Customer ledger vs bank position. Why both sides must be seen together.

Neither side alone is truth. Under CASS 15, safeguarding is the agreement between the two, and divergence is where the risk actually lives.

Two numbers describe the safeguarding position of any payments or e-money firm at any point in the business day. The first is what the firm owes its customers. The second is what the firm actually holds, in safeguarding, to protect them. The first lives in the customer ledger, which is the firm’s internal record of its liabilities to the people and businesses it serves. The second lives in the bank position, which is the external record, held by someone else, of what is sitting in the firm’s safeguarding accounts right now.

Under CASS 15, safeguarding is not either of those numbers. It is the agreement between them. A firm that sees only the customer ledger is coherent about what it owes and silent about whether the money is there to pay it. A firm that sees only the bank position is coherent about what it holds and silent about who it owes it to. Each kind of blindness has its own failure mode. Neither is defensible on its own. The whole point of the regime is that the two sides are seen together, and seen often enough that divergence is caught before it becomes a problem.

This article is about why both sides have to be seen together, what each kind of partial sight actually hides, and the specific operational trap of seeing both sides at different times, which is almost worse than seeing one.

What this is, in CASS 15 language

Before going further, it is worth being explicit about which part of the regime this article is actually about, because it is a distinction a surprising number of firms still read loosely. CASS 15 asks a firm to run two reconciliations on each business day, and they are not the same.

The internal reconciliation compares the customer ledger with the firm’s own records of what it is holding in safeguarding. Both sides are internal to the firm. It is a check that the firm’s books agree with themselves.

The external reconciliation compares those internal records with the bank position, meaning what the bank or custodian independently says is in the firm’s safeguarding accounts. One side is internal to the firm, the other is external. It is a check that the firm’s books agree with the outside world.

Both are required under CASS 15, and the two answer different questions. This article is specifically about the external one. It is about whether what the firm thinks it is holding, in its own records, matches what is actually sitting in its safeguarding accounts according to the people who hold them. Everything that follows, the two kinds of partial sight and the timing trap, concerns that external comparison.

The customer ledger alone

Imagine a firm that has done its internal records faithfully. Every customer deposit is captured in the customer ledger. Every outbound payment is recorded against the right customer. Every e-money issuance has an entry. Reconciliation runs comparing the ledger today with the ledger yesterday, and the firm can say, with a straight face, that it knows what it owes every one of its customers to the penny.

What that firm cannot say, from its ledger alone, is whether the money to pay those customers is actually in the safeguarding accounts. The ledger is the firm’s internal account of what should be there. It is not evidence that it is. If the bank account is short by £2,400, because of a fee that was not accounted for, or a transfer that failed silently, or a transaction that was reversed and not reflected, the customer ledger will not know. It cannot know. It only knows what the firm has told it.

That gap is exactly the sort of thing the safeguarding regime is built to catch. A firm whose internal records say it is holding the right amount, but whose bank position says it is not, has a shortfall. Under CASS 15, that shortfall is to be identified and corrected promptly. A firm that cannot see the bank position cannot identify the shortfall. It can only know, retrospectively, that one existed, usually at the point where it caused a visible problem. By then, the window for prompt correction has closed and the window for an awkward conversation with an auditor has opened.

The subtler problem with ledger-only sight is that it tends to produce confidence that is not warranted by the underlying position. The team running the reconciliation sees matching numbers and concludes the firm is in order. The numbers are matching their own counterparts, which is useful information, but not the information the regime actually asks for. Confidence without external verification is one of the harder failure modes to correct, because it feels, from inside the team, like the control is working.

The bank position alone

Now imagine the opposite failure. A firm that reconciles diligently to its bank statements. The daily download comes in. The internal cashbook is compared to it. The two agree. The firm can say, with equal straight face, that it knows exactly what is in each of its safeguarding accounts, down to the penny, every business day.

What that firm cannot say, from its bank position alone, is who the money is for. The bank statement knows about movements. It does not know about allocations. It cannot distinguish between a balance that is correctly held for 4,207 customers and a balance that is correctly held for 4,206 customers plus a stray £312 that has never been assigned to anyone. It cannot know whether a customer whose account was closed last month has been paid out, or whether their balance is still sitting in safeguarding without anywhere to go.

Those are not hypothetical scenarios. They are the sort of thing that happens quietly, in the normal operational life of a payments or e-money firm, and that only shows up when someone compares the bank position to the customer ledger and asks the obvious question. In a firm that reconciles only to the bank, nobody asks it. The firm reconciles perfectly, in the narrow sense that its cashbook agrees with its statements, and remains blind to the question CASS 15 actually asks, which is whether the money it holds matches what it owes.

Bank-only sight tends to produce a different, more technical kind of confidence. The firm feels in control because an external source confirms the internal number. What it has confirmed is that the firm’s record of its bank activity is accurate. That is a necessary condition for safeguarding, not a sufficient one.

The two sides answer different questions

A clean way to understand what both sides are for is to notice that they answer different questions.

The customer ledger answers: what does this firm owe, right now, and to whom? It is the firm’s internal map of its liabilities to its customers. It is the first thing an insolvency practitioner would ask for, if the firm failed, because it defines the universe of people the money is for.

The bank position answers: what does this firm actually hold, right now, in the accounts it has designated for safeguarding? It is the external record of the assets available to meet those liabilities. It is the second thing an insolvency practitioner would ask for, because it defines the amount available to distribute.

Safeguarding, under CASS 15, is the comparison between those two answers on each business day. The requirement is not that the customer ledger is correct, important as that is. It is not that the bank statements are correct, equally important. It is that the two sides agree, and that where they do not, the shortfall is identified promptly and corrected. The question the regime asks is a specifically relational one. It cannot be answered by looking at either side in isolation.

Owed versus held, in one line:

The customer ledger tells the firm what should be there. The bank position tells it what is there. Safeguarding is whether those two numbers agree.

The timing trap

There is a specific failure mode that affects firms which do see both sides, but see them at different times. It is almost worse than seeing one, because it produces a reconciliation that reads as valid and is quietly meaningless.

Consider a firm whose customer ledger extract is pulled at close of business on Monday and whose bank data for the comparison is downloaded at midday Wednesday. By the time the two are compared, the ledger reflects liabilities as of Monday night, and the bank position reflects what happened to the accounts up to Wednesday lunchtime. Any transaction that moved through the ledger on Tuesday without having yet cleared the bank, and any transaction that cleared the bank on Tuesday or Wednesday morning without having been reflected in the Monday ledger extract, will cause an apparent discrepancy that is not real. The team will investigate it, find nothing wrong, and close it out. Any real discrepancy that happens to coincide with those timing differences will be invisible, hidden inside the noise of the mismatched clocks.

That is how timing-mismatched reconciliations fail. They produce false positives that absorb investigation time, and false negatives that absorb nothing because nobody sees them. Over weeks and months, the team learns to treat the output of the reconciliation as approximately right and to resolve differences by reference to intuition and experience rather than hard analysis. Both halves of the number are present. Neither is useful.

The fix is to compare like with like. The customer ledger position and the bank position should be read at the same point in time, with the same cut-off, and the comparison run against both as of that cut-off. Where that is operationally impossible, the firm’s policy should document the timing offset and the reconciliation should be designed to handle it explicitly. What should not happen is that the mismatch sits quietly inside a process that is treated as valid.

What this changes in practice

Seeing both sides together, with timing aligned, produces a different operating pattern. The firm’s position is a single comparison, run on the same cut-off, against both the ledger and the bank, every business day. Discrepancies show up where they are, not where timing noise happens to produce them. The customer ledger is accepted as the firm’s record of what it owes. The bank position is accepted as the external record of what it holds. Divergence is treated as the signal it is, not as a presumption of either side being wrong.

This is the work Imperium(L) Prism is built for. Prism brings the customer ledger and the bank position into a single operational view, aligned on the same cut-off, with divergence surfaced the day it occurs. Where ingestion from either side has to lag for operational reasons, the comparison accounts for the lag explicitly rather than letting it corrupt the result. The team sees the two sides together, continuously, and the discrepancies that need attention are the real ones. The technology behind Prism has supported businesses in live, high-volume environments for over 12 years, so the operational logic has already been tested against real reconciliations and real audits.

Under CASS 15, safeguarding is the agreement between what the firm owes and what the firm holds. Neither number is enough on its own. A firm that sees only its ledger is confident about what it should hold and blind to whether it actually does. A firm that sees only its bank position is confident about what it holds and blind to who it owes it to. A firm that sees both at different times is confidently reconciling noise. The firms whose safeguarding stands up to a serious look are the ones that see both sides, aligned, every business day, and treat divergence as the first and most important thing to understand.

Frequently Asked Questions

What is the difference between internal and external reconciliation under CASS 15?

Both are required on each business day. The internal reconciliation compares the customer ledger with the firm’s own records of what it is holding in safeguarding, so both sides are internal to the firm. The external reconciliation compares those internal records with the bank position, meaning what the bank or custodian independently says is in the firm’s safeguarding accounts, so one side is internal and the other is external. The two answer different questions. This article is about the external one.

What is the customer ledger in a safeguarding context?

The customer ledger is the firm’s internal record of what it owes each of its customers at any point in time. In a payments or e-money context, it captures customer balances, deposits, outbound payments, e-money issuances and redemptions. It is the firm’s own view of its liabilities to the people and businesses it serves.

What is the bank position?

The bank position is the external record, maintained by the bank or custodian, of what is actually sitting in the firm’s safeguarding accounts at any point in time. It reflects what has cleared, what is in flight, and what balances the firm has access to. It is independent of the firm’s internal records.

Why does CASS 15 require both sides to be seen together?

Under CASS 15, safeguarding is defined by the agreement between what the firm owes customers and what it holds to protect them. Neither number is enough on its own. The customer ledger alone describes what should be held but cannot confirm it is; the bank position alone describes what is held but cannot confirm who it is for. Any shortfall between the two is to be identified and corrected promptly, which is only possible when both sides are visible together.

What is the timing trap in two-sided reconciliation?

The timing trap arises when a firm compares a customer ledger position from one point in time against a bank position from another. The resulting reconciliation produces false positives (apparent discrepancies that are only timing differences) and false negatives (real discrepancies hidden by timing noise). The fix is to align the cut-off on both sides, or where that is operationally impossible, to document the offset in policy and design the reconciliation to handle it explicitly.