CASS 15 is live: the 2026 UK safeguarding reset for EMI buyers

The rules arrived in two documents. Policy statement PS25/12 (7 August 2025) made the final rules; the Payments and Electronic Money (Safeguarding) Instrument 2025 (FCA 2025/38) wrote them into the FCA Handbook and commenced on 7 May 2026, nine months after publication. The result is a new architecture: CASS 15 carries the safeguarding rules themselves, CASS 10A the resolution-pack duty, SUP 3A the audit regime, and the monthly REP027 return runs through the FCA's reporting framework.

The two safeguarding methods survive. Relevant funds are either segregated - held with an authorised credit institution or custodian, or invested in secure liquid assets - or covered by insurance or a comparable guarantee. The insurance route now carries hard conditions: policies must not restrict payouts, except for confirming insolvency, and a contingency plan must be in place three months before a policy expires.

Scope is wide. Authorised payment institutions, authorised EMIs, small EMIs (for their e-money funds) and e-money-issuing credit unions are all in; small payment institutions may opt in. There is no small-firm carve-out from the regime itself - the one meaningful relief is the audit exemption for firms holding under GBP 100,000 of relevant funds. Anything still describing these rules as "proposed" is describing 2025.

The FCA did not rebuild safeguarding for tidiness. Its stated case, published with the final rules, is that customers of payments firms that became insolvent between the first quarter of 2018 and the second quarter of 2023 lost an average of 65% of their funds - money the old regime said was protected. The reform's answer is frequency and verification: daily checks, monthly reporting to the regulator, annual audits by an external reviewer.

The supervisory context points the same way: a June 2025 FCA multi-firm review of risk management and wind-down planning across 14 payments and e-money firms found almost all of the wind-down plans disconnected from the firms' own risk frameworks. Safeguarding failures surface when a firm fails; the new regime exists to generate records that show the problem earlier - which is what makes them useful to a buyer.

What commenced on 7 May 2026 is stage one, which the FCA calls the Supplementary Regime: Handbook rules layered on top of the safeguarding provisions that remain in the Electronic Money Regulations 2011 and the Payment Services Regulations 2017. Stage two - the Post-Repeal Regime - is the stated end state: a CASS-style regime that can only arrive once HM Treasury legislates to repeal the EMR and PSR safeguarding provisions. No date for that legislation has been published.

The much-discussed statutory-trust question sits in stage two, and it is deferred - that is the whole of what can honestly be said as of July 2026. Anyone modelling a deal on a firm view of the end state is modelling a rule that does not yet exist. Diligence the regime in force; verify again at signing.

Obligations under the new regime run with the entity, not the owner. When an EMI is sold, the FCA approves the buyer under FSMA Part 12 - prior approval on a section 178 notice, assessed within a statutory 60-working-day window - while the firm's safeguarding duties continue without a pause; the mechanics of that clock are in our guide to buying a UK EMI under section 178. The practical consequence is simple: whatever the target's safeguarding record is, on completion day it is yours.

Before 7 May 2026, testing that record from the outside was hard. Now the regime manufactures the evidence: monthly returns, daily reconciliation records, an audit opinion, a resolution pack. SKY7's live UK lot, the UK FCA-Authorised EMI for Sale, is an operational authorised EMI; we expect any serious counterparty to work through exactly the file below, on that lot or on any other target.

A change of control does not legally disturb the safeguarding arrangements - the authorisation, the accounts and the agent network all stay with the entity. The practical risk sits with the counterparty: a safeguarding credit institution can take its own view of a new owner, and a buyer who discovers that view after completion has inherited a live problem. Raise it early, in writing, and build it into the deal timetable.

If the relationship does need replacing, treat it as a project rather than an errand. Our guide to how new EMIs get a safeguarding account shows what that build looks like from a standing start - and why an operating EMI with a functioning safeguarding stack is worth more than its permission alone.