For many payment and e-money firms, the first CASS 15 audit deadline still feels comfortably distant. Which is exactly why it deserves attention now.

The FCA's safeguarding regime under CASS 15 came into force on 7 May 2026. For many firms, the first audit report won't be due until late 2027. On paper, that feels like plenty of time.

In reality, the report deadline is the very end of the process. So rather than focus on the final submission date, firms need to be asking the question, ‘will my safeguarding framework be ready for independent scrutiny when the audit begins?’

It may appear operationally effective - but the first audit is often the moment that assumption is tested. Starting early creates time for these tests, and options if issues are identified.

Importantly, time also creates the conditions for a higher-quality audit all together. This means more confidence in the controls, governance, and safeguarding arrangements that support a firm’s future growth.

The report deadline is the end point, not the starting point

Authorised payment and e-money institutions, and credit unions that are issuing e-money must appoint an external auditor where safeguarded funds exceed £100,000 during the audit period.

The first audit report is due to the FCA within six months of the firm's period end date, and then 4 months thereafter. For firms whose first audit period ends on 13 May 2027 (the latest end date), that means the audit report must be submitted to the FCA no later than 13 November 2027.

But by the deadline date, the outcome of the audit will be determined. Auditors will assess the controls, governance, and evidence generated throughout the audit period, not just the preparations made in the months leading up to the reporting deadline.

Why the first audit cycle is different

For many firms, this will be the first independent assessment of a new safeguarding framework. A frequent misunderstanding is treating CASS as a finance-only process rather than an end-to-end governance and operational control framework.

New reconciliations, reporting requirements, governance processes, and documentation standards have all been introduced under CASS 15. The challenge is bigger than implementation – it's being able to demonstrate a sustained record of operating consistently and effectively throughout the audit period.

If that evidence doesn't exist, firms may find there are limits to what can be fixed retrospectively. Controls can be strengthened and documentation improved, but missing historic evidence can’t easily be recreated.

Early engagement creates time

The conversation around auditor appointment often focuses on market capacity. While that's a valid concern, it's only part of the story.

Capacity constraints are already increasing as firms move towards the first audit cycle. But aside from securing an auditor, the biggest advantage of early engagement is the time it creates to assess readiness and address issues before they become findings.

An auditor can help firms identify weaknesses in processes, governance, documentation, or evidence gathering while there is still time to address them. This is particularly important during the first year of a new regime, when firms are still embedding processes and refining their operating model. Finding issues early creates options and alleviates pressure.

The question firms should be asking now

• Can we evidence that our safeguarding framework has operated effectively throughout the audit period?
• If we identified weaknesses today, would we have enough time to remediate them?
• Are we confident our governance arrangements would stand up to independent scrutiny?

The firms most likely to navigate the first CASS 15 audit successfully will be those that started early rather than those who did more than their peers.

Because the real risk is time missed for discovery. Learning that the evidence needed to support your safeguarding framework is insubstantial is a far greater issue than the looming submission date.

How Johnston Carmichael can help

The first CASS 15 audit cycle is fundamentally about demonstrating that safeguarding arrangements have operated effectively throughout the audit period and can withstand independent scrutiny.

CASS & Safeguarding, led by Gillian Boston, is a dedicated specialism within Johnston Carmichael. Our approach is grounded in constructive challenge, clear communication and long-term client relationships. To support ongoing compliance, we provide practical, risk-focused observations and recommendations informed by our work with regulated firms across the financial services sector.

If you haven't yet appointed a CASS 15 auditor, now is the time to start that conversation. Firms that begin preparing now will have the greatest opportunity to identify weaknesses, remediate issues and build a robust evidence base before the first audit cycle concludes.