Not all businesses regulated by the FCA have to produce a report on client assets. Likewise, stating that your firm does not keep client funds is not a justification for the absence of the obligation to report. It depends on the regulatory status of your firm and the requirements of SUP 3.1.
When selecting an auditor, find out what type of reporting your firm must do. This will help you not to order the wrong type of work or find out about the requirement for reporting late.
What is a client assets report?
A client assets report, which is usually referred to as a CASS audit report, is the report from the independent auditor which relates to compliance with applicable FCA client assets regulation. It is different from the audit of the financial statements of the organisation and serves a separate regulatory purpose.
Regarding a reasonable assurance engagement, the auditor assesses whether the organisation had adequate systems in place to comply with the applicable regulations during the reporting period, and whether such compliance occurred on the reporting date. The fact that the closing balance is satisfactory is not sufficient evidence that the organisation’s controls worked effectively during the year.
Which firms need a report?
Start by considering the guidance given in SUP 3.1.2R instead of generic terms like “fintech” or “wealth manager”. The regulatory framework differs from one category to another, and a firm could fall under more than one category depending on its activities and the permissions.
| Firm or arrangement | Position to check |
| Investment managers, brokers and investment platforms | Relevant investment-firm categories may require a report; application depends on the precise category and associated conditions. |
| Firms claiming not to hold client money or custody assets | An assurance report may be required in line with the provisions under SUP 3.10. |
| CASS debt management firms | It falls within row (5B), unless subject to a requirement imposed under section 55L FSMA, or a requirement to the same effect, stating that they must not hold client money. |
| CASS 7 loan-based crowdfunding firms and CASS 13 claims management firms | Included as applicable in the application table. |
| Insurance intermediaries holding client money | A report is almost always required, unless a relevant exemption applies. |
Being within SUP 3 does not necessarily mean that a client assets report is required. Check the firm’s applicable row or rows in SUP 3.1.2R and, specifically, whether SUP 3.11 applies to the firm and SUP 3.10 applies to its auditor.
Does holding no assets create an exemption?
Where the firm is subject to SUP 3.10 and claims not to have held client money or custody assets, the auditor reports whether anything has come to their attention that causes them to believe the firm held either during the reporting period. SUP 3.10.4AR requires this report to be prepared as a limited assurance engagement.
However, SUP 3.1 also has exclusions and exemptions in any specific situation or regulatory category that will not fall in line with this claim. This means that it will be equally incorrect to claim that every investment adviser will require a limited assurance report.
Ask the proposed auditor to summarise the analysis of the requirements that apply to the firm. If the firm states that it does not hold any client assets, the discussion must be concerned with the actual operational processes of the firm rather than the FCA licensing it has.
Insurance intermediaries: check the trust
The error in the understanding of the £30,000 exemption is common. The exemption applies to qualifying insurance intermediaries that do not hold an excess of £30,000 in client money within a statutory trust created under CASS 5.3. There are specific conditions that apply under SUP 3.1.2R.
The exemption is not a general one for firms holding small amounts of client money in the absence of statutory trusts. Firms that do not hold client money or any assets from clients in relation to the insurance distribution do not need to comply with the audit requirements that are made relevant by the provisions provided in the earlier applications.
Senior management should review the situation for exemption status on a regular basis. Once the firm is not eligible for exemption any longer, it should engage an auditor and comply with reporting requirements.
Reasonable or limited assurance?
These are not audit packages that firms can choose based on their costs. The particular form of engagement is determined by the firm’s situation and the course of action involving the legal framework represented by SUP 3.10.4R and SUP 3.10.4AR.
A reasonable assurance type of engagement takes place in case the auditor provides assurance regarding the firm’s compliance with the relevant client asset requirements. The report indicates that during the reporting period, the firm maintained the required systems and complied with the relevant regulations as of the reporting date.
A limited assurance engagement takes place in the proper form if the firm states that it did not have any client money or custody assets in the course of the reporting period. The auditor’s review consists of the existence of certain information that indicates that the firm possessed those assets during that time.
Thus, it’s not only a signed statement from management. The auditor must also perform some necessary procedures which would support the limited assurance conclusion.
Reporting periods and deadlines
SUP 3.10.6R states that the reporting time must not exceed 53 weeks from the previous reporting period. In case of a firm’s first report, the calculation must start from the date of its authorization or start of applicability of reporting requirements. The auditor’s report must normally be submitted to the FCA by the end of the four-month period starting from the end of the reporting period.
For insurance intermediaries within category (10) of SUP 3.1.2R, the auditor must deliver the report to the firm within four months of the reporting-period end and to the FCA on request within six years of that date. These arrangements do not override separate obligations on the firm or auditor to notify the FCA of relevant matters, including matters requiring immediate reporting.
The relevant report includes a schedule for breaches. Auditors have to indicate any rule that led to a single breach. Even if the violation is corrected during the reporting time, it still must be included in the breaches schedule. The violation will be evaluated in terms of its significance and its impact on the audit report’s opinion.
How to prepare the evidence early
If you are working with an auditor, it makes sense to agree upon a specific information request rather than to base it on a general checklist. Firstly, the basic information to be covered includes:
- FCA permissions and types of business carried out by a firm, as well as the arrangements concerning client money and custody assets.
- Banking and custodial accounts as well as acknowledgements and agreements regarding them.
- Internal and external reconciliations, record keeping, and investigations of any discrepancies.
- Breach registers, records of remediation actions, and the results of the last audit.
- Changes in the following areas: systems, products, third-party service providers, or personnel responsible for overseeing CASS.
Make sure to give management enough time to study the draft report and send feedback. According to SUP 3.10.8D, the auditor has to provide sufficient time for the company to examine the findings of the audit before finalising the report.
The payment and e-money institutions need to scrutinise their unique safeguarding auditing and reporting arrangements. From 7 May 2026, the associated regulations should follow CASS 15, CASS 10A, and SUP 3A. Such regulations impose precise safeguarding obligations, resolution pack obligations, and auditing specifications. The institutions should examine their obligations in accordance with this separate framework instead of relying on the SUP 3.10 process.
How Reflex Accounting’s Cass Auditor can help
The CASS audit service of Reflex Accounting provides an audit work based on risk covering the controls of client assets, reconciling accounts, segregation, governance, and regulatory reporting.
Evaluate the skills, resources, and experience of the auditor you want to appoint based on the type, size, and complexity of your business. Check their experience with similar clients regarding client assets.
At an initial scoping meeting, you need to discuss the requirements for reporting, the period of reporting, and the timetable for the client before finalising the fees involved and the requirements for evidence. Reflex Accounting will look into the controls, conduct the audit, and give findings about its audit.
FAQs
Does every FCA-regulated firm need a CASS audit?
No, the regulatory category of the firm dictates the need for the requirement according to the business activities and application rules of SUP 3.1. However, a firm not holding client money or custody assets does not automatically qualify for an exemption from this requirement. There are certain firms that need a limited assurance report to confirm that there is nothing to suggest that they had client money or custody on their books during the reporting period.
What is the deadline for a client assets report?
In general, an auditor is supposed to complete a report and submit it to the FCA four months after the reporting period ends. However, different rules apply to certain insurance intermediaries. Their auditors must send reports to the firms within four months and file with the FCA upon request within six years. Make sure you check the reporting requirements applicable to your company instead of assuming that the deadline for filing financial statements is also applicable to you.
How can Reflex Accounting help with a CASS audit?
Reflex Accounts offers independent audits that assess the client’s CASS arrangements, including reconciliation and segregation. Their approach is risk-based and involves an assessment of the evidence, detection of reportable breach issues, and identification of control weaknesses in order to communicate this to management, so that it may take necessary measures. A CASS audit provides the reasonable or limited assurance required by the applicable reporting framework. It does not provide an absolute guarantee of compliance, and management remains responsible for the firm’s CASS arrangements.
