In short
A CASS breach must be notified to the FCA in writing without delay when it falls within CASS 7.15.33R or CASS 6.6.57R, such as materially inaccurate records, a shortfall the firm cannot cover or a reconciliation it cannot perform. Any other significant rule breach must be notified immediately under SUP 15.3.11R. Every breach, however small, belongs in the firm's breach register and in the auditor's report.
Key takeaways
- CASS 7.15.33R lists six client money events, and CASS 6.6.57R lists the custody events, that must be notified to the FCA in writing without delay.
- SUP 15.3.11R requires any significant breach of a rule to be notified immediately the firm becomes aware of it, with significance judged by factors such as potential loss to clients and delays in finding or fixing the breach.
- A notification must be in writing, in English and delivered by a permitted method such as online submission; one that does not follow SUP 15.7 is invalid.
- Other CASS events have their own notice rules, including resolution pack failures, adopting the alternative approach and the annual CASS firm type notice.
- The CMAR asks whether notifiable events arose in the month, but filing it does not count as notifying the FCA.
- The auditor must list every rule breached in the client assets report, so a complete breach register kept during the year is essential.
What counts as a CASS breach
A CASS breach is any failure to comply with a rule in the Client Assets Sourcebook: a reconciliation done a day late, a shortfall paid in the next morning, an acknowledgement letter with the wrong wording, a record that does not agree with the bank. It is broader than a loss of client money, and most breaches cause no loss at all.
Breaches fall into three groups for reporting purposes. Some must be notified to the FCA without delay under specific CASS rules. Others must be notified immediately because they are significant under SUP 15.3.11R. All of them, including those that are neither, must be recorded and will appear in the auditor's report to the FCA.
| Group | Rule | Timing | Example |
|---|---|---|---|
| Specific CASS notification | CASS 7.15.33R, CASS 6.6.57R | In writing, without delay | A shortfall the firm cannot pay in by close of business |
| Significant breach of any rule | SUP 15.3.11R | Immediately the firm becomes aware | Repeated late reconciliations affecting many clients |
| Every other breach | SUP 3.10.9AR (auditor reporting) | Recorded when found; listed in the annual client assets report | One internal reconciliation performed a day late, no loss |
Client money notifications under CASS 7.15.33R
CASS 7.15.33R requires a firm to inform the FCA in writing without delay if any of six things happens. Its internal records and accounts of client money are materially out of date, inaccurate or invalid. It will be unable to, or materially fails to, pay in a shortfall or withdraw an excess as CASS 7.15.29R requires. It will be unable to, or materially fails to, resolve a discrepancy found by an external reconciliation.
The other three: it will be unable to, or materially fails to, perform internal client money reconciliations; it will be unable to, or materially fails to, perform external client money reconciliations; or it becomes aware that, at any time in the preceding 12 months, the amount of client money segregated differed materially from what it should have been. The last one means a firm cannot treat a historic problem found today as out of scope. Our guide to CASS 7 client money rules explains the reconciliations behind each item.
Custody notifications under CASS 6.6.57R
CASS 6.6.57R uses the same structure for custody assets. A firm must inform the FCA in writing without delay if its internal records of safe custody assets are materially out of date, inaccurate or invalid so that it cannot comply with the record rules; if it will be unable to, or materially fails to, take the steps CASS 6.6.54R requires to cover a shortfall; or if it will be unable to, or materially fails to, conduct internal custody record checks, physical asset reconciliations or external custody reconciliations.
Firms acting as trustee or depositary of an investment fund have additional items tied to the fund rules. The checks and shortfall steps behind each item are covered in our guide to CASS 6 custody rules.
Significant breaches under SUP 15
SUP 15.3.11R requires a firm to notify the FCA of a significant breach of a rule, and SUP 15.3.11R(2) says the notification must be made immediately the firm becomes aware, or has information which reasonably suggests, that the breach has occurred or may occur. SUP 15.3.12G says significance is judged having regard to potential financial losses to customers, and to other factors including whether there were delays in identifying or rectifying the breach.
This sits alongside Principle 11, which requires a firm to deal with the FCA in an open and cooperative way. SUP 15.3.8G gives examples of what that includes, such as any significant failure in the firm's systems or controls. A run of small CASS breaches with the same cause can therefore become notifiable as a systems failure even if no single breach would be.
Other CASS notifications
Several CASS rules require the FCA to be told about planned changes or particular events, separate from breaches. Missing one of these is itself a breach.
These notices are easy to overlook because they are triggered by business decisions, such as launching a product line or changing banks, rather than by an operational failure. Building a check for each into the firm's change approval process is the simplest control.
| Event | Rule | Timing |
|---|---|---|
| Failure to comply with the CASS resolution pack rules | CASS 10.1.16R | In writing, immediately |
| Adopting the alternative approach for a business line | CASS 7.13.57R | At least three months before |
| Using a non-standard method of internal client money reconciliation | CASS 7.15.18R | Before using it, with an auditor's report |
| CASS firm type and highest amounts held | CASS 1A.2.9R | By the fifteenth business day of January |
| Choosing not to apply the 20 per cent group deposit limit | CASS 7.13.21CR | When the assessment is made or changed |
How to notify the FCA
SUP 15.7.1R requires a notification to be in writing, in English, and on the form specified for that rule, or the general notification form in SUP 15 Annex 4R where none is specified. SUP 15.7.4R and SUP 15.7.5AR require it to reach the firm's usual supervisory contact by a permitted method, which includes online submission through the FCA's website and email with electronic confirmation of receipt. SUP 15.7.15G warns that a notification that does not follow these rules is invalid.
A useful notification answers the questions a supervisor will ask: what happened, which rules are affected, how many clients and how much money or assets are involved, when it started and when it was found, what has been done to protect clients, what caused it, and what will stop it happening again. Where the cause is not yet known, notify what is known and follow up; waiting for a complete picture defeats the purpose of 'without delay'.
Worked example: a missed external reconciliation
An investment platform migrates its bank statement feeds on 1 September 2026. On Monday 12 October its CASS team notices that one euro client bank account dropped out of the external reconciliation schedule in the migration. The last external reconciliation of that account covered 31 August, so more than one month has passed, breaching CASS 7.15.22R. Because the firm has materially failed to perform an external reconciliation, CASS 7.15.33R requires written notice to the FCA without delay.
The firm performs the reconciliation the same day. It finds a €14,200.00 difference: bank charges debited to the client account rather than to the firm's own account. Until the bank reverses them, CASS 7.15.32R requires the firm to assume the record showing the greater need is right and pay in its own money. It notifies the FCA on 12 October, pays in the equivalent of €14,200.00 the same day, logs the breach, and answers Yes to the breach questions in the October CMAR.
| Date | Event | Rule | Action |
|---|---|---|---|
| 1 September | Statement feed migration; euro account drops out of schedule | CASS 7.15.22R | Not detected |
| 12 October | Gap found; last reconciliation was 31 August | CASS 7.15.22R breached | Reconciliation performed the same day |
| 12 October | Material failure to perform external reconciliation | CASS 7.15.33R | Written notification to the FCA without delay |
| 12 October | €14,200.00 of bank charges found in the client account | CASS 7.15.31R and 7.15.32R | Investigate; pay in own money until resolved |
| October CMAR | Breach questions in section 8 | SUP 16 Annex 29R | Answer Yes and confirm notification was made |
| Year end | Breach listed by the auditor | SUP 3.10.9AR | Firm's response records the cause and the fix |
Keeping a CASS breach register
A breach register is the firm's own list of every CASS breach. No rule prescribes its format, but the auditor must identify every rule breached in the client assets report under SUP 3.10.9AR, and the FRC standard says a breach of minor significance is still reported. The register is how the firm makes sure the auditor's list holds no surprises and how the oversight holder shows the board that problems are found and fixed.
Each entry should record the rule, a description, the dates it occurred, was found and was corrected, the clients and amounts affected, the cause, whether it was notifiable and when it was notified, and the action taken to prevent a repeat. The register should agree with the reconciliation exception records and with section 8 of the CMAR, and it is one of the first documents a CASS auditor will ask for.
| Field | Why it matters |
|---|---|
| Rule reference | The auditor reports by individual rule |
| Dates occurred, identified and corrected | Delay in finding or fixing a breach affects whether it is significant |
| Clients and amounts affected | Potential loss to clients is the first significance factor |
| Root cause | Shows whether breaches share a systems failure |
| Notifiable, and date notified | Evidence that 'without delay' was met |
| Preventive action and owner | Shows the firm stopped it recurring |
Deciding quickly whether to notify
Most notification failures are decisions made too slowly, not decisions made wrongly. A firm should write down in advance what it treats as material for the 'materially fails' and 'materially out of date' tests, who decides, and how fast. The decision should sit with the person responsible for CASS oversight, as our guide to CASS operational oversight describes, with a deputy named for absences.
When in doubt, notify. A notification that turns out to be unnecessary costs a conversation with a supervisor; one that turns out to be late is a further breach. Payment and e-money firms follow a separate regime, covered in our guide to safeguarding breach notification.
Safeheld reconciles client money every day for regulated firms, works every difference to its cause and keeps the record auditors ask for, and is extending that work to CASS 6 and CASS 7. If your firm holds client money or custody assets under CASS, talk to us about CASS breach reporting.
Frequently asked questions
What is a notifiable CASS breach?
An event listed in CASS 7.15.33R or CASS 6.6.57R, such as materially inaccurate records, a shortfall the firm cannot cover, or reconciliations it cannot or materially fails to perform. Significant breaches of any rule are also notifiable under SUP 15.3.11R.
How quickly must a CASS breach be reported to the FCA?
In writing without delay for the CASS 7.15.33R and 6.6.57R events, and immediately the firm becomes aware for a significant breach under SUP 15.3.11R.
How do you notify the FCA of a CASS breach?
In writing and in English, to the firm's usual supervisory contact by a method in SUP 15.7.5AR, such as online submission through the FCA's website. A notification that does not follow SUP 15.7 is invalid.
Do all CASS breaches need to be reported to the FCA?
Not individually at the time. Only notifiable and significant breaches are notified straight away, but every breach the auditor identifies is listed in the annual client assets report.
Does the CMAR count as notifying the FCA of a breach?
No. The CMAR asks whether notifiable events arose and were notified, but the FCA's guidance says filing it does not discharge the duty to notify without delay.
What should a CASS breach register contain?
The rule breached, what happened, when it occurred, was found and was fixed, the clients and amounts affected, the cause, whether and when it was notified, and the preventive action.
References
- FCA Handbook, CASS 7.15 Records, accounts and reconciliations
- FCA Handbook, CASS 6.6 Records, accounts and reconciliations
- FCA Handbook, SUP 15.3 General notification requirements
- FCA Handbook, SUP 15.7 Form and method of notification
- FCA Handbook, CASS 10.1 CASS resolution pack
- FCA Handbook, SUP 3.10 Duties of auditors: notification and report on client assets
About Safeheld
Safeheld reconciles client money every day, resolves every difference and prepares every regulatory return for sign-off, for regulated firms in the United States, the United Kingdom, the European Union, Canada, Australia, Singapore and Hong Kong. To discuss your operations, contact us at safeheld.com/contact.
This article is for general information and does not constitute legal or regulatory advice.