Safeguarding Rules Finalised: A Pragmatic Update in PS25/12

The FCA has made several important allowances in this policy statement, most of which will be a welcome relief for firms, particularly smaller ones.

• Extended Implementation Period: The implementation window has been increased from the proposed 6 months to 9 months, giving firms until 7 May 2026 to solidify understanding and adjust processes as necessary.
• A New Safeguarding Audit Threshold: A de minimis threshold of £100,000 has been introduced. Firms that do not hold relevant funds above this amount will not be required to arrange the new annual safeguarding audit.
• Limited Assurance is gone: The requirement for a limited assurance audit for firms that held no relevant funds during the period has been removed.
• ‘Reconciliation Day’ Replaces ‘Business Day’: Reconciliations are now required at least once per ‘reconciliation day’. This new definition formally excludes weekends, bank holidays, and days when relevant foreign markets are closed, removing a concern from the original proposal.

The final rules also provide some technical clarifications on the reconciliation process itself:

• Use of Third-Party Data: The FCA has confirmed that firms may use data from third parties (such as a bank) to create and maintain their internal records of relevant funds, where no other reasonable method is available.
  • This is a very wise allowance, firms must be sure not to default to this and clearly document that they have considered all other options first.
• A Simpler D+1 Reconciliation: For the internal reconciliation, the FCA has replaced the complex ‘relevant funds deposit resource’ reconciliation with a simpler, higher-level comparison. Firms will now compare the relevant funds that should be held (the ‘D+1 segregation requirement’) against the balances of the accounts where they are held (the ‘D+1 segregation resource’).
  • Once again, a positive change. D+1 should help eliminate settlement and processing times and reduce the potential for reconciling items complicating the rec.

The new annual safeguarding audit is one of the biggest changes. The final rules state that the submission period for the first assurance report will be 6 months after the period end, reverting to 4 months for all subsequent years.

The PS suggests that the safeguarding audit will be primarily focused on the reconciliation framework and the firm’s compliance with the new CASS 15 rules, rather than a substantive check of individual transactions during the period.

However, we are still waiting for the other key piece of this puzzle. The Financial Reporting Council (FRC) is currently working on a new auditing standard specifically for CASS 15. The FCA has stated it expects this standard to be available before the 7 May 2026 implementation date, which is crucial for auditors to be able to plan their work.

While these changes are a positive, firms should not be complacent. The 9-month implementation window will pass quickly. The introduction of a CASS-style daily reconciliation and a mandatory annual audit for most firms is a significant operational and governance uplift.

I expect auditor capacity to be a major constraint as we approach the implementation date. My advice is to conduct your gap analysis now, there are excellent compliance consultants that can help with this. Speaking to potential auditors early is important, they’ll have plenty of questions to ensure they understand your business model, transaction flows and controls, so be prepared!