In short
An insurance intermediary that holds client money under CASS 5 needs an annual client assets report from its auditor, unless it holds no client money or holds no more than £30,000 and only on a statutory trust. Each report covers a period ending not more than 53 weeks after the last one, and the auditor must deliver it to the firm within four months of the period end.
Key takeaways
- SUP 3.1.2R applies the client money audit to every insurance intermediary subject to CASS 5 except those holding no client money and those holding no more than £30,000 of client money only on a statutory trust.
- Firms operating a non-statutory trust always need the audit, and money held only as an insurer's agent under CASS 5.2 does not on its own bring a firm into scope.
- For insurance intermediaries the auditor delivers the report to the firm within four months of the period end, and to the FCA on request within six years (SUP 3.10.8AR), rather than sending it straight to the FCA.
- The report gives a reasonable assurance opinion on whether the firm's systems were adequate throughout the period and whether it complied at the reporting date, and must list every individual rule breach found.
- The firm must report the final report to its governing body (SUP 3.11.2R) and should give the auditor its explanation of each breach and the remedial action before the report is finalised.
Who needs a CASS 5 audit
The client money audit for insurance brokers comes from SUP 3, the part of the FCA's Supervision manual that deals with auditors. Row (10) of the table in SUP 3.1.2R covers an insurance intermediary, other than an exempt insurance intermediary, to which the insurance client money chapter applies, leaving out CASS 5.2. The auditor of a firm in that row is subject to SUP 3.10, which requires the client assets report.
Note 4 to the table sets the two exceptions. The audit applies to all insurance intermediaries except those that do not hold client money or other client assets in relation to insurance distribution, and those that hold up to, but not exceeding, £30,000 of client money under a statutory trust arising under CASS 5.3. The second group are exempt insurance intermediaries. The FCA's guidance on the retail mediation return puts the test the other way round: the audit is needed by firms that hold client money on a non-statutory trust, or that held more than £30,000 on a statutory trust at any time in the period.
Because CASS 5.2 is carved out, a firm that holds money only as an insurer's agent under valid risk transfer agreements holds no client money and is outside row (10). But insurer money held in client bank accounts by agreement under CASS 5.1.5AR is client money and counts. SUP 3.10.8CG makes senior management responsible for deciding, on a continuing basis, whether the firm is exempt, and for appointing an auditor as soon as it is not.
| Firm's position during the period | Client money audit needed? |
|---|---|
| Holds money only as insurers' agent under valid CASS 5.2 agreements | No |
| Statutory trust, highest balance never above £30,000 | No (exempt insurance intermediary) |
| Statutory trust, balance above £30,000 at any time | Yes |
| Non-statutory trust, any amount | Yes |
| Both trusts in use | Yes |
| Insurer money co-mingled in client accounts under CASS 5.1.5AR | Counts as client money in the tests above |
The period and the deadline
Each report covers a period that must end not more than 53 weeks after the end of the period covered by the previous report or, for a first report, after the firm is authorised or becomes subject to SUP 3.11 and its auditor becomes subject to SUP 3.10 (SUP 3.10.6R). The FCA does not prescribe the end date itself, so most firms align it with their financial year end.
The delivery rule for insurance intermediaries differs from other firms. SUP 3.10.7R requires most auditors to send the client assets report to the FCA within four months of the period end, but it excludes auditors of firms in row (10). For those firms, SUP 3.10.8AR requires the auditor to deliver the report to the firm so that it is received within four months of the end of each period, and to the FCA on request within six years of the period end. Before finalising, the auditor must give the firm a draft with enough time for the firm to consider the findings and comment (SUP 3.10.8DR(1)).
| Event | Date for a period ending 31 March 2026 | Rule |
|---|---|---|
| Period end | Tuesday 31 March 2026 | SUP 3.10.6R |
| Draft report to the firm for comment | With adequate time before the final deadline | SUP 3.10.8DR(1) |
| Firm's explanations of breaches back to the auditor | Before the final report is due | SUP 3.11.1G |
| Final report received by the firm | By Friday 31 July 2026 | SUP 3.10.8AR(1) |
| Final report to the firm's governing body | On receipt | SUP 3.11.2R |
| Latest end of the next period (53 weeks) | Tuesday 6 April 2027 | SUP 3.10.6R |
| Report available to the FCA on request | Until 31 March 2032 | SUP 3.10.8AR(2) |
What the report says
The auditor gives an opinion on whether the firm maintained systems adequate to comply with the client money rules, except CASS 5.2, throughout the period, and whether it was in compliance with them at the reporting date (SUP 3.10.5R(1) and (2)). Where a secondary pooling event has occurred, meaning a failure of a bank or other third party holding client money, the opinion also covers compliance with the distribution rules in CASS 5.6 (SUP 3.10.5R(4)).
A full report is a reasonable assurance engagement, which means the auditor must obtain enough evidence to give a positive opinion. A firm that claims to hold no client money gets a limited assurance report instead, saying whether anything has come to the auditor's attention suggesting it did (SUP 3.10.4R(2) and 3.10.4AR). The report must name every requirement not met and how (SUP 3.10.9R), identify each individual rule breached whether or not it changes the opinion, or state that none was found (SUP 3.10.9AR), and explain any requirement on which the auditor could not form an opinion (SUP 3.10.10R).
| Report content | Rule |
|---|---|
| Systems adequate throughout the period | SUP 3.10.5R(1) |
| Compliance at the reporting date | SUP 3.10.5R(2) |
| Compliance with the distribution rules after a secondary pooling event | SUP 3.10.5R(4) |
| Reasonable assurance for a full report; limited assurance for a no-client-money report | SUP 3.10.4AR |
| Each requirement not met, and in what respects | SUP 3.10.9R |
| Each individual rule breached, or a statement that none was found | SUP 3.10.9AR |
| Requirements on which no opinion could be formed, with reasons | SUP 3.10.10R |
What the auditor tests
The auditor tests the same records the firm relies on to run CASS 5. Expect sample testing of receipts against the banking deadline, re-performance of client money calculations, inspection of acknowledgement letters, and review of how commission was drawn. Although the opinion excludes CASS 5.2 itself, the auditor still needs to know which money falls outside the client money rules, so insurer agreements are usually requested to support any money treated as the insurer's.
The table maps the main areas to the rules and to the evidence an auditor will normally ask for.
| Area | Rule | Evidence asked for |
|---|---|---|
| Trust status | CASS 5.3.2R, 5.4.6R | Executed non-statutory trust deed, or confirmation the statutory trust applies |
| Non-statutory trust conditions | CASS 5.4.4R | Current auditor confirmation, designated manager, capital records, client terms |
| Acknowledgement letters | CASS 5.5.49R, 5.5.50R | Signed letter for every client bank account, with correct wording and title |
| Banking of receipts | CASS 5.5.5R, 5.5.6G, 5.5.12R | Receipt dates against bank credit dates for a sample period |
| Bank selection | CASS 5.5.43R | Due diligence on each bank, at least once each financial year |
| Calculation | CASS 5.5.63R(1), 5.5.64R | Every calculation in the period, the recorded method, funding of shortfalls |
| Bank reconciliations | CASS 5.5.63R(2) to (4) | Reconciliations within ten business days, with differences classified and cleared |
| Commission and mixed remittances | CASS 5.5.16R | Proof premium was received before commission was drawn; timing of withdrawals |
| Appointed representatives | CASS 5.5.18R, 5.5.19R | Record of the regime used for each and evidence of timely transfer |
| Notifications | CASS 5.5.61R, 5.5.76R, 5.5.77R | Any notifications made, and the firm's process for deciding |
The non-statutory trust confirmation is separate
A firm operating a non-statutory trust needs a second document from its auditor: the written confirmation under CASS 5.4.4R(2) that its systems and controls are adequate to manage client money and the credit risk from the trust. This is not part of the client assets report, and the annual report does not satisfy it.
The confirmation must be kept current. Many firms ask the auditor to refresh it at the same time as the annual report, so the confirmation reflects the controls that have just been tested. Our guide to the CASS 5 non-statutory trust covers the five conditions in full.
Worked example: when a small broker loses its exemption
A personal lines broker holds client money on a statutory trust and has treated itself as an exempt insurance intermediary. It monitors the highest balance on its client bank account each month. In July a block of renewals is paid before the premiums are passed to insurers, and the balance peaks at £41,800.00 for two days.
Because the exemption covers only firms that hold up to, but not exceeding, £30,000 on a statutory trust, the firm is no longer exempt once the balance passes £30,000. Under SUP 3.10.8CG senior management must recognise this and appoint an auditor. The broker has two lasting options: accept the audit, or change how money flows, for example by agreeing risk transfer with its insurers so premiums are received as their agent, so that the balance stays at or below £30,000.
| Month in 2026 | Highest client bank balance (GBP) | Above £30,000? |
|---|---|---|
| April | 18,250.00 | No |
| May | 22,940.00 | No |
| June | 27,610.00 | No |
| July | 41,800.00 | Yes: exemption lost, auditor needed |
| August | 24,300.00 | No, but the exemption has already been lost |
Preparation checklist
Audit preparation is mostly a matter of having each record complete and in one place before the auditor asks. The list below follows the order in which auditors usually work.
Breaches the firm has already found and recorded are far easier to explain than breaches the auditor finds. The report must list every individual rule breached, so there is no threshold below which a breach can be left out.
- Confirm the audit period end and that it falls within 53 weeks of the last period end.
- Assemble the trust file: executed deed and current auditor confirmation if a non-statutory trust is used.
- List every client bank account opened, closed or renamed in the period, with its signed acknowledgement letter.
- Record the calculation method and keep every calculation, with evidence that each shortfall was funded by close of business that day.
- Keep every bank reconciliation with dates, showing completion within ten business days and how each difference was cleared.
- Update the register of insurer agreements and match each to the money flows treated as the insurer's.
- Prepare evidence of bank due diligence for each bank, at least once in the financial year.
- Maintain a breach log with the rule, dates, amounts, cause, client impact and remedial action for every breach.
- Agree the timetable for the draft report so management can give explanations before the four-month deadline.
After the report
When the draft arrives, the firm should explain the circumstances of each breach and the remedial action taken or planned, and give that explanation to the auditor in time to be recorded in the report (SUP 3.11.1G). The final report must be reported to the firm's governing body (SUP 3.11.2R), and the FCA expects firms to use it to judge whether their systems work, building it into risk management and reviewing whether the auditor has the right skill and resources (SUP 3.11.3G and 3.11.4G). SUP 3.10.8CG points firms to SUP 3.7 and SUP 15 when deciding whether matters raised by the auditor should be notified to the FCA.
The simplest way to a clean report is to keep the calculation and reconciliation current all year, as described in our guide to insurance premium segregation and reconciliation, with every difference traced and recorded. For the rules themselves, see the CASS 5 client money rules.
Safeheld reconciles client money every day for regulated firms, works every difference to its cause and keeps the record auditors ask for, and is extending that work to CASS 5. If your firm holds client money under CASS 5, talk to us about CASS 5.
Frequently asked questions
Do insurance brokers need a CASS audit?
Yes, if they hold client money under CASS 5, unless they hold no more than £30,000 and only on a statutory trust. Firms holding money only as insurers' agents under CASS 5.2 hold no client money and are outside the requirement.
What is the £30,000 CASS 5 audit exemption?
An insurance intermediary that holds up to, but not exceeding, £30,000 of client money only on a statutory trust under CASS 5.3 is an exempt insurance intermediary and does not need a client money audit under SUP 3.1.2R.
When is the CASS 5 audit report due?
The auditor must deliver it so that the firm receives it within four months of the end of the period it covers, under SUP 3.10.8AR.
Does the CASS 5 audit report go to the FCA?
Not automatically. For insurance intermediaries the report goes to the firm, and the auditor must provide it to the FCA on request within six years of the period end.
How long is a CASS 5 audit period?
Each period must end not more than 53 weeks after the end of the previous period, or after authorisation for a first report, under SUP 3.10.6R.
Is the NST auditor confirmation the same as the CASS 5 audit report?
No. The confirmation under CASS 5.4.4R(2) that the firm's systems are adequate for a non-statutory trust is a separate document that must be kept current.
References
- FCA Handbook, SUP 3.1 Applicable sections
- FCA Handbook, SUP 3.10 Duties of auditors: notification and report on client assets
- FCA Handbook, SUP 3.11 Client assets report: firm responsibilities
- FCA Handbook, CASS 5.4 Non-statutory trust
- FCA Handbook, CASS 5.5 Segregation of client money
- FCA, RMA-C: Client money and assets FAQs
About Safeheld
Safeheld reconciles client money every day, resolves every difference and prepares every regulatory return for sign-off, for regulated firms in the United States, the United Kingdom, the European Union, Canada, Australia, Singapore and Hong Kong. To discuss your operations, contact us at safeheld.com/contact.
This article is for general information and does not constitute legal or regulatory advice.