Safeguarding audit

A key focus area is the safeguarding calculation and reconciliation process, including:

• How relevant funds are identified and calculated
• The frequency and methodology of reconciliations
• Evidence of review and challenge
• Exception identification and escalation

We test selected reconciliations and review how effectively discrepancies are resolved.

We review:

• How customer funds are segregated
• The flow of funds through the business
• Controls ensuring segregation occurs within required timeframes (including T+1 requirements)

Where firms use banks or other third parties in the safeguarding process, we examine:

• Initial and periodic due diligence
• Ongoing monitoring arrangements
• Contractual documentation
• Evidence of review and oversight

We inspect key safeguarding documents, which may include:

• Risk and controls matrices mapped to CASS 15
• Policies and procedures
• Governance papers
• Resolution packs and safeguarding documentation

Where breaches are identified, we clearly explain:

• The rule breached
• The associated risk
• What would be expected to achieve compliance

The enhanced CASS 15 regime takes effect from 7 May 2026.

No. Your safeguarding auditor can be the same firm as your statutory auditor, but it does not have to be.

A structured assurance engagement covering governance, reconciliations, segregation of funds, third-party oversight, documentation and record-keeping, with a strong focus on testing safeguarding controls.

Firms that do not meet the £100,000 relevant funds threshold over the 53-week assessment period will not require an annual safeguarding audit. Small Payment Institutions may also fall outside scope unless they opt in.

If no relevant funds were held during the period and the threshold is not met, an audit opinion may not be required. Firms should document and evidence this position carefully.

Common requests include:

• Risk and controls matrices mapped to CASS 15
• Governance documentation and board papers
• Safeguarding calculation workings
• Reconciliation evidence
• Third-party due diligence records
• Policies, procedures and systems notes

The audit typically includes:

1. Planning and scoping
2. Fieldwork and control testing
3. Reporting and opinion issuance

First year of the regime

For the first year, the audit period will begin from May 2026 (when the new rules come into effect). Firms will then typically have six months from their period end to submit their first safeguarding assurance report.

Subsequent years

In subsequent years, the process becomes more routine:

• Annual audit covering the full financial period
• Consistent application of safeguarding controls throughout the year
• Submission of the assurance report within six months of each period end

Firms should plan ahead to ensure controls are embedded from the start of each period, as issues arising during the year may impact the audit opinion.

Most work can be completed remotely. We agree information request lists in advance and structure testing to align with existing processes, reducing operational disruption.

Yes – these may arise where new rules take effect mid-year. Firms can opt for split periods, as long as each period is no more than 53 weeks.

Example – year end 31 December 2026

Two report approach:

• 1 January 2026 – 6 May 2026 under the legacy safeguarding regime and existing assurance framework; and
• 7 May 2026 – 31 December 2026 under the relevant funds regime.

This would also result in a hybrid opinion to cover each of the above periods.