Insights Archives - Imperium(L) https://www.imperiuml.com/category/insights/ Tue, 23 Jun 2026 12:52:42 +0000 en-GB hourly 1 https://wordpress.org/?v=7.0 https://www.imperiuml.com/wp-content/uploads/2026/02/imperiuml-circle-background-150x150.png Insights Archives - Imperium(L) https://www.imperiuml.com/category/insights/ 32 32 CASS 15 Operational Control Challenge https://www.imperiuml.com/insights/cass-15-operational-control-challenge/ Tue, 23 Jun 2026 12:12:26 +0000 https://www.imperiuml.com/?p=3535 CASS 15, introduced by FCA Policy Statement PS25/12 and in force since 7 May 2026, is not just a reporting requirement. It makes safeguarding a daily operational control discipline for payments and e-money firms, requiring regular internal and external reconciliation, comparison of the segregation requirement against the segregation resource, prompt correction of shortfalls, a resolution […]

The post CASS 15 Operational Control Challenge appeared first on Imperium(L).

]]>

CASS 15 is not just a reporting issue.
It is an operational control challenge.

The FCA’s new safeguarding regime comes with a deadline, a monthly return and an audit. Treat it as form-filling and you miss the point, and the risk.

  • By Imperium(L)
  • June 2026
  • Approx 8 Minute Read

When the FCA published Policy Statement PS25/12 in August 2025, confirming its changes to the safeguarding regime for payments and e-money firms, much of the early reaction settled on the obvious. There was a new monthly safeguarding return to produce, an annual safeguarding audit to pass and more records to keep. In a lot of firms, the instinct was to treat it as a reporting upgrade. Build the return, satisfy the auditor, move on. That reading is understandable. It is also wrong, and the distance between the two interpretations is exactly where regulatory and customer-protection risk now sits.

What PS25/12 actually changed

Since 7 May 2026, the Supplementary Regime set out in PS25/12 has been in force. Following its consultation in CP24/20, the FCA gave firms a nine-month implementation window, longer than the six months it had originally proposed, precisely because what it expects is not a quick configuration change. The new rules introduce a dedicated safeguarding chapter in the Client Assets Sourcebook, CASS 15, and they do not sit alone. They are accompanied by a resolution pack chapter in CASS 10A, a safeguarding audit requirement in SUP 3A and the monthly safeguarding return in SUP 16.14A.

Read those four pieces together and a pattern emerges. This is the description of an operating model, not a reporting cycle. PS25/12 also confirmed that the FCA is not, for now, pressing ahead with the more far-reaching end-state, sometimes called the post-repeal, regime it had floated, choosing instead to let the Supplementary Regime bed in and to review it once a full audit cycle has run. The direction of travel, though, is set, and firms should plan around it rather than against it.

Why the rules look like this

The rationale is uncomfortable, and instructive. The FCA’s own analysis of firm failures found that when payments and e-money firms went under, customers were left badly short. The money actually available to return to those customers fell well below what they were owed, with average shortfalls running to roughly two thirds of relevant funds in the cases the regulator examined. A regime built around a monthly form would never have closed a gap that large. A regime built around continuous control has a chance of doing so. That logic runs through every part of CASS 15, and it explains why the obligations are weighted so heavily towards daily operational discipline rather than periodic disclosure.

The return is the tip of the iceberg

The monthly return is the visible output. The work that actually protects customers sits beneath it, and most of that work happens every business day. CASS 15 expects firms to reconcile what they owe customers against what they hold in safeguarding, and to do it on each reconciliation day rather than once a month. It draws a sharp distinction between the segregation requirement, meaning what the firm should be holding, and the segregation resource, meaning what it actually holds, and it asks firms to compare the two and put right any shortfall promptly. A discrepancy is no longer something to flag and revisit at month end. It is something to find today and fix today.

Around that daily core sit further obligations, and none of them is a reporting task. Firms must maintain a resolution pack, so that if the worst happens relevant funds can be identified and returned to customers quickly. They must carry out due diligence on where safeguarding funds are held and avoid undue concentration in any one place. Where they rely on the insurance or guarantee method, they must meet specific conditions, including allowing enough lead time to put replacement cover in place. They must hold acknowledgement letters for their safeguarding accounts. And they must support an annual safeguarding audit, although the FCA has carved out the smallest firms, those whose relevant funds do not exceed £100,000, from the audit requirement.

Why this is an operating challenge, not a reporting one

Seen as a whole, the message is hard to miss. CASS 15 asks firms to run a control environment, to evidence that it is working, and only then to report on it. Reporting is the third step, not the first. That ordering is why a spreadsheet, however carefully maintained, struggles under the new regime. A spreadsheet can hold numbers well enough. It is far weaker at proving, weeks or months later, who reviewed a discrepancy, when it was escalated, what action was taken and who signed it off. When an auditor or the FCA asks how a particular break was handled, a workbook and a folder of emails will not carry the weight.

The practical problem most firms face is not a shortage of data. The data exists. It is simply spread across customer ledgers, bank portals, payment processor exports, spreadsheets and the working memory of whoever ran the last reconciliation. Assembling that picture once a month is demanding enough. Assembling it every business day, to a standard that survives an audit, is a different order of task altogether. That is the operational control challenge PS25/12 has created, and it is precisely the part that never appears on the face of the return.

Where this leaves firms

This is the work Imperium(L) Prism is built for. Prism brings the owed side and the held side into a single view, runs internal and external reconciliation daily, and surfaces breaks the same day they happen rather than three weeks later when someone opens the file. It wraps each break in a structured resolution workflow, with an owner, a severity, a deadline, evidence and sign-off, and it tracks resolution-pack completeness against the documents the pack actually needs. Every reconciliation, action and sign-off is captured, timestamped and attributable, and the monthly safeguarding return data is generated from controlled reconciliation rather than rebuilt by hand at month end.

It is worth saying that this is not untested thinking. Prism is built on reconciliation and customer-fund-protection technology that has supported businesses in live, high-volume environments for over 12 years, so the operational logic behind it has already been proven against real money, real reconciliations and real audits.

CASS 15 set a deadline, and that deadline has passed. The firms that will find the regime manageable are the ones that treat it as what it is, a continuous control discipline that happens to produce a monthly report, rather than a monthly report that happens to require some control. The return is the easy part. The control behind it is the point.

Book a Demo

Frequently Asked Questions

Is CASS 15 just a new reporting requirement?

No. The monthly safeguarding return is only the visible output of CASS 15. The regime set out in PS25/12 is built around daily operational control: regular internal and external reconciliation, prompt correction of discrepancies, a resolution pack, acknowledgement letters, due diligence and an annual safeguarding audit. The reporting sits on top of that control, not in place of it.

The Supplementary Regime came into force on 7 May 2026, following a nine-month implementation period after PS25/12 was published in August 2025.

The segregation requirement is what a firm should be holding in safeguarding to cover what it owes customers. The segregation resource is what it actually holds. CASS 15 asks firms to compare the two on each reconciliation day and to correct any shortfall promptly.

Not all. The FCA has exempted the smallest firms, those whose relevant funds do not exceed £100,000, from the safeguarding audit requirement. Firms above that threshold must support an annual audit.

The post CASS 15 Operational Control Challenge appeared first on Imperium(L).

]]> Safeguarding Visibility Starts with a Unified Ledger https://www.imperiuml.com/insights/safeguarding-visibility-starts-with-a-unified-ledger/ Tue, 23 Jun 2026 11:56:02 +0000 https://www.imperiuml.com/?p=3519 Under the FCA’s CASS 15 safeguarding regime, in force since 7 May 2026, payments and e-money firms must identify relevant funds at any time without delay, reconcile what is owed to customers against what is held in safeguarding on each reconciliation day, and maintain a resolution pack. A unified ledger is the operational layer that […]

The post Safeguarding Visibility Starts with a Unified Ledger appeared first on Imperium(L).

]]>

Why safeguarding visibility starts with a unified ledger.

Most payments and e-money firms do not have a safeguarding data problem. They have a safeguarding data assembly problem. CASS 15 has made that distinction expensive.

  • By Imperium(L)
  • June 2026
  • Approx 8 Minute Read

Ask a payments or e-money firm whether it knows what it owes its customers, and the answer is almost always yes. Ask whether it knows what it holds in safeguarding accounts to protect them, and the answer is yes again. Ask whether it can show, right now, the two numbers side by side, drawn from current data, on the same screen, with a complete record of what has moved between them since this morning, and the answer becomes more interesting. In most firms, that is not a question the systems can answer without help.

This is the visibility problem the new safeguarding regime has put a spotlight on.

It is not, in the usual sense, a data shortage. Most firms have everything they need, somewhere. The customer ledger knows what is owed. The bank portals know what is held. The payment processor exports show what is in flight. Internal cashbooks, claims systems, refund logs, FX conversion tables and a string of spreadsheets each carry part of the picture. The trouble is that no single place in the business carries all of it at once, in a current and reviewable form. Pulling it together once a month, for the return or for the auditor, is demanding enough. Doing it every business day, to a standard that survives scrutiny, is a different task altogether.

What CASS 15 actually expects firms to see

Under the chapter introduced by Policy Statement PS25/12 and in force since 7 May 2026, the safeguarding rules set a books and records expectation that does not bend. A firm must be able to identify the funds it holds as relevant funds, distinguish them from its own, and do so at any time, without delay.

That phrasing matters. It describes a state of continuous visibility, not a monthly assembly job.

Sitting on top of that, the chapter requires reconciliation of what is owed against what is held, both internally between the customer ledger and the firm’s records of safeguarded amounts, and externally against bank and third-party data, on each reconciliation day. Any discrepancy is to be corrected promptly. The resolution pack expectation in CASS 10A then assumes that, if the worst happens, the firm can produce a clear, current picture of relevant funds and the customers they belong to, so that money can be returned without delay.

Read those three obligations together and a single operational requirement falls out of them.

The firm needs to see, in one place, what it owes and what it holds, with the underlying detail intact, every business day. Fragmented data cannot deliver that. It can deliver the appearance of it once a month, with enough effort, but the appearance is the part the regime is moving away from.

What goes wrong when the picture is fragmented

Three things, predictably, in the firms we have looked at.

  1. The first is timing. If the picture lives across five sources, the firm can only see it when someone takes the time to assemble it, and that time tends to fall at month end. By then, the small discrepancy from two weeks ago has either resolved itself, quietly, or grown into something larger. Breaks that should have been corrected the same day get caught in the next cycle instead, or the cycle after that. The cost of late detection is not always financial. Often, it is the loss of the trail that would have explained how the break happened in the first place.
  2. The second is evidence. When an auditor or the regulator asks how a particular break was handled, a stitched-together story drawn from four spreadsheets and an email thread does not carry the weight. The firm did the work, very often. It just cannot prove it cleanly. In a regime that is increasingly built around demonstrable control rather than periodic disclosure, work that cannot be proved is, for practical purposes, work that did not happen.
  3. The third is speed in resolution. The CASS 10A resolution pack is not really about a document. It is about the firm’s ability to move quickly under stress, with a clear picture of relevant funds and the customers they belong to. Fragmented data makes that act of assembly slow exactly when speed matters most. The firms that have thought hardest about this are the ones that have realised the resolution pack is, in effect, a daily readiness exercise, not an annual paperwork one.

What a unified ledger actually is

The term unified ledger does not appear in the rules.

It is not a regulatory artefact.

It is the operational answer to what the rules now require.

In plain language, a unified ledger is a single view of what is owed to customers, set against what is held to protect them, drawn from all the underlying sources, kept current, and reviewable. Customer ledger data, safeguarding account balances, bank and third-party records and exception activity sit together, and when one of them moves, the picture moves with it.

Two things are worth being clear about. A unified ledger is not a dashboard in the cosmetic sense. It is the connecting tissue underneath one. And it does not replace the firm’s existing systems. The customer ledger, the cashbook, the bank feeds and the payment processor records all still matter. The unified ledger is the layer that brings them into a single operational view and reconciles the result. Done well, it makes the question “what is happening with safeguarding right now” answerable without phoning anyone.

What changes when a firm has a unified ledger?

The change is easier to describe than to engineer.

Breaks surface the day they happen rather than three weeks later, because the comparison runs every business day. The trail behind every action is captured automatically, because the actions take place inside the system that holds the picture, rather than in messages and workbooks outside it. Senior

managers get a current view of safeguarding exposure rather than a monthly snapshot, which changes the questions they can ask and the speed at which they can ask them. And when a regulator, auditor or board member wants the firm’s safeguarding position, the firm produces it rather than reconstructs it.

This is the work Imperium(L) Prism is built for. Prism brings the owed side and the held side together, runs internal and external reconciliation daily, surfaces breaks the same day, captures a timestamped audit trail of every action and turns controlled reconciliation into the data behind the monthly safeguarding return. The technology has supported businesses in live, high-volume environments for over 12 years, so the operational logic behind it has already been tested against real money, real reconciliations and real audits.

Safeguarding under CASS 15 starts with a question that sounds simple. What does the firm owe its customers, and what is it holding to protect them, right now? The firms that can answer cleanly will find the rest of the regime manageable. The ones that cannot will spend the next audit cycle trying to assemble an answer they should have been able to see all along.

Book a Demo

Frequently Asked Questions

What is a unified ledger?

A unified ledger is a single, current view of what a firm owes its customers set against what it holds to protect them, drawn from the firm’s customer ledger, safeguarding account balances, bank and third-party records and exception activity. It is the connecting layer beneath any safeguarding dashboard, not a replacement for the underlying systems.

No. The CASS 15 rules do not mandate a unified ledger by name. They require firms to maintain accurate books and records that identify relevant funds at any time without delay, to reconcile what is owed against what is held both internally and externally on each reconciliation day, and to maintain a resolution pack. Meeting those obligations daily, on fragmented data, is the operational difficulty a unified ledger is built to remove.

CASS 15 requires reconciliation of what is owed against what is held on each reconciliation day, both internally between the customer ledger and the firm’s safeguarding records, and externally against bank and third-party data. Discrepancies are to be corrected promptly.

No. A unified ledger sits across the firm’s existing customer ledger, cashbook, bank feeds and payment processor records and brings them into a single operational view. The underlying systems remain, and the firm continues to rely on them.

The post Safeguarding Visibility Starts with a Unified Ledger appeared first on Imperium(L).

]]>