The client assets rules exist for one purpose: if a regulated firm fails, the money and assets belonging to its clients should be identifiable, intact and returnable without joining the queue of creditors. That is why CASS breaches are treated more seriously than most compliance failures — a breach is not a procedural slip, it is a gap in the protection that separates client property from the firm's.
What a breach actually is
A CASS breach is any failure to comply with the client money or custody asset rules, and the range runs from the trivial to the existential:
- Segregation failures — client money not paid into a client bank account promptly, or firm money left in a client account beyond the permitted period;
- Reconciliation failures — internal or external reconciliations not performed, not performed on time, or performed and not reviewed, with differences uninvestigated;
- Shortfalls — the client money resource falling below the client money requirement, which must be funded by the firm from its own money immediately;
- Documentation failures — a bank acknowledgement letter missing, in the wrong form, or not updated after an account change. This is the single most common finding, and the rules are prescriptive about the wording;
- Record failures — records that do not allow the firm to distinguish one client's assets from another's, or from its own;
- Resolution pack deficiencies — the pack that would let an insolvency practitioner return assets quickly not being complete or retrievable within the required timeframe.
What to do when one is found
The sequence matters and it is not negotiable in its first step. Fix the client position first: where there is a shortfall, the firm pays its own money into the client account immediately, before any investigation, analysis or internal debate about whose fault it was. Every other step follows.
Then: record the breach in the register; establish the cause and, crucially, the period over which it existed, because a control that failed in March probably failed in February too; assess whether other clients or other processes are affected; and remediate the control rather than the instance. Do not read that as a sequence ending in notification. Containment, assessment, escalation, notification and remediation run in parallel: where a breach meets a notification trigger, the obligation is not suspended while the fix is built, and the identification of the applicable rule and its deadline is part of the first hour's work rather than the last.
Notification is where firms get into trouble. The rules require prompt notification of significant breaches, and firms routinely delay while they investigate, on the reasonable-sounding basis that they want to report complete facts. The FCA's consistent position is that it wants to know early, with an incomplete picture, and be updated — not to learn months later that a firm knew and was working on it. A late notification turns a control failure into a transparency failure, and the second attracts more regulatory consequence than the first.
The annual CASS audit
Firms holding client money or custody assets must obtain a client assets report from an auditor and submit it to the FCA. It is not part of the financial statement audit: it is a separate reasonable assurance engagement examining whether the firm maintained systems adequate to comply throughout the period, and whether it was compliant at the period end.
The report is qualified where breaches are identified, and the breaches are listed. Firms sometimes assume a qualified report is a private matter between them and their auditor. It is not — it goes to the FCA, it is read, and a pattern of qualifications across years is precisely the trigger for supervisory attention.
The practical consequence: the time to deal with a control weakness is when it is found internally, not when the auditor lists it. A breach identified by the firm, remediated and notified reads very differently from the same breach discovered by an auditor six months later.
Why breaches happen
Rarely through dishonesty. The recurring causes are structural: growth outpacing the operations team; a system change that altered how client money was flagged without anyone testing the CASS impact; an outsourced administrator whose reconciliation output nobody reviewed; and key-person dependency, where one person understood the client money calculation and left.
The CASS oversight function is a senior management responsibility under the regime, and where it is held by someone without the authority or the time to challenge operations, the failures accumulate quietly. The firms with clean reports are consistently those where the oversight holder sees the reconciliation exceptions weekly rather than the summary quarterly.
Staying out of trouble
Reconcile daily where the rules require it, and review the reconciliations — performance without review is not a control. Keep acknowledgement letters current and mapped to every account, re-issuing whenever an account or a bank changes. Test the resolution pack annually by asking someone unfamiliar to retrieve it. Assess the CASS impact of every system and process change before it goes live. And maintain the breach register honestly, because a register with nothing in it tells a supervisor that the firm is not finding its own problems.
Acumon acts as CASS auditor and advises on client asset controls through CASS audit and financial services audit work, with outsourced internal audit for firms wanting assurance between annual reports — and the prudential side covered in our guide to the ICARA. If a breach has been found, the first question is whether the client position has been made good today.