EXCLUSIVE: "The Compliance Gap" - Roger Binks, Kani in 'The Paytech Magazine'

A change to regulations governing payment providers in the UK is more than a technology shift. It’s a fundamentally different way of working, says Kani

When new safeguarding rules to better protect UK consumers using payment firms came into effect in May this year, it was reasonable to assume the industry would be ready for them. It had been given nine months to adjust its processes, after all. And it wasn’t as if the writing hadn’t been on the wall long before that. Payment firms that went bust between Q1 2018 and Q2 2023 couldn’t repay 65 per cent of their customers’ funds, according to data from the UK’s Financial Conduct Authority (FCA).

 It was just a question of whether consumer trust ran out before the regulator’s did.

And yet, in the days leading up to the FCA’s stricter CASS (Client Assets Sourcebook) 15 rules going live, 90 per cent of businesses still weren’t= compliant with at least one key aspect of the new requirements, according to a study commissioned by the reconciliation and reporting platform Kani. It was a statistic even it found shocking.

The new rules are not dissimilar to those that apply to other, traditionally more heavily regulated areas of financial services, and are designed to ensure that consumer cash is ringfenced and protected should the worst happen. The principal way to keep on top of that is through daily reconciliations – a key requirement of CASS 15.

“We expected to see a higher level of operational readiness,” says Roger Binks, Managing Director at Kani. “A number of firms believed they were aligned with the new CASS 15 requirements, but when we looked more closely at their ability to explain, evidence and test specific parts of the reconciliation process, the confidence levels dropped.

“The biggest surprise was the gap around daily reconciliations. Given how central they are to the new regime, we expected more firms to have that process firmly embedded.”

The FCA’s zero tolerance for breaches doesn’t bode well for any organisation found lacking. Failure to comply with CASS 15 risks hefty fines and personal liability for managers overseeing the processes. And you can see why the FCA is taking such a hard line. In 2017, as little as one per cent of consumers used Payment Services Providers (PSPs) and Electronic Money Institutions (EMIs) to complete transactions. By 2024, that had risen to 12 per cent, and today they are responsible for more than £2trillion of payments. Moreover, one in 10 people now holds an e-money account and uses it as their main day-to-day transaction account. Failing to bring these providers more in line with the rest of the banking industry would eventually present a systemic risk to the UK’s financial system.

Tellingly, 32 per cent of respondents to the Kani survey believed they were already compliant with updated CASS 15 requirements, and yet just 13 per cent were performing the daily reconciliations those rules demand. What Kani revealed was how big a gap existed between what companies should have been doing and how well they thought they were doing it. Which is, arguably, a bigger problem to solve than a technology gap. Binks explains: 

“We were hearing a lot of conversations across the industry that suggested some firms still viewed safeguarding readiness as a one-off compliance project. That is not how the new regime works. CASS 15 requires an embedded operating model, with the right controls, reconciliations and evidence in place every day.” In other words, if companies continue to see safeguarding as a tick-box reporting obligation that comes up at the time of an annual audit, they’ve not only missed the point, but are leaving themselves wide open to sanctions.

Kani describes the introduction of CASS 15 as a major operational shift for firms – one that it has been encouraging payment providers to address for some time by reducing their reliance on manual processes in favour of automated or semi-automated ones. And not just because it will keep them on the right side of the regulator, but because Kani believes it’s far more cost-effective in the long run.

While spreadsheets remain a cornerstone of compliance operations, semi-automation or full automation can take the burden off teams. Kani’s study showed that 66 per cent of users who relied on spreadsheets needed at least six hours to produce an evidence pack for the FCA under CASS 15 rules. In comparison, almost half of firms using a fully automated model have real-time access to one. These packs are required to help insolvency practitioners quickly identify, transfer, and return client money and safe-custody assets if a firm fails.

The FCA’s CASS resolution pack requirement has a 48-hour retrieval expectation, so firms that build their records on an as-and-when basis are unlikely to meet this requirement. Kani believes evidence readiness should be a structured aspect of the reporting workflows, not an afterthought that is only created when it is requested, and safeguarding should now be rooted in the day-to-day financial operations. That’s clearly not happening if many businesses are still conducting reconciliation processes monthly or weekly. 

Those companies, according to the Kani survey, were much more likely to be dependent on traditional spreadsheet-driven processes   and 22 per cent of them weren’t confident that their teams could explain the calculations in their firm’s report to an auditor or pass an audit. That compared with 59 per cent of fully automated users who believed every member of the team would be able to explain the audit.

While there was general unease about audits among the 75 finance chiefs who took part in the survey, users who relied on spreadsheets certainly felt more pressure than those who had implemented automated or semi-automated systems. While it clearly made a big difference, the point of the survey, though, wasn’t to grandstand the technology. Rather, it was a genuine desire to see how the biggest operational shift in UK payment service providers’ history was impacting the sector that Kani serves. 

Mind the gap

So, for those still worried about stressful audits, Binks offers this advice: “The most practical first step is to map the process as it works today, then identify where the weak points sit. That could be system limitations, gaps between data sources, manual workarounds, or areas where too much knowledge sits with one person or one team.

“Those single points of failure are where firms should focus their attention. The aim should be to reduce operational risk before it becomes a compliance issue.

“Automation has an important role to play, but the mindset matters just as much. Firms need confidence in the process, in the controls and in the evidence they can produce. That is the real shift CASS 15 requires.”

As firms get used to the new processes and expectations of the CASS 15 regime, there will likely be a boost in confidence. But, in the meantime, the big takeaway from Kani’s survey is that firms that have implemented automated processes are benefiting from a more streamlined workflow and less pressure. For those feeling under-confident about compliance and audits, automation could be the lifeline they are searching for.