What is CASS? The FCA Client Assets Sourcebook Explained

The Client Assets Sourcebook is one of the specialist sourcebooks in the Business Standards block of the FCA Handbook, alongside sourcebooks such as SYSC (systems and controls) and SUP (supervision). Its job is narrow and specific: it governs how a firm handles money and assets that belong to its clients when the firm holds those assets in the course of its regulated business, rather than as principal.

The reason CASS exists as a discrete sourcebook, rather than a set of general conduct principles, is that client asset protection has a distinct failure mode. If a firm becomes insolvent, client money and client assets need to be identifiable, segregated from the firm's own estate, and returnable, so that clients do not become unsecured creditors standing behind the firm's other liabilities. CASS is built around that outcome. Its rules on segregation, reconciliation, records and reporting all exist to make that outcome achievable in practice, not just in principle.

CASS applies by activity, not by firm label. A firm's permissions and the way it actually holds client money or assets determine which chapters bite. This is the point most readers new to the sourcebook get wrong, and it matters enough that it has its own section below.

CASS 1A sets the firm-level oversight requirement for firms within the main CASS regime: a director or senior manager of sufficient skill and authority must be allocated responsibility for oversight of the firm's operational compliance with CASS, with reporting to the governing body. It is a governance chapter, not a reconciliation chapter, and it sits above the substantive chapters rather than alongside them.

CASS 5 governs client money held by insurance intermediaries in connection with insurance mediation activity. It has its own segregation and reconciliation logic, separate from the investment firm regime in CASS 7, because premium handling has a different commercial shape from investment client money.

CASS 6 governs custody: safe custody assets, meaning client securities and other assets a firm holds or arranges to be held on a client's behalf. It requires internal record checks and external reconciliations against custodian statements, and it treats a shortfall in a specific asset as something to be made good in kind, not simply funded in cash.

CASS 7 governs client money for investment business: cash held for clients rather than assets. It requires internal reconciliation of the client money resource against the client money requirement, and external reconciliation against banking records, with same-day correction where the two diverge.

CASS 7A sets out how client money is distributed if a firm holding it fails. It is the chapter that determines what actually happens to a pool of client money on insolvency, including the primary pooling arrangement, and it is the reason the rest of CASS is written the way it is: everything upstream exists to make CASS 7A workable when it is needed.

CASS 9 requires firms to give clients specific information about how their money or assets are held, including whether they are held in a way that provides the statutory trust protection and what happens to unclaimed client money. It is a disclosure chapter, sitting alongside the operational chapters rather than duplicating them.

CASS 10A requires firms in scope of the safeguarding regime to maintain a resolution pack, being the set of records that allows an insolvency practitioner to identify and return relevant funds quickly if the firm fails, without having to reconstruct the firm's books from scratch. It came into force alongside CASS 15 on 7 May 2026.

CASS 15 is the newest chapter and the one this article treats in most detail below. It sets safeguarding requirements for payment institutions and electronic money institutions holding relevant funds under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011.

A recurring confusion is treating 'client money' and 'client assets' as interchangeable. They are not, and CASS keeps them apart deliberately because the risks and remedies differ.

Client money is cash. The control question is whether the amount held in client bank accounts, the client money resource, equals the amount the firm should be holding for clients, the client money requirement, calculated under the applicable method. A discrepancy is a funding problem, correctable with cash, and CASS 7 requires it to be corrected the same day it is identified.

Client assets, sometimes called safe custody assets, are securities or other instruments a firm holds or arranges to be held for a client. A discrepancy here is positional, not valuational: the firm's record disagrees with the custodian's record about a specific holding, often because of a corporate action, an unsettled trade, or a stock lending position. It cannot be remedied by paying in cash; the firm must appropriate or acquire the missing quantity of the actual asset.

The practical consequence is that a firm holding both client money and client assets needs two distinct reconciliation disciplines, not one combined process that happens to touch both. A platform, or a manual process, that reconciles cash well and treats custody as a secondary check on the same data will pass a client money review and fail a custody one. CASS 6 and CASS 7 Software: Custody and Client Money Control goes into the mechanics of running both disciplines properly for investment firms.

CASS 15 is the FCA's answer to a gap that existed for years: payment institutions and e-money institutions were never subject to the main CASS regime, because CASS was written for investment business, but they hold customer funds that need the same kind of protection on insolvency. Their safeguarding obligations previously lived only in the Payment Services Regulations 2017 (regulation 23) and the Electronic Money Regulations 2011 (regulations 20 to 24), which set the requirement to segregate or insure relevant funds but did not prescribe the operational detail of how a firm demonstrates it is doing so.

FCA policy statement PS25/12, published 7 August 2025, set out how that gap would be closed. The supplementary safeguarding regime it introduced, comprising CASS 15 itself, the resolution pack requirement in CASS 10A, the monthly safeguarding return in SUP 16.14A and the annual external safeguarding audit report in SUP 3A, came into force on 7 May 2026. CASS 15 sits alongside the existing PSR 2017 and EMR 2011 safeguarding duties rather than replacing them: the underlying duty to segregate or insure relevant funds is still set in those Regulations, and CASS 15 supplies the operational and evidential standard the FCA expects firms to meet in discharging it.

The substance of CASS 15 will look familiar to anyone who has worked with CASS 7. It requires internal and external reconciliation of relevant funds, with the FCA expecting these to be performed each business day, and prompt correction of any shortfall or excess identified. CASS 15.2.4R requires the firm to allocate to a director or senior manager of sufficient skill and authority responsibility for oversight of safeguarding compliance and for reporting to the governing body, an obligation deliberately shaped like the CASS 1A.3 governance requirement. There is no named FCA controlled function attached to this allocation: CF10a is a historic reference that no longer describes a live controlled function, and SMF18 is not a prescribed mapping for safeguarding oversight, so firms need to decide for themselves who carries the responsibility and record it properly.

It is worth being precise about what CASS 15 does not yet do. The FCA's end-state proposals, including a statutory trust model for relevant funds, remain outstanding and are not law. CASS 15 as it stands is the interim, supplementary safeguarding regime, not the final architecture. Firms should build their controls around what is actually in force rather than anticipating a structure that has not been adopted.

The monthly safeguarding return under SUP 16.14A is a distinct filing from the FSA056 CMAR return that CASS medium and CASS large investment firms submit under SUP 16.14: the two should never be conflated, and a payment or e-money firm has no obligation to file CMAR simply because it now sits within a CASS-numbered chapter. PS25/12 and CASS 15: The FCA Safeguarding Requirements Explained sets out the policy background and the rule changes in more detail, and CASS 15 Software for Payments Firms: Relevant Funds, Reconciliation and Records covers what the reconciliation, correction and reporting obligations look like operationally.

Insurance intermediaries handling premium under an insurance mediation permission sit under CASS 5. CASS 6 and CASS 7 do not apply to them unless they separately hold investment client money or assets. Operationally this means segregating premium in a client bank account, reconciling it against the firm's own records, and maintaining the CASS 5 client money resource and requirement discipline, which is a lighter and differently shaped obligation than the CASS 7 equivalent. How Safeheld Helps Insurance Intermediaries with CASS 5 Compliance covers this in more detail.

Investment firms holding client money and, separately, safe custody assets sit under CASS 1A for oversight, CASS 6 for custody, CASS 7 for client money, and CASS 7A for the distribution rules that would apply on failure. CASS 9 disclosure obligations sit alongside these wherever the firm holds client money or assets. CASS 5 and CASS 15 do not apply to a firm in this category unless it separately carries insurance mediation or payment services permissions.

Payment institutions and electronic money institutions holding relevant funds sit under CASS 15 for safeguarding and CASS 10A for the resolution pack, with the related SUP 16.14A monthly return and SUP 3A annual audit obligations. CASS 5, 6, 7 and 7A do not apply to these firms in respect of their payment services or e-money business. A firm that also holds investment client money under a separate permission would need to run the CASS 7 regime in parallel for that business, but the two regimes are not interchangeable and satisfying one does nothing to satisfy the other.

Firms authorised only under the Payment Services Regulations 2017 or the Electronic Money Regulations 2011, without a separate FCA investment permission, typically sit outside the Senior Managers and Certification Regime altogether, which is why the CASS 15.2.4R allocation has to be recorded against whichever senior role the firm's own governance structure supports, rather than mapped to a prescribed function. The CASS Head's Guide to Continuous Compliance Oversight covers what that oversight role needs to be able to demonstrate day to day, whichever chapter it is discharging.

The first is assuming CASS 15 replaced the safeguarding duty in the Payment Services Regulations and Electronic Money Regulations. It did not. The duty to segregate or insure relevant funds still comes from those Regulations. CASS 15 adds the operational and evidential standard on top.

The second is assuming every CASS chapter applies to every regulated firm simply because the firm is 'in CASS'. A payment institution reading CASS 7 requirements written for investment firms and applying them to its own safeguarding is applying the wrong chapter; the equivalent obligations for it are in CASS 15, and while the two regimes rhyme in structure, they are not identical.

The third is treating the CASS 15 statutory trust as already in force. It is a proposal within the FCA's end-state work, not a current rule. Firms should describe their safeguarding arrangements accurately as they stand today rather than as the FCA has said it might eventually require them to be.

The fourth is conflating the SUP 16.14A monthly safeguarding return with the FSA056 CMAR return. They serve different regimes, different firm populations and different data, and a firm should confirm which one it is actually required to file rather than assuming.

Whichever chapter of CASS applies, three practical disciplines recur across all of them. The first is a named, accountable individual with genuine oversight, not a title on an organogram. CASS 1A.3 and CASS 15.2.4R both require this explicitly, and supervisors test whether the person named can actually describe the current position, not just whether the allocation exists on paper.

The second is reconciliation performed at the frequency the relevant chapter expects, internal and external treated as distinct exercises, and any shortfall or excess corrected and evidenced rather than merely noted. CASS 7.15 sets this out for client money at least daily under the normal approach; CASS 15 expects the equivalent daily discipline for relevant funds, even though the rule text is drafted separately.

The third is records that can answer a question about a specific historic date without a week of reconstruction. An auditor, whether performing a CASS 6/7 client assets audit or the new CASS 15 annual safeguarding audit, samples dates and asks for the reconciliation, the break, the correction and the reviewer for each one. A firm's evidence is only as good as its ability to reproduce that record unchanged from the day it was created, which is why hash-sealed, tamper-evident reconciliation records now form part of what a well-run CASS or safeguarding function keeps as a matter of course, alongside the written policies and governance minutes.

Safeheld runs the reconciliation, correction and evidence layer that sits underneath whichever chapter of CASS applies to a given firm, whether that is client money and custody reconciliation for an investment firm under CASS 6 and 7, premium reconciliation for an insurance intermediary under CASS 5, or relevant funds reconciliation for a payment institution or e-money institution under CASS 15. Each reconciliation run is hash-sealed at the point it is executed, so the record an auditor or a supervisor is given is provably the record that existed on the day in question, not a version reconstructed under time pressure.

Because the underlying data model is the same regardless of which CASS chapter a firm sits under, a group with both an investment firm subsidiary and a payment institution subsidiary can run both sets of obligations from one platform, with the outputs, the monthly safeguarding return, the resolution pack, and the client money and custody audit evidence, all generated from the same sealed records rather than assembled separately for each entity. /solutions/cass sets out how that applies across the different chapters in more detail.