Webinar on The New Safeguarding Frontier
Published on: 07/05/2026 00:00
Read the summary of CASS 15 Regulations and 2026 Audit Requirements from the MHA and Pathlight Associates webinar briefing held on 7th May 2026
Context: Why the Change?
The shift from the ‘Approach Document’ to the prescriptive CASS 15 regime is driven by historical failures. Analysis of recent insolvencies showed that firms under the old safeguarding rules often faced shortfalls of 20-40% in customer funds. In contrast, firms
under the more rigorous CASS rules typically saw shortfalls of less than 5%. The FCA’s goal is to close this gap by introducing enforceable law rather than just ‘best practice’ guidance.
Governance and Personal Liability
The regime introduces the Single Responsible Director (SRD). This role is not merely administrative; it carries significant weight under the Senior Managers and Certification Regime (SM&CR).
Key Accountability Requirements:
– The SRD is personally responsible for the integrity of customer funds and must
review monthly RegData returns.
– Firms must demonstrate ‘unfettered access’ for auditors, meaning systems must be
open and transparent.
– Boards must move beyond high-level oversight to active monitoring of ‘safeguarding
culture’.
The Audit Revolution (SUP 3A)
Annual safeguarding audits are now mandatory. The focus has shifted from a ‘point-in-time’ check to ‘reasonable assurance’ that systems and controls were adequate throughout the entire reporting period.
Specifics for Compliance:
– Auditors must be ‘Statutory Auditors’ under the Companies Act 2006. Reports from consultancies are no longer sufficient.
– Standardised Reporting: The FRC has issued interim guidance to ensure all audit reports follow a consistent format.
– Non-Standard Reconciliations: If your firm uses a bespoke reconciliation method, the auditor must sign off on the methodology before it is implemented.
– Material Significance: The threshold for reporting breaches has been lowered. Any failure to safeguard is considered ‘materially significant’ and must be included in the breaches schedule.
Operational Requirements & Reconciliation
The ‘D+1’ rule is the new operational benchmark. This requires funds to be segregated or invested by the close of the next business day.
Practical Operational Challenges:
– Defining ‘End of Day’: Firms must clearly document their cut-off times. This is especially critical for firms operating across multiple time zones to avoid reconciliation breaks.
– -Funds in Transit: There is a legal distinction now that firms are ‘Statutory Trustees’. Money moving through the system must be accounted for within the trust environment.
– Direct Receipt Challenge: Ensuring that funds received directly into non-safeguarded accounts are swept into the correct environment by D+1.
The Resolution Pack (CASS 10A)
The Resolution Pack is a ‘living document’ designed to allow an Insolvency Practitioner (IP) to return funds within 48-72 hours. The FCA treats the inability to produce this pack within 48 hours as a major supervisory failure.
Common Pitfalls include amongst others:
– The ‘Friday 4:30 PM’ request: The FCA frequently issues requests just before the weekend to test resilience.
– Formatting errors: Simple mistakes like incorrect phone number formats or outdated bank mandates can lead to the pack being rejected.
– The ‘IP Drill’: Firms are encouraged to perform ‘dry runs’ to ensure that an IP could actually use the data provided to distribute funds.
Resilience, DORA, and Fraud
Digital Operational Resilience (DORA):
– Third-party reconciliation software is now considered a ‘material reliance’. Firms must have alternative manual or secondary arrangements in case of a software outage.
– APP Fraud Tensions:
– New rules allow for 4-day delays on suspicious payments. Firms must have a clear policy on whether these ‘held’ funds remain within the safeguarding perimeter.
Implementation Timeline (9-Month Runway)
Q3 2025: Formally minute the SRD appointment and board-level responsibilities.
Q4 2025: Gap analysis on D+1 capabilities and ‘dry run’ of the Resolution Pack.
Q1 2026: Update Bank Acknowledgement Letters to match the new, strict FCA
templates.
7 May 2026: CASS 15 Go-Live.
July 2026: Submission of the first monthly RegData returns.
