The short answer
CASS 15 does not apply to insurance intermediaries. It is the FCA’s new safeguarding sourcebook for payment institutions and electronic money institutions, with final rules in Policy Statement PS25/12 and an effective date of 7 May 2026. If you are a broker, MGA, appointed representative, or any firm holding premium, return premium, or claims money in the course of insurance distribution, your client money obligations continue to sit in CASS 5.
This gets misread often enough to be worth stating plainly, because the consequences of acting on the wrong reading run both ways. Firms that believe a new sourcebook lands on them in May 2026 spend budget preparing for rules that do not apply. Firms that hear "CASS 15 is not ours" and stop reading miss that the regime reshapes the payment rails their premium already travels on, and that it is the clearest available signal of where supervisory expectations are heading for everyone holding client money.
What CASS 15 actually requires
Worth knowing in outline, because it defines the standard your payment providers now work to — and because it is a fair preview of the direction of travel.
- Daily reconciliation of internal records to safeguarding accounts, rather than periodic reconciliation.
- Monthly regulatory returns to the FCA on safeguarded funds.
- An annual safeguarding audit by an external auditor.
- Resolution pack readiness — records assembled and current enough that an insolvency practitioner can act within 48 hours.
- Bank acknowledgement letters with no right of set-off, so the safeguarding account cannot be raided to settle the firm’s own obligations.
The pattern is familiar from CASS 7: sharper reconciliation cadence, named accountability, stronger evidential discipline, and a resolution pack that is continuously assembled rather than rebuilt on request.
Why it still matters to brokers and MGAs
Your payment providers are now in scope
Premium increasingly moves through payment service providers and e-money institutions before it reaches a client money account. Those firms are the ones CASS 15 regulates, and their obligations change how your money sits and how quickly it arrives.
The FCA has been explicit about the consequence for CASS 5 firms. At the PKF–FCA bi-annual meeting in June 2025, the FCA confirmed that firms must review their relationships with payment service providers to determine whether the PSP qualifies as an Other Agent under CASS 5, and how the PSP sits within the firm’s existing reconciliation requirements. Firms are expected to assess whether the PSP introduces a delay in the receipt of client money, and to put arrangements in place to manage that delay consistently with the trust obligation.
That is a live CASS 5 obligation arising directly out of the CASS 15 population. If you cannot say which of your payment providers is an Other Agent, how long premium sits with each, and how that timing is reflected in your reconciliation, that is a gap in your own control environment — not theirs.
It sets the benchmark supervision is moving toward
Daily reconciliation, named oversight, annual audit, continuously assembled resolution packs, tamper-evident records. None of these are CASS 5 requirements today. All of them are recognisable as the direction the FCA has been pushing client money control for a decade, and firms that adopt them early are the ones that pass supervision comfortably rather than defensively.
The FCA’s July 2021 Dear CEO letter to general insurance intermediaries found that more than half of assessed firms had client money calculations that did not align with its expectations, and raised concerns about commission withdrawal, co-mingling, and CASS control quality generally. Those are routine operating model weaknesses, not rare misconduct. The enforcement record makes the consequence concrete: in August 2025 the FCA banned and fined Martin Sarl, sole director of Perry Prowse Insurance Consultants, after he used client account money to pay personal and company debts, failed to pass clients’ premiums to insurers, and left customers uninsured without their knowledge. In at least one case a customer’s claim was rejected because cover was not in place.
What CASS 5 requires of you today
Before adopting anything from CASS 15, be certain the regime you are actually subject to is under control. Three ways of holding insurance money, with materially different obligations:
| Method | Description | CASS 5 obligations | Audit requirement |
|---|---|---|---|
| Risk transfer | The insurer grants the broker authority to hold money as its agent. Premium paid to the broker is treated as received by the insurer; credit risk transfers to the insurer under a signed TOBA. | Not subject to CASS 5, provided the TOBA is valid, in writing, signed, non-conditional, and cascades correctly through any sub-agent chain. | Not required unless the insurer TOBA specifically demands it. |
| Statutory trust (ST) | Client money held in a designated statutory trust account under CASS 5.3. Trust status arises automatically — no deed required. The broker may not advance credit from a statutory trust account. | Full CASS 5 obligations: segregation, bank acknowledgement letters, a client money calculation at least every 25 business days, reconciliation, commission extraction rules. | Required if the balance exceeds £30,000 at any point in the year. |
| Non-statutory trust (NST) | Client money held under a formal trust deed executed under CASS 5.4. The deed permits the broker to extend credit to clients or insurers from the client money account, subject to controls. | Full CASS 5 obligations, plus the additional controls required by the NST deed. Higher capital requirements apply for retail-facing firms. | Required irrespective of balance. |
Client money trust arrangements are subject to trust law: the broker acts as trustee and owes fiduciary duties to the beneficiaries. That is why apparently technical errors — poor account naming, invalid acknowledgement letters, mixed remittance mistakes, premature commission extraction — become legal, regulatory, and conduct issues rather than ordinary back-office corrections.
Six disciplines worth adopting now
These are the CASS 15 obligations restated as operating practice. None is mandatory for a CASS 5 firm. Each closes a weakness the FCA has already said it finds in the sector.
1. Segregation and approved banks
Client money held in designated trust accounts at approved banks, with concentration risk actively monitored and diversified. Track bank diversification and alert when exposure to a single counterparty crosses a threshold. Keep account titles and bank acknowledgements to a standard that would survive challenge.
2. Internal reconciliation
Move from spreadsheet-based, end-of-period reconciliation to system-driven reconciliation with exception workflows. Every difference investigated, ownership assigned, ageing tracked — no orphaned items. Material differences escalated to CASS oversight on a defined timeline. CASS 5 permits up to 25 business days between calculations; running closer to daily turns reconciliation from a lagging report into a control.
3. External reconciliation
Internal client money records reconciled to bank statements on an agreed cadence, evidenced with source data, approver identity, and timestamp. Sign-off by the named CASS oversight role, separate from the team that produced the reconciliation. Structure the outputs for the annual audit so there is no year-end scramble.
4. Breach identification and reporting
Shortfalls, excesses, and concentration breaches detected at the point they arise rather than at the next reconciliation. Every breach captured with amount, account, root cause, and remediation plan; material breaches flagged for notification with the structured context a regulator expects; nothing closed without evidence of fix.
5. A living resolution pack
Client balances, trust account lists, signatories, bank acknowledgements, recent reconciliations, breach records, and sign-offs — continuously assembled from current data rather than rebuilt by hand each quarter. The test is simple: could an insolvency practitioner act on it today, without anyone reconstructing anything?
6. Records, evidence, and audit trail
Write-once, read-many records of every entry, movement, and reconciliation event. Every premium, return premium, and claims movement traceable to source and destination. Every action stamped with user, time, and the authority under which it was taken. The answer to "what did you do, when, and on whose authority?" should live in the system, not in an email folder.
Where client money meets commission
The most common CASS 5 failure in practice is not segregation. It is commission extraction — taking firm money out of a client money account before it has been properly earned and evidenced, or leaving earned commission stranded in client funds because nobody can prove entitlement.
Both directions are control failures. Over-extraction is a breach. Under-extraction strands the firm’s own money in the trust and distorts every calculation that follows. Both are made far more likely when the commission calculation itself is unreliable — when rates are stale, endorsements are not re-rated, or contingent entitlement is estimated from partial data.
This is why client money control and commission integrity cannot be treated as separate programmes. The evidence chain runs through both. We cover the calculation side in detail in The Hidden Cost of Commission Leakage.
What to do next
- Confirm your perimeter. Document that your insurance distribution activity sits under CASS 5, and identify any group entity authorised under the PSRs or EMRs that genuinely does fall in the CASS 15 population.
- Map your payment chain. For each PSP and e-money institution in the premium flow, determine whether it is an Other Agent under CASS 5, how long money sits with it, and how that delay is reflected in your reconciliation.
- Test your client money calculation. More than half the firms the FCA assessed had calculations that did not meet its expectations. Assume yours needs proving, not asserting.
- Time your resolution pack. Measure how long it would take to assemble one today from current data. If the answer is more than a day, it is a document, not a control.
- Close the commission-extraction loop. Evidence every extraction against a governed entitlement, in both directions.