In short
A CASS audit is the independent examination behind the client assets report that a firm's auditor must send to the FCA under SUP 3.10. Where a firm holds client money or custody assets, the auditor gives reasonable assurance opinions on whether its systems were adequate throughout the period and whether it complied at the period end. The report must reach the FCA within four months of the period end.
Key takeaways
- Under SUP 3.10.4R the firm's auditor must submit a client assets report addressed to the FCA.
- The report is prepared under a reasonable assurance engagement where the firm holds client money or custody assets, and a limited assurance engagement where the firm claims not to hold them (SUP 3.10.4AR).
- The auditor gives two main opinions: whether the firm maintained adequate systems throughout the period, and whether it complied with the rules at the reporting date (SUP 3.10.5R).
- Each period must end no more than 53 weeks after the last, and the report must reach the FCA within four months of the period end (SUP 3.10.6R and 3.10.7R).
- The auditor must identify every rule it found breached, and the FRC standard says a breach being of minor significance is not a reason to leave it out.
- The firm receives a draft report in time to comment, and its responses sit alongside the breaches the auditor lists.
What a CASS audit is
A CASS audit is the work an auditor does to produce the client assets report required by SUP 3.10 of the FCA Handbook. CASS, the Client Assets Sourcebook, is the part of the Handbook that protects money and investments a firm holds for clients. The report tells the FCA whether the firm's systems for protecting client money under CASS 7 and custody assets under CASS 6 worked during the year and whether the firm was complying with the rules on the reporting date.
It is a separate engagement from the audit of the firm's accounts, even when the same firm of auditors does both. The Financial Reporting Council's standard, Providing Assurance on Client Assets to the Financial Conduct Authority, tells auditors how to do the work, and SUP 3.10.5BG says the FCA expects auditors to have regard to that material. The standard requires the auditor to adopt an insolvency mindset: to judge the firm's processes on the assumption that the firm may fail, because that is when the client asset rules matter most. Payment and e-money firms have their own safeguarding audit, covered in our guide to the CASS 15 safeguarding audit.
Reasonable assurance and limited assurance
Assurance describes how much comfort the auditor's work provides. Under reasonable assurance, the auditor gathers enough evidence to give a positive opinion that systems were adequate and the firm complied. Under limited assurance, the auditor does less work and gives a negative form of opinion: it states whether anything has come to its attention suggesting the firm held client money or custody assets when it says it did not.
SUP 3.10.4AR sets which applies. A firm that holds client money or custody assets gets a reasonable assurance report. A firm that claims not to hold them gets a limited assurance report on that claim. Where a firm holds one but claims not to hold the other, the report can contain both, which auditors often call a hybrid report.
| Firm's position | Engagement type | What the auditor states |
|---|---|---|
| Holds client money and custody assets | Reasonable assurance | Whether systems were adequate throughout the period and whether the firm complied at the reporting date |
| Claims not to hold client money or custody assets | Limited assurance | Whether anything has come to its attention suggesting the firm held them during the period |
| Holds one but claims not to hold the other | Both, in one report | Reasonable assurance on what it holds, limited assurance on what it says it does not hold |
The opinions in the report
SUP 3.10.5R sets out what a reasonable assurance report covers: whether the firm maintained systems adequate to comply with the relevant client asset rules throughout the period, and whether it was complying with them at the date the report is made up to. Where a subsidiary nominee company holds custody assets, the report also covers that company's systems, and if a secondary pooling event occurred, the report covers compliance with the rules for that event. SUP 3.10.5DG notes that auditors are not expected to assess Consumer Duty matters in this report.
The FRC standard sets out the possible outcomes. An unmodified opinion means the auditor found no reason to qualify. An 'except for' opinion is likely where the system generally works but there have been isolated breaches. An adverse opinion, stating that the firm did not maintain adequate systems or did not comply, applies where weaknesses are systemic or pervasive. Where the auditor cannot obtain enough evidence on a requirement, SUP 3.10 requires it to say so and explain why.
| Outcome | When it is used |
|---|---|
| Unmodified | No matters require qualification of either opinion |
| Qualified ('except for') | The system generally works, but there have been isolated breaches |
| Adverse | Weaknesses are systemic or pervasive, so the firm did not maintain adequate systems or did not comply |
| Unable to form an opinion | The auditor could not obtain sufficient appropriate evidence on a requirement |
The period and the deadline
SUP 3.10.6R requires each period to end no more than 53 weeks after the end of the period covered by the previous report. For a firm's first report, the period runs from when it was authorised or first became subject to the requirement. Most firms align the period with their accounting year end so that the two audits can be planned together.
SUP 3.10.7R requires the report to reach the FCA within four months of the end of the period. If the auditor expects to miss that deadline it must tell the FCA, with reasons, before the four months end, and if it does miss it, it must tell the FCA promptly (SUP 3.10.8R). Under SUP 3.10.8DR the auditor must give the firm a draft in time for comment and a copy of the final report when it goes to the FCA, so the firm's responses need to be ready well before the deadline.
| Milestone | Example date | Basis |
|---|---|---|
| Period end | 31 December 2026 | No more than 53 weeks after the previous period end (SUP 3.10.6R) |
| Auditor tests period-end reconciliations | January 2027 | Compliance at the reporting date (SUP 3.10.5R(2)) |
| Draft report and breaches list to the firm | March 2027 | Draft in time for comment (SUP 3.10.8DR) |
| Report received by the FCA | By 30 April 2027 | Within four months of period end (SUP 3.10.7R) |
What CASS auditors test
The FRC standard requires the auditor to check that control activities cover all client assets, to walk through the firm's processes, and to evaluate compliance with each relevant CASS rule at the period end, including by testing the internal and external reconciliations at that date. In practice the work follows the rules that create a firm's daily obligations, sampled across the year for the systems opinion and tested at the period end for the compliance opinion.
The table shows the areas most audits cover for an investment firm and the evidence the auditor will usually ask to see. Each is a rule a firm can test itself against during the year.
| Area | Rule | Evidence usually requested |
|---|---|---|
| Internal client money reconciliation each business day | CASS 7.15.15R | Daily reconciliations with dates, preparer and reviewer |
| Shortfalls paid in and excesses withdrawn the same day | CASS 7.15.29R | Transfer records matched to each reconciliation |
| External reconciliations no more than one month apart | CASS 7.15.22R and CASS 6.6.37R | Reconciliations to every bank and custodian statement |
| Internal custody record checks no more than one month apart | CASS 6.6.11R | Check records showing method, date and outcome |
| Acknowledgement letters for client bank accounts | CASS 7.18.2R | Countersigned letters in the template wording, one per account |
| Due diligence on custodians | CASS 6.3.1R | Selection and periodic review records |
| Notifications to the FCA | CASS 6.6.57R and CASS 7.15.33R | Breach register and copies of notifications sent |
The breaches schedule
If the report states that any requirement was not met, SUP 3.10.9R requires the auditor to specify each one and how it was not met, and SUP 3.10.9AR requires it to identify each individual rule breached, or to say that it found none. The FRC standard puts these in a breaches schedule and is explicit that size does not matter: a breach of minor significance is still listed, because the auditor must report all the breaches it identifies or that the firm tells it about. Where none are found, the auditor gives a nil return.
The schedule includes a column for the firm's own response, for which the auditor takes no responsibility. That response is the firm's chance to show it understood the cause and fixed it. Separately, the standard requires the auditor to report matters of material significance to the FCA as soon as practicable, rather than waiting for the report. A firm that has already notified the FCA of a notifiable breach, as our guide to CASS breach reporting explains, is in a far better position when the schedule arrives.
Worked example: a breaches schedule
A wealth manager holding £62 million of client money and £1.9 billion of custody assets has a period ending 31 December 2026. Its auditor's testing finds the four breaches below. The firm had logged three of them in its own breach register during the year, with cause and fix recorded, and had notified the FCA of the third without delay. The fourth was found by the auditor.
Because the system generally worked and the breaches were isolated and corrected, this is the kind of result the FRC standard links to an 'except for' opinion rather than an adverse one, although the judgement is the auditor's. The unlogged acknowledgement letter error is the one that would most concern a supervisor, because it suggests the firm's own checks missed it.
| Rule | What happened | Logged by firm? | Firm's response |
|---|---|---|---|
| CASS 7.15.15R | Internal reconciliation not performed on 3 June due to a data feed failure; performed on 4 June | Yes | Backup data route added; no shortfall arose |
| CASS 7.15.29R | £18,250 shortfall on 9 August paid in the next morning rather than by close of business | Yes | Cut-off for treasury transfers moved earlier |
| CASS 7.15.22R | External reconciliation for a euro account missed for six weeks after a system change | Yes, notified to the FCA | Account added to the reconciliation schedule; change process updated |
| CASS 7.18.2R | Acknowledgement letter for a new account altered the template wording | No | Letter replaced in the correct wording; letter review added to account opening |
How to prepare for a CASS audit
The best preparation happens during the year, not in the weeks before fieldwork. Keep a breach register that records every breach when it is found, with rule, cause, clients affected, fix and whether it was notified. Keep a document that maps each applicable CASS rule to the control that meets it and the evidence that control produces, because auditors usually ask for it first. Check every acknowledgement letter against the template in CASS 7 Annex 2 when the account is opened, not when the auditor asks.
Make sure each reconciliation shows who prepared it, who reviewed it, when, and what happened to every difference. Report to the governing body through the person responsible for CASS oversight, as our guide to CASS operational oversight describes, so the audit confirms what the board already knows. For CASS medium and large firms, make sure the monthly CMAR agrees with the records the auditor will test.
Where CASS audits most often find problems
Auditors and practitioners repeatedly point to the same areas. Acknowledgement letters that depart from the template wording, even slightly. Client money that passes through a payment service provider's account, which is not a client bank account. Transfers after a reconciliation that are late or wrong. Prudent segregation, where a firm adds its own money to client accounts as a buffer, without the written policy approved by the governing body that CASS 7.13.43R requires. Breach registers that are incomplete or do not agree with the reconciliation records.
Each of these is visible in the records long before the audit. A firm that reviews its own evidence against the auditor's likely tests each quarter will find most of them while they are still small, and will be able to show the fix in its response.
Safeheld reconciles client money every day for regulated firms, works every difference to its cause and keeps the record auditors ask for, and is extending that work to CASS 6 and CASS 7. If your firm holds client money or custody assets under CASS, talk to us about CASS audit readiness.
Frequently asked questions
What is a CASS audit?
The independent work behind the client assets report that a firm's auditor must send to the FCA under SUP 3.10, giving opinions on the firm's client money and custody systems and compliance.
When is the CASS audit report due?
Within four months of the end of the period it covers under SUP 3.10.7R. Each period must end no more than 53 weeks after the previous one.
What is the difference between reasonable and limited assurance in a CASS audit?
Reasonable assurance gives a positive opinion on systems and compliance where the firm holds client assets. Limited assurance applies where the firm claims not to hold them, and states only whether anything suggests it did.
Is materiality applied to CASS audit breaches?
No. The FRC standard requires the auditor to report all breaches it identifies, and says a breach being of minor significance is not a relevant consideration.
Does a firm that holds no client money need a CASS audit?
Where the firm's auditor is required to report under SUP 3.10 and the firm claims not to hold client money or custody assets, the auditor reports under a limited assurance engagement on whether anything suggests it held them.
Does the firm see the CASS audit report before the FCA?
Yes. SUP 3.10.8DR requires the auditor to give the firm a draft in time for comment and a copy of the final report when it is sent to the FCA.
References
- FCA Handbook, SUP 3.10 Duties of auditors: notification and report on client assets
- FRC, Providing Assurance on Client Assets to the Financial Conduct Authority (November 2019)
- FCA Handbook, CASS 7.15 Records, accounts and reconciliations
- FCA Handbook, CASS 6.6 Records, accounts and reconciliations
- FCA Handbook, CASS 7.18 Acknowledgement letters
About Safeheld
Safeheld reconciles client money every day, resolves every difference and prepares every regulatory return for sign-off, for regulated firms in the United States, the United Kingdom, the European Union, Canada, Australia, Singapore and Hong Kong. To discuss your operations, contact us at safeheld.com/contact.
This article is for general information and does not constitute legal or regulatory advice.