CASS Iain Colquhoun, November 2026
The FCA's interim safeguarding rules for payment and e-money firms took effect in May 2026. Six months in, the policy debate has moved on to the end state and the transition to a CASS-style regime. The daily work has not moved on at all. It has become routine, and routine is where the problems hide. This note is for the people who run the reconciliations, not the people who wrote the rules.
What changed in practice
The reconciliation became the evidence. Before CASS 15, safeguarding reconciliation at many firms was a finance control run when someone had time. It is now a regulatory record. The internal reconciliation of relevant funds against the firm's own records and the external reconciliation against the safeguarding accounts have to happen on a defined cadence, with discrepancies identified, explained and resolved within the timescale the rules set. If you cannot show the reconciliation ran, as far as the regulator is concerned it did not.
Monthly reporting arrived. The first REP027 safeguarding return landed in July 2026 and it is now monthly, every month, for good. The form is the easy part. The hard part is that every figure on it has to agree back to a reconciliation that someone can produce on request. Firms that built the return by hand from spreadsheets in July are discovering that the same work comes round again every fifteen business days.
The audit changed shape. The annual safeguarding audit under SUP 3 now reads reconciliation output against the rules. Auditors are asking for the full population of breaks over the period, not a sample from the month before the fieldwork. They are asking how the resolution timescale was evidenced, and they are starting to ask how any model-driven or automated matching inside the reconciliation is controlled and explained.
Where firms are getting caught
- Timing. The reconciliation runs on the right day but the data it uses is from the wrong one. A statement that arrives after the reconciliation has been run and signed is a break nobody sees until month end.
- Scope. Relevant funds in transit, funds held with more than one institution and funds held in more than one currency fall outside the reconciliation because the spreadsheet was built for one bank account. The rule does not have that exception.
- Ownership. Finance runs the reconciliation. Operations resolves the breaks. Compliance signs the return. Nobody owns the break between the three, so it ages.
- Evidence. The reconciliation happened, the break was fixed, and the only record is an email. An email is not a control.
What good looks like six months in
The firms that are comfortable now share a few features. The reconciliation is a daily control with a named owner, a documented data source for each side, and an exception process that records who did what and when. The monthly return is produced from the reconciliation, not alongside it. There is a map of where relevant funds can be at any moment, from the customer payment through to the safeguarding account, and every point on that map is reconciled to something. And the whole thing has been shown to the auditor once already, so there are no surprises in the second cycle.
None of this needs a new platform. Some firms have one and still fail the tests above. Some run it on well-designed spreadsheets and pass. What it needs is a reconciliation designed from the data outwards, with the control built into the design rather than added at audit time.
The next six months
The end-state rules will bring safeguarding closer to the client money regime under CASS 7, and the cryptoasset regime under CASS 16 and CASS 17 is already on the horizon for firms in that market. The principle is the same across all of them: the record of what you hold has to agree with the record of what you owe, every day, and you have to be able to prove it. Firms that have made that routine over the past six months are ready. Firms that have made the form routine have more to do.
If you want a second pair of eyes on how your reconciliation stands up against the rules as they are now, that is exactly what one day of the Data Diagnostic is for.