS 10A, SUP 3A and CASS 15.8 |
| Regulator | Financial Conduct Authority |
| Applies to | All safeguarding institutions |
| Reporting | To the governing body on the oversight of operational compliance; annual CASS 10A report |
| In force | 7 May 2026 |
| Last checked | 11 October 2026, against the FCA Handbook and PS25/12 |
What does CASS 15.2.4R require?
It requires the firm to give one director or senior manager responsibility for overseeing operational compliance with the safeguarding rules and for reporting on it to the governing body.
CASS 15.2.4R has three elements. The responsibility sits with a single individual, not a committee. That individual must be a director or senior manager of sufficient skill and authority. And the role is oversight of operational compliance with the relevant funds regime, the EMRs or PSRs together with CASS 15, plus reporting to the governing body on that oversight. The individual is identified in the safeguarding resolution pack under CASS 10A.2.1R(10), alongside the other people responsible for critical operational functions.
The rule sits beside the general duty in CASS 15.2.1R to maintain adequate arrangements to safeguard clients' rights and prevent relevant funds being used for the firm's own account. That duty remains the firm's. Allocating oversight to one person gives the board a clear line of accountability; it does not transfer the obligations.
Is this a senior management function under SM&CR?
No: the Senior Managers and Certification Regime applies to firms authorised under the Financial Services and Markets Act 2000, and payment and e-money institutions are authorised under the PSRs and EMRs instead, so CASS 15.2.4R creates its own allocation.
CASS 15.2.4R does not require FCA approval of the individual. Firms that are also authorised under the Financial Services and Markets Act 2000, such as credit unions issuing e-money, should map the allocation onto their existing responsibilities so that one person is clearly accountable. Groups that include an investment firm subject to CASS 7 often already have a CASS oversight role; the two allocations can sit with the same person if that person has the skill and authority for both businesses, but the records should show each allocation separately.
What does the board and senior management own?
The governing body and senior management own a set of decisions and reviews that the rules assign to them, or that need their authority.
| Duty | Rule | Frequency |
|---|---|---|
| Allocate safeguarding oversight to one director or senior manager | CASS 15.2.4R | Ongoing; update on any change |
| Receive a report on compliance with CASS 10A | CASS 10A.1.14R | At least annually |
| Receive the final safeguarding audit report | SUP 3A.10.2R | Each audit period |
| Decide whether the audit exemption applies | SUP 3A.1.4G | On a continuing basis |
| Approve safeguarding policies, including reconciliation method and review frequency | CASS 15.8.1R, 15.8.2G | On adoption and on review |
| Review investment policies for relevant assets | CASS 15.4.6R(5) | At least annually |
| Select and periodically review banks, custodians and insurers | CASS 15.6.1R, 15.6.5R | Periodically |
| Review acknowledgement letters | CASS 15.7.12R | At least annually |
| Decide whether to continue an insurance or guarantee | CASS 15.5.10R | At least 3 months before expiry |
The safeguarding audit exemption decision is explained in the £100,000 audit exemption.
What does sufficient skill and authority mean in practice?
The individual needs enough knowledge to understand the controls and enough seniority to change them, stop activity or require money to move.
The rule does not define the phrase, so firms should be able to explain their choice. In practice the person should be able to read a reconciliation and challenge its result, to require a top-up from the firm's own funds the same day, to escalate to the board without going through the people whose work they oversee, and to obtain information from finance, operations and outsourced providers. A head of finance who also runs the reconciliation team can hold the role, but the firm should then show how independent challenge is provided, for example through compliance monitoring or internal audit.
Time matters as much as title. Oversight of a daily control needs regular attention: reviewing exceptions, reading the reconciliation results, following up overdue items and preparing the board report. A director who holds the allocation alongside several other large roles should show how much time is set aside for it and who supports them. Training is the other common gap. The rules changed materially on 7 May 2026, and the individual should be able to explain the D+1 comparison, the monthly return and the notification triggers without relying on the team being overseen. A short record of relevant experience and training, kept with the allocation, answers the question an auditor or supervisor is likely to ask first.
How does oversight fit with the rest of the firm?
The responsible individual oversees; operations perform the controls, compliance monitors them and auditors test them.
| Function | Typical safeguarding role |
|---|---|
| Operations and finance | Daily reconciliations, allocation of receipts, transfers to safeguarding, account and letter administration |
| Responsible individual (CASS 15.2.4R) | Oversight of operational compliance and reporting to the governing body |
| Compliance | Monitoring of controls, breach assessment and FCA notifications |
| Internal audit, where the firm has one | Periodic independent review of the safeguarding framework |
| Safeguarding auditor (SUP 3A) | Annual reasonable assurance report to the FCA, unless the firm is exempt |
| Governing body | Allocation, policies, annual CASS 10A report, audit report and key decisions |
Outsourcing does not move responsibility. CASS 15.8.1R requires the firm's policies to cover services provided through agents and e-money distributors, and a firm that appoints a manager for relevant assets remains responsible for how those funds are invested (CASS 15.4.12R). The responsible individual's oversight should therefore reach into outsourced reconciliation, agents and asset managers.
What must be escalated, and how fast?
Several events carry a fixed or immediate deadline, so the escalation route to the responsible individual must work the same day.
| Event | Deadline | Rule |
|---|---|---|
| Shortfall found at an internal reconciliation | Corrected by the end of that day | CASS 15.8.50R, 15.8.51R |
| Any circumstance listed in CASS 15.8.60R | Written notice to the FCA without delay | CASS 15.8.60R |
| Failure to maintain or retrieve the resolution pack | Written notice to the FCA immediately | CASS 10A.1.15R |
| Insurance or guarantee with under 3 months left and no renewal | Segregation plan to the FCA | CASS 15.5.13R, 15.5.14R |
| Vacancy in the safeguarding auditor role | Notice to the FCA without delay | SUP 3A.3.2R |
What should the individual report to the board?
A regular report that lets the board see whether safeguarding worked, where it did not, and what was done about it.
Worked example. The safeguarding oversight report for an e-money institution for September 2026 reads as follows.
| Measure | September 2026 |
|---|---|
| Reconciliation days | 22 |
| Internal and external reconciliations completed on each day | 22 of 22 |
| Shortfalls found and corrected the same day | 3, totalling £41,380; largest £36,000 |
| D+1 shortfalls | 1, £8,273, corrected within the reconciliation day |
| Unallocated receipts older than one business day | 4, totalling £6,120 |
| Accounts covered by acknowledgement letters | 6 of 6 |
| Monthly return for August filed | Business day 11 of 15 |
| CASS 15.8.60R notifications made | 0 |
| Open audit or monitoring findings | 2, both on target dates |
The board can see that every reconciliation happened, that shortfalls were small and fixed the same day, and that four receipts breached the allocation deadline and need follow-up. If any measure triggered CASS 15.8.60R, the report should also show the notification sent; see notifying the FCA of a safeguarding breach. The same data supports the monthly safeguarding return.
What happens when the responsible individual changes?
The firm records the new allocation, updates the resolution pack within 5 business days and runs a structured handover.
The document identifying key individuals is part of the resolution pack under CASS 10A.2.1R(10), so a change of individual makes it materially inaccurate until corrected, and CASS 10A.1.11R allows no more than 5 business days. The governing body should approve the new allocation and the record of why the successor has sufficient skill and authority.
A useful handover covers the open breaks and their ageing, any shortfall corrected from own funds and not yet recovered, notifications made or under consideration, open audit and monitoring findings, the state of bank and custodian due diligence and acknowledgement letters, renewal dates for any insurance or guarantee, and the calendar of returns and reviews. The outgoing and incoming individuals should both sign it, so that responsibility for each open item is clear from the first day.
What should a firm check?
These steps make the allocation clear and testable.
- Record the allocation to one named director or senior manager, with the date and the governing body's approval.
- Explain in writing why that person has sufficient skill and authority.
- Name a deputy for absences, while keeping the allocation with one individual.
- Set the frequency and content of the report to the governing body, and minute its discussion.
- Update the resolution pack within 5 business days of any change in the individual.
- Diary the annual CASS 10A report, the acknowledgement letter review and the investment policy review.
- Align the allocation with any SM&CR or CASS 7 responsibilities elsewhere in the group.
Our safeguarding policy template shows where the allocation sits in the firm's written arrangements.
How does Safeheld help?
Safeheld gives the responsible individual the daily evidence the board report draws on: reconciliation results, breaks and how they were resolved, funding actions and approvals.
Top-ups and withdrawals are routed for approval before money moves, so the oversight record shows who decided what. See audit evidence and our CASS 15 and PS25/12 guide.
Frequently asked questions
Who is responsible for safeguarding under CASS 15?
The firm remains responsible for all obligations, but CASS 15.2.4R requires it to allocate oversight of operational compliance to a single director or senior manager of sufficient skill and authority.
Is the safeguarding oversight role a senior management function?
No. Payment and e-money institutions authorised under the PSRs and EMRs are not within SM&CR, and CASS 15.2.4R does not require FCA approval of the individual.
Can the responsibility be shared by a committee?
No. CASS 15.2.4R requires allocation to a single director or senior manager. A committee can support the individual but cannot hold the allocation.
Who must the individual report to?
To the firm's governing body, on the oversight of operational compliance with the safeguarding rules.
What must the governing body receive each year?
A report on compliance with CASS 10A at least annually, and the final safeguarding audit report for each audit period.
Who decides whether the firm is exempt from the safeguarding audit?
Senior management, on a continuing basis, under SUP 3A.1.4G.
Does outsourcing reconciliation move safeguarding responsibility?
No. The firm remains responsible for compliance, including for services provided through agents, distributors and asset managers, and the responsible individual's oversight should cover them.
References
- FCA Handbook, CASS 15.2 Organisational requirements
- FCA Handbook, CASS 10A Payment services and electronic money: resolution pack
- FCA Handbook, CASS 15.4 Segregation: secure, liquid assets
- FCA Handbook, CASS 15.5 The insurance or guarantee method
- FCA Handbook, CASS 15.6 Selection and appointment of third parties
- FCA Handbook, CASS 15.7 Acknowledgement letters
- FCA Handbook, CASS 15.8 Records, accounts and reconciliations
- FCA Handbook, SUP 3A.1 Application
About Safeheld
Safeheld is reconciliation and regulatory financial control software for regulated firms that hold client money. It records every reconciliation, break, resolution and approval, giving the individual responsible for safeguarding oversight a complete daily record to report from. To discuss your safeguarding operations, contact us at safeheld.com/contact.
This article is general information on the UK safeguarding rules and is not legal or regulatory advice.