An FCA regulated firm needs a CASS audit when SUP 3.1 applies SUP 3.10 to its auditor, which covers investment firms, debt management and claims management firms, certain crowdfunding platforms and insurance intermediaries that hold client money. The auditor gives a reasonable assurance client assets report on whether the firm’s systems were adequate throughout the period and whether it complied with the CASS rules at the period end, with a schedule of every rule breach found. Insurance brokers holding no more than £30,000 of client money on statutory trust are exempt.

Which firms need a CASS audit?

The table in SUP 3.1.2R of the FCA Handbook decides which firms’ auditors must report under SUP 3.10. The main categories are:

  • investment management firms, personal investment firms (other than small ones), securities and futures firms and external AIFMs that have a statutory auditor or to which the custody or client money chapters apply;
  • MiFID investment firms with a statutory auditor, and sole traders or partnerships that are MiFID investment firms;
  • UCITS firms and internally managed AIFs;
  • CASS debt management firms, CASS 7 loan based crowdfunding firms and CASS 13 claims management firms;
  • authorised professional firms to which the custody or client money chapter applies; and
  • insurance intermediaries, other than exempt insurance intermediaries, to which the insurance client money chapter applies (apart from CASS 5.2).

Note 6 to the table explains that, for the firms concerned, the requirements apply whether or not the firm’s permission prevents it from holding client money or custody assets, and whether or not it actually holds any. There is a carve out in SUP 3.10.2R for solicitors: the auditor of an authorised professional firm regulated by one of the UK Law Societies need not report on the client money rules if the firm is subject to its professional body’s rules for its regulated activities.

How does the rule apply to insurance brokers?

Note 4 to SUP 3.1.2R says the client money audit requirement applies to all insurance intermediaries except those that hold no client money or other client assets in relation to insurance distribution, and those that hold no more than £30,000 of client money, only under a statutory trust arising under CASS 5.3. Firms in the second group are exempt insurance intermediaries. SUP 3.10.8CG makes it the responsibility of senior management to decide on a continuing basis whether the firm is still exempt, and to appoint an auditor if it is not.

Two features are specific to insurance intermediaries:

  • Delivery. Under SUP 3.10.8AR the auditor delivers the report to the firm within four months of the period end, and to the FCA on request within six years. The FCA’s guidance says intermediaries are not obliged to send the report to the FCA unless the auditor has given an adverse opinion for the period.
  • No limited assurance report. The FRC’s client assets standard notes that the FCA rules do not require limited assurance opinions for insurance intermediaries, and that reasonable assurance opinions are not required for intermediaries holding no more than £30,000 in a statutory client money trust.

The opinion also excludes CASS 5.2, the rules on holding money as agent of the insurer. For the general principles of holding other people’s money, see client money rules for accountants.

What does the auditor report?

Under SUP 3.10.4R the auditor submits a client assets report addressed to the FCA. Where the firm holds client assets, SUP 3.10.4AR requires a reasonable assurance engagement and SUP 3.10.5R requires the auditor’s opinion on whether:

  1. the firm maintained systems adequate to enable it to comply with the custody rules, collateral rules, client money rules, debt management and claims management client money rules and mandate rules throughout the period;
  2. the firm was in compliance with those rules at the date of the report;
  3. for certain investment firms, any nominee company subsidiary maintained adequate systems for custody assets, including reconciliations; and
  4. if there was a secondary pooling event, the firm complied with the distribution rules.

Where a firm claims not to hold client money or custody assets, the auditor gives a limited assurance report stating whether anything has come to its attention suggesting the firm did hold them. The report uses the template in SUP 3 Annex 1R, in two parts: the auditor’s opinion and a breaches schedule. SUP 3.10.9AR requires the report to identify every individual rule breached, or to state that none was found, and the FCA expects the list to include every breach identified, whether found by the auditor or disclosed by the firm or a third party. The auditor uses professional judgement about the significance, context, duration and repetition of breaches in deciding whether to qualify the opinion or give an adverse one. The report is signed by the individual with primary responsibility for it, in their own name. For opinion types generally, see audit opinions.

What are the deadlines?

  • Period. Each report must cover a period ending not more than 53 weeks after the end of the previous one (SUP 3.10.6R).
  • Submission. The report goes to the FCA within four months of the period end (SUP 3.10.7R); the FCA’s preferred method is submission through Connect.
  • Late reports. If the auditor expects to miss the deadline it must tell the FCA before the four months end, with a full account of the reasons; if it does miss it, it must notify the FCA promptly (SUP 3.10.8R).
  • Draft and comments. The auditor must give the firm a draft with enough time to comment. SUP 3.11.1G expects the firm to explain the circumstances of each breach and its remedial action, and those comments go into the report.

The firm must report the final report to its governing body (SUP 3.11.2R), and the FCA expects it to be built into the firm’s risk management and decision making.

Which standard does the CASS auditor follow?

SUP 3.10.5BG says the FCA expects auditors to have regard to FRC material on the client assets report. The FRC’s Standard for Providing Assurance on Client Assets to the Financial Conduct Authority, revised in November 2019, applies to periods commencing on or after 1 January 2020. It confirms that the CASS auditor need not be the firm’s statutory auditor, requires compliance with ethical requirements including independence, and draws on the FRC Ethical Standard as well as professional body codes. ICAEW’s independence helpsheet places client asset reports required by the FCA alongside audits, under the FRC Ethical Standard. See auditor independence and the Ethical Standard.

The firm also has duties. SUP 3.11.4G reminds firms that they must take reasonable steps to ensure their auditor has the required skill, resources and experience, and should critically assess the client assets report as part of that review. Separately, SUP 3.10.8BG reminds auditors of their statutory duty to report certain information to the FCA directly.

How might this work in practice?

Illustration only. A general insurance broker holds premiums in a statutory trust client bank account. For several years the balance never exceeds £25,000, so the firm is an exempt insurance intermediary and needs no CASS audit. After winning a large scheme, the balance reaches £60,000 in month seven of its financial year. Senior management recognise the firm is no longer exempt and appoint a CASS auditor. The auditor tests how client money is segregated and reconciled, and finds that two reconciliations were carried out late. The draft report lists both breaches; the firm explains the cause and the new checklist it has introduced. The final report, with a qualified opinion on systems, is delivered to the firm within four months of the period end and presented to the board. Because the opinion is not adverse, it does not have to be sent to the FCA unless requested.

What mistakes come up most often?

  • Not monitoring the £30,000 limit. An intermediary that drifts above it loses its exemption and needs an auditor.
  • Assuming a CASS audit is part of the statutory audit. It is a separate engagement and need not be done by the same firm; see how a statutory audit works.
  • Missing the four month deadline without telling the FCA. The notification duty applies before the deadline passes.
  • Incomplete breaches schedules. Breaches the firm found and fixed itself still belong on the list.
  • Treating the report as a box ticking exercise. The FCA expects it to reach the governing body and inform the firm’s controls.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.