CASS Firm Classification and Operational Oversight: Small, Medium and Large Firms

    In short

    CASS 1A classifies investment firms as CASS small, medium or large by the highest client money and custody assets held in the previous calendar year. Medium starts at £1 million of client money or £10 million of assets; large means more than £1 billion or £100 billion. Every firm must give one director or senior manager responsibility for CASS oversight, and medium and large firms add the CMAR.

    Key takeaways

    • CASS 1A applies to firms subject to the custody rules in CASS 6, the client money rules in CASS 7, or both.
    • A firm is CASS large above £1 billion of client money or £100 billion of custody assets, CASS medium from £1 million or £10 million, and CASS small below both, with the higher category applying.
    • The figures are the highest amounts held in the previous calendar year, based on the internal reconciliations of that year, and the firm must notify the FCA of its type by the fifteenth business day of January.
    • A CASS small firm must give a single director or senior manager oversight of its operational compliance with CASS; a medium or large firm must give one person oversight of its CASS systems and controls, reporting to the board and completing the CMAR.
    • Under the senior managers regime, responsibility for the firm's compliance with CASS is prescribed responsibility (z), which applies to core and enhanced firms subject to CASS.
    • The CASS 1A.3.1AR function itself is not a separate controlled function; if it is given to someone who is not a senior manager, it becomes a certification function.

    What CASS 1A does

    CASS 1A is the chapter of the FCA's Client Assets Sourcebook that sorts firms by size and makes someone senior answerable for client assets. Under CASS 1A.1.1R it applies to a firm subject to either or both of the custody rules in CASS 6 and the client money rules in CASS 7. Client money held under the insurance rules in CASS 5 is left out of the calculation, and a firm subject only to CASS 6 because it arranges custody for others is outside the chapter.

    The classification matters because it decides how much reporting a firm does. CASS medium and large firms file the monthly CMAR and give their oversight holder a wider role; CASS small firms do neither. For an overview of every chapter in the sourcebook, see what CASS is.

    The CASS firm classification thresholds

    The thresholds are in the table in CASS 1A.2.7R. They apply separately to client money and to safe custody assets, and a firm's type is set by whichever of the two puts it in the higher category. A firm with modest client money but a large custody book is therefore classified by its custody book.

    Because the two measures are tested separately and the higher result applies, a firm needs to track both peaks through the year, not only the one it thinks of as its main business. A firm close to a threshold should check its daily figures well before January so the result does not come as a surprise.

    CASS firm typeHighest client money in previous yearHighest safe custody assets in previous yearFiles CMAR
    CASS large firmMore than £1 billionMore than £100 billionMonthly
    CASS medium firm£1 million or more, up to £1 billion£10 million or more, up to £100 billionMonthly
    CASS small firmLess than £1 millionLess than £10 millionNo

    How the classification is calculated

    Under CASS 1A.2.2R a firm uses the highest total amount of client money and the highest total value of safe custody assets it held during the previous calendar year to 31 December. CASS 1A.2.3R says those daily figures come from the internal reconciliations performed during that year. Foreign currency is converted at the previous day's closing spot rate and custody assets are valued at the previous day's closing mark to market value, meaning their market price at the close of the previous day.

    The test uses the peak, not the average, so one busy day can move a firm up a category for the whole of the following year. A firm that did not hold client money or custody assets in the previous year but expects to this year uses its projected peak. A firm may also choose to be treated as a higher category under CASS 1A.2.5R by notifying the FCA in writing at least one week beforehand, provided the FCA has not objected.

    Notifying the FCA of your CASS firm type

    CASS 1A.2.9R requires a firm that held client money or custody assets in the previous year to notify the FCA of its highest amounts and its CASS firm type no later than the fifteenth business day of January. A new firm must notify no later than the business day before it begins to hold client money or custody assets. Under CASS 1A.2.12R the classification takes effect on 1 February following a January notification, or on the day a new firm begins to hold.

    The January notice is easy to miss because it falls in the same weeks as year-end work. The table shows the dates for the 2027 cycle, counting business days in England and Wales.

    StepDateRule
    Calculation period ends31 December 2026CASS 1A.2.2R
    Notification due (fifteenth business day of January)Friday 22 January 2027CASS 1A.2.9R(1)
    New classification takes effectMonday 1 February 2027CASS 1A.2.12R
    First CMAR after moving up to medium or largeReturn for March 2027, due in April 2027SUP 16.14.3R(3)

    Worked example: classifying a stockbroker

    An execution-only stockbroker reviews its 2026 internal reconciliation records. Its client money never exceeded £840,000.00, which on its own would make it a CASS small firm. But its safe custody assets peaked at £14,600,000.00 on 18 November 2026, when a large client transferred in a portfolio. That figure is above the £10 million threshold for safe custody assets.

    Because the higher category applies, the firm is a CASS medium firm for the year from 1 February 2027. It must notify the FCA by 22 January 2027, start filing the monthly CMAR, and widen its oversight holder's role from the small firm duty in CASS 1A.3.1R to the medium firm function in CASS 1A.3.1AR, including the CMAR.

    Measure2026 peakCategory on its own
    Highest client money£840,000.00CASS small (less than £1 million)
    Highest safe custody assets£14,600,000.00CASS medium (£10 million or more)
    CASS firm type from 1 February 2027CASS medium (the higher category)

    The oversight responsibility by firm type

    CASS 1A.3.1R requires a CASS small firm to give a single director or senior manager of sufficient skill and authority responsibility for oversight of the firm's operational compliance with CASS and for reporting to the governing body on that oversight. CASS 1A.3.1AR requires a CASS medium or large firm to give a single director or senior manager the function of overseeing the operational effectiveness of its CASS systems and controls, reporting to the governing body on that oversight, and completing and submitting the CMAR.

    The medium and large firm role comes with two further rules. Under CASS 1A.3.2AR the firm must not give the person other responsibilities unless it is reasonably satisfied they can still discharge the CASS role effectively and that the firm's full compliance with CASS will not be compromised. Under CASS 1A.3.2BR the role may be shared only as part of a job share. CASS 1A.3.3R requires a record of who holds the role, kept for five years, although a small firm needs one only if it gives the role to someone other than the holder of its compliance oversight function.

    CASS small firmCASS medium or large firm
    RuleCASS 1A.3.1RCASS 1A.3.1AR
    WhoA single director or senior manager of sufficient skill and authorityA single director or senior manager of sufficient skill and authority
    Oversight ofOperational compliance with CASSOperational effectiveness of CASS systems and controls
    Reports toThe governing bodyThe governing body
    CMARNot filedCompletes and submits it
    Other responsibilitiesNot restricted by CASS 1A.3.2AROnly if the firm is satisfied the CASS role is not compromised

    How CASS oversight fits the senior managers regime

    The senior managers and certification regime, SM&CR, is the FCA's framework for making named individuals accountable. Under it, firms must give each prescribed responsibility to a senior manager. The table in SYSC 24.2.6R lists responsibility (z): responsibility for the firm's compliance with CASS, which applies only to firms subject to CASS. SYSC 24 Annex 1 applies it to UK core firms, overseas core firms and enhanced scope firms. The FCA's CMAR guidance refers to the holder as the CASS PR(z).

    CASS 1A.3.1BG explains how the two fit together. The CASS 1A.3.1AR function is not a separate controlled function and does not need approval as an approved person, although the term 'CASS operational oversight function' is still widely used for it. The firm may give that function to the senior manager holding responsibility (z), or to someone who is not a senior manager. In the last case the person falls under the certification regime as the CASS oversight certification function in SYSC 27.8.1R, supervised by the holder of responsibility (z).

    What the oversight holder actually does

    The rules set the allocation; the day-to-day role is to know at any time whether client money and custody assets are intact and whether every required check happened on time. That means reviewing the daily reconciliations and the exceptions they raise, deciding promptly whether an event must be notified to the FCA, signing off the monthly CMAR, and reporting to the board on trends, not just totals. Our guide to continuous CASS oversight covers that practice in depth.

    The holder is also the person the FCA and the auditor will ask first when something goes wrong. A clear record of what they saw, when, and what they decided, kept alongside the breach register, is what lets them answer.

    Safeheld reconciles client money every day for regulated firms, works every difference to its cause and keeps the record auditors ask for, and is extending that work to CASS 6 and CASS 7 oversight. If your firm holds client money or custody assets under CASS, talk to us about CASS oversight.

    Frequently asked questions

    What are the CASS firm classifications?

    CASS large (more than £1 billion of client money or £100 billion of custody assets), CASS medium (£1 million to £1 billion, or £10 million to £100 billion) and CASS small (below both lower thresholds), under CASS 1A.2.7R.

    How is CASS firm type calculated?

    From the highest client money and highest custody asset values held at any point in the previous calendar year, taken from that year's internal reconciliations. The higher of the two resulting categories applies.

    When must a firm notify the FCA of its CASS firm type?

    No later than the fifteenth business day of January under CASS 1A.2.9R, with the classification taking effect on 1 February.

    Who is responsible for CASS oversight?

    A single director or senior manager of sufficient skill and authority, allocated under CASS 1A.3.1R for small firms or CASS 1A.3.1AR for medium and large firms.

    Is the CASS oversight role a senior management function?

    No. Compliance with CASS is prescribed responsibility (z), held by a senior manager, but the CASS 1A.3.1AR function is not a separate controlled function and can be given to a non-senior manager under the certification regime.

    Can the CASS oversight holder have other responsibilities?

    In a medium or large firm, only if the firm is reasonably satisfied the person can still discharge the CASS role effectively and full compliance with CASS will not be compromised (CASS 1A.3.2AR).

    References

    About Safeheld

    Safeheld reconciles client money every day, resolves every difference and prepares every regulatory return for sign-off, for regulated firms in the United States, the United Kingdom, the European Union, Canada, Australia, Singapore and Hong Kong. To discuss your operations, contact us at safeheld.com/contact.

    This article is for general information and does not constitute legal or regulatory advice.

    See it on your own accounts.