Chartered Accountants and Professional Business Advisers

Senior Managers must be ready to give CASS compliance attestations

First published by Thompson Reuters Compliance Complete on 29 April 2015

Firms must stand ready for the Financial Conduct Authority (FCA) to issue "client assets sourcebook" (CASS) attestations, lawyers have warned.

Senior managers at asset managers and other firms will face greater scrutiny once the new FCA rules are fully in force as from June, they said. The alert has come shortly after the FCA said in its February board minutes that it would be increasing CASS visits.

"CASS supervision is a main theme in the FCA's Business Plan 2015/16. Attestations are a supervisory tool. As a logical inference, we anticipate firms will be required to give CASS compliance attestations," said Alix Prentice, partner, Taylor Wessing.

"Attestations are an early-stage regulatory tool, and have not led much to enforcement yet, but that will change. We think senior individuals in asset managers and other firms will face greater individual scrutiny for how they have led their firms' CASS requirements. The attestations are part of this," she said.

Prentice said that one way asset managers and others could protect themselves in advance from breaching the rules was by closely reading any of the FCA's previous CASS final notices which were relevant to their firm, although the specific focus would depend entirely on individual circumstances.

There is no shortage. The FCA has published 18 cases of CASS enforcement in recent years including, this month, the £126 million fine imposed on the Bank of New York Mellon, which dwarfed the £38 million fine of Barclays in September last year. In September 2013, the FCA fined Aberdeen Asset Managers and Aberdeen Fund Management £7.2 million.

Final notices

Prentice said she could not discuss any individual FCA action, but that firms should read the final notices and attempt to draw comparisons with their own situations. "Senior individuals must read closely the final notices on enforcement actions related to CASS and should measure their own firms' standards against the failures picked up on in the FCA's enforcement actions. They must make sure that they do not mirror the same mistakes. The advice for CASS is the same as in areas such as transaction reporting."

Delving into specifics, Judith Cromwell, consultant, Bovill, said that the FCA's fine of the Bank of New York Mellon was a warning for all CASS firms that client money remained high on the regulator's agenda. The biggest lesson from this fine, she said, was that firms must approach their CASS obligations on an entity-specific basis.

"The fundamental purpose of the CASS rules is to protect client assets in the event of a firm's insolvency, and since insolvency applies on a legal entity basis, it follows that firms must apply CASS in the same way. This can be a real problem for many firms who find it more efficient in every other regard to arrange their businesses along product or service lines," Cromwell said.

CASS breaches

Some hard decisions may need to be made. Nicola Higgs, senior associate, Ashurst, said that given the FCA's recent focus on CASS, firms must have a solid basis for deciding that a CASS breach did not need to be reported. "Where the line is drawn is dependent on each firm and its business. Firms must not assume, however, that there needs to have been a client detriment for a notification to be warranted. Given the current climate, firms would be wise to report most breaches at an early stage," Higgs said.

According to the Investment Association, asset managers should be ready for the regulator to ask questions about CASS even on non-CASS specific visits.

Susan Wright, regulatory and compliance specialist at the Investment Association, said that If firms got things wrong under the new CASS rules, which are to be finalised in June this year, a Section 166 order was possible, together with a significant fine.

"Firms should not assume that if a visit from the regulator is not CASS-specific, that questions will not be asked in this area. The FCA could quite easily include a question about CASS," she said. The CASS fines in the last two years or so had amounted to some £220 million, and compliance officers had not been excluded from the enforcement action, she said.

Wright said that there had been a CASS attestation letter in 2009, and that although another letter to senior individuals remained possible, the FCA would probably first want the rules to bed in. "What is on the regulator's mind is the event of insolvency in any firm that holds client money or client assets. Lehman's remains the main example, with its poor recordkeeping and the difficulty in trying to find out which Lehman’s entity had what."

For wealth managers, Ian Cornwall, director of regulation at the Wealth Management Association, said that CASS rules were one of three areas of regulation, along with suitability and conduct risk, where firms must be absolutely on top of the rules.

FCA visits inevitable

"The FCA's CASS supervisors will not make materiality judgements. They want to be sure that, if there is a default, there is no impediment to clients getting their money back promptly. They will visit firms; it is a question [of] not if, but when," Cornwall said.

"If an uncertainty arises, the firm should contact its CASS auditor in most cases and agree an interpretation of the rules. If it does not, there is the possibility that the auditor in its annual audit could disagree with the decision," Cornwall said.

"There are a few firms that do the majority of audits. This is quite a high-risk audit for them because there is no materiality threshold, and so they are under the cosh. If the FCA finds anything wrong, it may report this to the accounting professional bodies," he said.

Cornwall said that a major restraint under the FCA's new CASS rules was the abolition of unbreakable term deposits, which meant investment firms could no longer place client cash on deposit for longer than 30 days. "This is not business that banks want. The new rule can cause problems if the firm wants to diversify, which is a FCA requirement," he said.

The devil is in the detail. As Wright has said, tens of thousands of firms are subject to the CASS rules, from banks to consumer credit firms and prime brokers to asset managers, and not all have the same business model. She said that the emphasis would, as always, be on understanding client money flows, good recordkeeping practices and appropriate internal education. Part of this, she said, involved the FCA finalising the new rule changes, including faster money transfers and some standardisation, and there could be teething issues.

Wright said that one major change was that firms must re-paper all acknowledgement letters on client money accounts held by banks (previously called "trust letters"). The new acknowledgement letters must follow the FCA's template, with no deviation, and be on a firm's headed paper and signed by an authorised signatory at the bank. Wright said that any current delays in banks' responses were possibly just a blip.

"This is about standardisation, with the FCA introducing a template. Insolvency practitioners will now find it easier to identify the piece of paper that identifies the client account because they know what they are looking for," she said.

Bank impact

Away from any specific sector, it has been suggested that some banks are failing to respond quickly to signing the letters because of the operational impact on the client accounts in insolvency. The banks do not all have the infrastructure in place for this. There may also be capital to be held against the client accounts.

Rob Wood, of the financial services team at fund auditors Shipleys LLP, said he had found three main areas where many asset managers appeared to have underestimated the work involved and should focus attention now. The first area was the transfer of client money. Under the new FCA rules, asset managers must shrink the "delivery versus payment" window from three days to 24 hours, if they are to keep it at all. In practice, the 24-hour DvP would work only for electronic trading, however, and not if the asset managers should take in cheques or very large CHAPS payments from clients, because these could take longer than 24 hours to clear.

"Asset managers need direct consent from clients to the 24-hour DvP. They are worried that some clients may drop off," Wood said. Most asset managers in Shipleys' experience were using client money accounts, he said, which was much safer for their clients than DvP because it immediately segregated their funds.

Wood's second area of concern was the FCA's new money reconciliation requirements. Firms using client money accounts must make checks at least twice a day, compared with only once a day under DvP. The third area of concern, he said, was that firms using client money accounts must clear client funds before investing them, unlike when they used the DvP, where they could net funds.

"Asset managers may have to prop client funds with their own funds. Otherwise, they would have to wait to clear client funds, which takes too long, and so breaches FCA rules. Asset managers should be talking to their banks about cash flow, and possibly about setting up another account to transfer money," he said.

In such ways, there are practical decisions involved. Higgs said that one of the areas which required detailed consideration was the treatment of interest accrued on clients' accounts. "Firms must notify clients where they do not pay all the interest accrued and this, in turn, raises the question of how to classify and disclose any interest which is retained by the firm itself," she said.

Due diligence

Wood said that the regulator had not been specific about how far firms should conduct due diligence on banks. The more obscure the bank used, the more work the team should do, he said. Asset managers should keep meticulous documentation about due diligence carried out, and review it every year, or more frequently if there were reasons for concern about the credit rating.

"They need to do a bit of work for this, but when the FCA comes on a CASS visit, they will then be able to show they have the records," Wood said. The recording of calls was good for disputes but less so for agreeing unwritten mandates, and asset managers might wish to introduce a "tick-box" system and make notes on client agreements, which could be done on a spreadsheet, he said.

Higgs said that, in general, from June 1, firms would be subject to enhanced recordkeeping requirements to ensure that they could identify client money held for each client within two days. "This is particularly challenging for firms that have not yet moved to fully automated IT-based client money record keeping systems. Such firms are likely to need to invest more heavily in this area."


New regulation does not stop in June. The FCA will subsequently issue more CASS rules, with MiFID II, and Prentice said this was an opportunity to engage with the regulators. She said the FCA was clear it was a supervisor, not a practitioner, and when new rules come out, it would want operational feedback.

"The FCA wants to hear how execution is achieved. CASS is operational-heavy and any firm can add real value to the rules by talking to the regulator," Prentice said.

The bottom line is, however, that, as Higgs said, CASS failings attract zero tolerance from the regulator as it increases the number of visits it pays to firms. "Firms must be ready to demonstrate compliance with CASS," she said.