Home › Blog › CASS 15 insolvency data
Guardexia · Regulatory Analysis
CASS 15 and the FCA's 65% safeguarding shortfall finding
The safeguarding failures that produced PS25/12 follow a consistent pattern. Understanding that pattern — not just the obligations it generated — is what separates firms that can evidence CASS 15 controls from those that will be surprised by an audit.
Guardexia · April 2026 · 10 min read · Sources: FCA PS25/12 · CP24/20 · Financial Lives Survey 2022
In brief
- What the FCA found. Across 12 payment-firm insolvencies between Q1 2018 and Q2 2023, the FCA found an average shortfall of 65% between funds owed to customers and funds available (80% for EMIs). Source: PS25/12 §2.3.
- Why it matters operationally. The finding is used to justify continuous reconciliation, evidence and retrieval — not a one-off policy refresh.
- What a firm should examine. Whether daily reconciliations, discrepancy records, governance MI and resolution-pack evidence can be produced on demand.
The number the FCA leads with
In the twelve payment firm insolvencies that occurred between Q1 2018 and Q2 2023, the FCA found an average shortfall of 65% between funds owed to customers and funds actually available. That figure — confirmed in PS25/12 at paragraph 2.3 — is the single data point the FCA uses to justify the entire CASS 15 framework. It is worth pausing on what it means in practice.
Average shortfall between funds owed to customers and funds safeguarded across 12 UK payment firm insolvencies, Q1 2018 – Q2 2023. For EMIs specifically, the average shortfall was 80%.
FCA PS25/12, §2.3 · FCA CP24/20
A 65% shortfall does not mean firms mislaid a small amount. It means that in a typical failure, customers received less than half of what they were owed. In eight of those twelve cases, the absolute shortfall exceeded £1 million. In two, it exceeded £20 million. These are not marginal compliance gaps in otherwise functional safeguarding arrangements. They are the documented outcome of arrangements that were not functioning.
The customer impact confirms the scale of the underlying failure. In the six insolvencies that have occurred since 2021, only one resulted in any distribution to customers at all. Where funds were eventually returned, the average time to distribution was 2.3 years. A customer who relied on an e-money account for everyday transactions — the FCA's Financial Lives Survey 2022 found that 10% of UK e-money account holders transact primarily through their e-money account — waited over two years and, in most recent cases, received nothing.
This is the starting point for CASS 15. The rules exist because the previous regime produced those outcomes repeatedly. For how daily internal and external reconciliation, discrepancy ownership and review evidence work in practice, see CASS 15 safeguarding reconciliation software.
The scale that makes this a systemic issue
The same firms operating inadequate safeguarding arrangements are now operating at significantly greater scale. EMIs were safeguarding approximately £26bn in relevant funds in 2024, up from £11bn in 2021. The proportion of UK consumers using payment firms as their primary non-bank payment account rose from 1% in 2017 to 12% in 2024. The FCA also found that 40% of e-money account holders had at least one characteristic of vulnerability.
Relevant funds safeguarded by EMIs in 2024 — more than double the £11bn figure in 2021. The failures CASS 15 is designed to prevent are now occurring against a fund pool that has grown at roughly 25% per year.
FCA PS25/12
The regulatory response to that combination — recurring failures, growing scale, vulnerable consumer base — is not proportionate tightening of existing guidance. It is a codified rulebook with enforceable obligations, structured reporting, and independent audit. CASS 15 is the outcome of the FCA concluding that the industry would not self-correct.
The pattern behind the failures
The FCA's own supervisory findings, set out in CP24/20 and the Dear CEO letter of March 2023, identified the same weaknesses across repeated insolvency cases. These failures follow a consistent pattern.
Consistent failure pattern — FCA supervisory findings, CP24/20 and PS25/12
- Reconciliation without audit traceability
Firms performed reconciliations but could not produce timestamped, evidenced output on demand. The process existed; the record did not. An undocumented reconciliation cannot be distinguished from no reconciliation at all — and under CASS 15, an auditor will treat it accordingly. - Governance without real-time visibility
Boards and named SMFs had nominal responsibility for safeguarding but received no structured management information between audit cycles. Shortfalls were corrected operationally without escalation. The governing body was unaware of the compliance position it was formally responsible for. - Documentation without retrievability under time constraint
Resolution packs and account documentation existed in some form but were not maintainable within the 48-hour retrieval window the FCA now mandates under CASS 10A. Documents assembled on notice are not the same as documents maintained continuously. The distinction matters because an insolvency practitioner cannot wait for assembly to begin.
These three failure mechanisms explain both why shortfalls reached the scale they did, and why distribution took an average of 2.3 years when it happened at all. Reconciliation without traceability means shortfalls accumulate undetected. Governance without visibility means they are not escalated. Documentation without retrievability means insolvency practitioners cannot act quickly when the firm fails.
CASS 15 does not require firms to do things they were not already supposed to do. It requires them to prove they are doing them — continuously, evidentially, and under time constraint.
What CASS 15 requires
The new rules are structured across four sourcebook chapters that must be read as an integrated framework. Firms that treat them as separate workstreams will find gaps at precisely the points an auditor examines most closely.
Daily D+1 reconciliation — CASS 15
Firms must perform internal and external reconciliations on each business day, excluding weekends, public holidays, and days on which relevant foreign markets are closed. The reconciliation compares the D+1 segregation requirement — the amount that should be held — against the D+1 segregation resource — the balance actually held in relevant accounts. Any shortfall must be made good from own funds the same day. Any excess must be withdrawn. Firms must notify the FCA in writing, without delay, if they cannot perform a reconciliation or cannot resolve a material discrepancy.
Monthly FCA returns — SUP 16.14A
All in-scope firms must submit a monthly safeguarding return within 15 business days of each month-end, disclosing the safeguarding requirement, method used, reconciliation outcomes, shortfalls and remediation steps, breach details, and account and insurance or guarantee arrangements. There is no size threshold. The live SUP 16.14A regime took effect on 7 May 2026; confirm the applicable deadline in RegData and against the firm's permissions.
Annual safeguarding audit — SUP 3A
Firms that have safeguarded £100,000 or more at any point in a 53-week period must commission an annual independent audit. The auditor produces a reasonable assurance report on the adequacy of safeguarding arrangements, together with a Breaches Schedule. The first submission deadline is six months after the audit period end; subsequent audits must be submitted within four months.
Resolution pack — CASS 10A
Firms must maintain a resolution pack containing a master index, details of all institutions holding relevant funds, executed acknowledgement letters, insurance or guarantee policies, and reconciliation records — retrievable within 48 hours by the firm or an insolvency practitioner. The governing body must receive an annual compliance report on the pack.
On the monthly return
The introduction of SUP 16.14A is the most significant change to the FCA's supervisory toolkit. The regulator now holds structured, monthly data on every in-scope firm's safeguarding position. PS25/12 is explicit that this data is used for proactive, risk-based supervision — to identify firms showing early deterioration before they reach insolvency. A firm that passes its internal reconciliation but submits an inaccurate monthly return has created a documented compliance failure independently of any internal process error. See REP027 monthly safeguarding return software for how return preparation can sit on the same controlled records.
The auditor's framework: critical and supporting controls
The following framework maps the control areas a qualified auditor will assess under SUP 3A. Controls are grouped by supervisory weight. Critical controls are those where failure is likely to constitute a reportable breach and where the FCA's own findings show the highest frequency of deficiency. Supporting controls are material but typically treated as secondary in a reasonable assurance engagement.
| Control area | What good looks like | What failure looks like | Evidence expected |
|---|---|---|---|
| Critical controls — highest supervisory weight | |||
| Daily reconciliation with audit trail | Timestamped output for every reconciliation day, named owner, same-day shortfall correction from own funds with written log | Gaps in the record; reconciliation performed ad hoc; no escalation trail for exceptions or shortfalls | Reconciliation log by date, shortfall register, escalation correspondence |
| Segregation methodology | Written, board-approved methodology applied uniformly; e-money and unrelated payment services pools tracked separately where applicable | Methodology undocumented or inconsistently applied; commingling of pools where CASS 15.12 requires separation | Safeguarding policy, methodology document, account mapping |
| Breach register and FCA notification | Written register for every breach, root cause documented, FCA notified in writing without delay where required | Breaches corrected without written record; no classification of breach type; FCA notifications absent or delayed | Breach register, FCA correspondence, remediation evidence |
| SMF governance and board oversight | Named SMF with documented accountability; board receives regular MI on safeguarding status — not only at audit | No clear SMF ownership; board has no visibility between audit cycles; safeguarding treated as operational rather than governance matter | SMF responsibility map, board MI pack, attestation records |
| Supporting controls — material, assessed as part of reasonable assurance scope | |||
| Account designation and acknowledgement letters | Accounts labelled as safeguarding, held in firm's name, signed CASS 15 Annex 1 letter from every custodian bank | Missing, unsigned or incorrectly-formed letters; accounts held in agent's name; right-of-set-off not waived | Signed letters with dates, account statements confirming designation |
| Resolution pack — CASS 10A | Complete, current, retrievable within 48 hours without assembly; board annual compliance report on record | Pack assembled after request rather than maintained; missing distributor lists or outdated agreements | Indexed pack with version dates, board minutes confirming annual review |
| Third-party due diligence | Annual due diligence on all custodians, insurers and guarantors; diversification of providers assessed and documented | No documented review of custodians since appointment; concentration risk not assessed | Due diligence records by provider, annual review log |
How the regime was introduced
PS25/12 published. Final rules confirmed. CASS 10A, CASS 15, SUP 3A and SUP 16.14A effective 7 May 2026.
Gap analysis. Review safeguarding methodology, account designations, acknowledgement letters and reconciliation processes against CASS 15. Appoint auditor.
Controls implementation. Daily reconciliation workflow operational. Breach register live. Resolution pack built and indexed. Bank letters signed. Board MI framework agreed.
Dry run and board sign-off. Run daily reconciliation end-to-end. Confirm resolution pack retrieval within 48 hours without assembly. Board receives and approves CASS 10A annual report.
CASS 15 effective. All obligations live. Monthly returns commence. FCA supervisory monitoring begins on the new data set.
First audit cycle. First safeguarding audit due within six months of audit period end. Breaches Schedule and reasonable assurance report submitted to FCA.
Assessing your current position
Before making representations to an auditor about CASS 15 compliance, a firm needs to answer five questions — not as a description of process intention, but in terms of documented, evidenced reality that can be produced on demand.
- Can you produce a compliant daily reconciliation output for every reconciliation day since 7 May 2026, with a timestamped audit trail for each run?
Can you evidence this within 48 hours of a request? - Does your safeguarding methodology document correctly distinguish between e-money relevant funds and unrelated payment services pools where CASS 15.12 applies?
Is that methodology board-approved and currently in force? - Do you hold a signed acknowledgement letter in CASS 15 Annex 1 form from every institution currently holding relevant funds on your behalf?
Can you retrieve every letter within 48 hours? - Is your resolution pack complete, current, and retrievable within 48 hours — without any assembly work required after the request is received?
Has the governing body received a compliance report on it in the last 12 months? - Does your breach register contain a written record of every instance in which own funds were used to make good a safeguarding shortfall, with root cause documented?
Does the governing body receive this information between audit cycles?
If the answer to any of these is uncertain, the gap is not administrative. Under CASS 15, it is a finding that will appear in a reasonable assurance report submitted to the FCA.
Operational response in Guardexia
The current platform now connects safeguarding outputs to capital adequacy and wind-down viability: coverage ratio, staged progression, required actions, and pre-attestation risk gates. Board and regulator exports include explain-your-position fields (assumptions, buffer rationale, mitigation owner/date) so governance decisions are defensible with dated evidence.
Further operational reading
The analysis above is the primary purpose of this page. If you then want to see how daily reconciliation, discrepancy review and monthly reporting sit together, start with CASS 15 software or REP027 preparation.
CASS 15 reconciliation workflow Run the gap analysis
Sources: FCA Policy Statement PS25/12 (7 August 2025), §2.3 and passim — fca.org.uk/publication/policy/ps25-12.pdf · FCA Consultation Paper CP24/20 (September 2024) · FCA Financial Lives Survey 2022 · FCA Dear CEO Letter on safeguarding (March 2023)
Nothing in this article constitutes legal or compliance advice. Firms should seek independent legal and regulatory counsel in connection with CASS 15 implementation.