The Financial Reporting Council (FRC) has released its long-awaited interim guidance to auditors who will be carrying out CASS 15 safeguarding audits.
With CASS 15 implementation just 51 days away, auditors have been looking for guidance as Electronic Money Institutions / Authorised Payment Institutions (EMIs/APIs) ask questions on what their first safeguarding audit will look like.
While the below does not signal an overhaul of the current CASS Assurance Standard yet, it provides a framework for auditors to reference for the time being. Here are the key takeaways from the newly released guidance:
- Audit firms will adopt a ’zero materiality’ threshold when compiling the safeguarding report to the Financial Conduct Authority (FCA), meaning that all breaches are included. Previously, EMI/API auditors were only required to report material issues to the regulator
- Timing of submission - CASS reporting periods ending within 12 months after 7 May 2026 will have an extended 6 month filing deadline for the first safeguarding audit
- For firms where the new rules come in during the CASS reporting period, auditors can produce either two reports (one each under the different rules) or one report producing a hybrid opinion
- Ethical standards apply in much the same way as current CASS audits e.g. when it comes to independence and competence to carry out the work
- Auditors must ensure they understand the firm’s flow of funds and reconciliation methodologies (whether by segregation or insurance method) in detail. Therefore, Firm’s must prepare to answer detailed and pointed questions in these areas
- Documentation of processes will be key e.g. reconciliations, systems surrounding safeguarding accounts, trust letters and distinguishing relevant funds from office funds
- IT controls will form an essential part of the CASS 15 audit, which is unsurprising given the high level of automation we see with these businesses
- Similar thresholds will apply when assessing whether to issue a qualified or adverse opinion
All said however, today’s guidance is just that, and doesn’t replace any existing legislation. In this transition period audit firms will be expected to use professional judgement when forming their audit methodologies.
For audit firms who have been using the existing CASS framework to conduct their safeguarding audits, this publication will be well received.
Now that we have a better picture of what a firm’s first safeguarding audit will look like, important that EMIs/APIs engage as soon as possible with their auditors to get CASS 15 ready.
Contact us if you’d like to discuss how we can support with your first safeguarding audit and CASS 15 compliance.
