CASS: failure to protect client money and safe custody assets

Failure to properly protect client money and safe custody assets (CASS) is one of the FCA's most deeply held regulatory priorities. The obligation to segregate, reconcile and return client assets in an orderly manner was the central regulatory lesson from the Lehman Brothers collapse in 2008, which trapped £4.6 billion of client money for years. Every significant CASS enforcement action since 2013 has explicitly referenced the Lehman precedent.

• £193.1m in total FCA CASS fines, 2013–2025.
• 14 enforcement actions: 10 institutional and 4 individual.
• £126m: BNY Mellon 2015, the largest CASS fine ever.
• £1.3tr+ in custody assets at risk at BNY Mellon alone.

1. Scenario overview

The dataset covers 14 enforcement actions and £193.1 million in fines across five sectors: investment banking, asset management, wealth management, life insurance and general insurance. The CASS framework applies through different sourcebook chapters (CASS 5, 6, 7, 10) to different firm types, but the underlying obligation is always the same: client assets must be identifiable, segregated, reconciled and returnable in an insolvency.

Two structural features define this scenario. First, the distribution is extremely right-skewed: the BNY Mellon 2015 fine (£126m) represents 65% of the total alone, and BNY Mellon and Barclays 2014 together represent 84%. This reflects the FCA's policy of scaling CASS fines to the value of assets at risk. Second, there has been an extended enforcement gap since 2020, with no published CASS fines from 2021–2025. This reflects a combination of private warnings and firms remediating before enforcement thresholds were crossed, not a loss of supervisory focus.

CASS failure is directly relevant to any firm that holds client money or safe custody assets. The FCA's CASS specialist supervisory team conducts proactive reviews: CASS enforcement can arise from a supervisory visit without any client complaint.

For firms in wind-down, CASS is particularly critical. The CASS resolution pack is the primary mechanism enabling orderly client asset return, and its absence is both a CASS breach and a WDPG/ICARA adequacy failure.

2. The CASS framework: what applies to which firm

Unlike most FCA regulatory frameworks, CASS has multiple chapters applying to different activities. Understanding which chapter applies is itself a compliance obligation, and choosing the wrong chapter, or failing to reassess after a business model change, is a primary failure mode in the enforcement dataset.

3. The enforcement record

All 14 enforcement actions, institutional and individual. Investment banking and wealth management cases involve safe custody assets; general insurance cases involve client premiums under CASS 5. Fine values in nominal GBP.

No published institutional CASS fines 2021–2025. The extended gap likely reflects supervisory engagement (private warnings, voluntary remediation) ahead of enforcement.

4. Landmark cases

BNY Mellon: £126 million (2015)

The largest CASS fine in FCA history. BNY Mellon, the world's largest custodian bank, failed to maintain entity-specific records and accounts for safe custody assets over a six-year period (November 2007 to August 2013). The firm used global platforms that did not record which BNY entity clients had contracted with. Assets from 13 proprietary accounts were commingled with client assets. No adequate CASS resolution pack was maintained. CMARs were inaccurate.

Assets at risk: £1.3 trillion (peak: £236 billion). Gross penalty before discount: £180 million; with the Stage 1 settlement discount, £126 million. The fine quantum was explicitly driven by the scale of assets that would have been inaccessible in a BNY Mellon insolvency.

Barclays Bank: £37.7 million (2014)

Barclays failed to protect £16.5 billion of client custody assets in its Investment Banking Division (November 2007 to January 2012). The FCA cited significant weaknesses in systems and controls: no adequate reconciliation, no entity-specific records and no documentation trail to support insolvency distribution. It was the largest CASS fine until BNY Mellon in 2015.

Charles Schwab UK: £9 million (2020)

The clearest example of business model change without CASS impact assessment. Schwab swept client assets to its US affiliate (Charles Schwab & Co, Inc.) and conducted custody activities under that arrangement without assessing whether UK CASS requirements applied to the new structure. The FCA issued three simultaneous findings: a CASS breach, an FSMA s20 breach (conducting regulated activity without permission) and a PRIN 11 breach (a false statement to the FCA about auditor confirmation). All three arose from one structural change not reviewed for regulatory impact.

Aberdeen Asset Managers: £7.2 million (2013)

The first major post-Lehman CASS enforcement action. Aberdeen failed to apply correct depositary arrangements for UCITS funds, holding safe custody assets in the client's name rather than using proper segregation mechanisms, with inadequate reconciliations. The case established the FCA's benchmark for CASS compliance in asset management and signalled that CASS would be enforced proactively, not only in response to client complaints.

5. Three recurring failure patterns

Group or global systems without entity-specific records

BNY Mellon and Barclays both failed because group-wide or global platforms did not maintain records at the level of the individual UK entity. The FCA's view: UK CASS obligations attach to the UK entity, not the group. Using a group platform is not a defence. The UK entity remains responsible for entity-specific segregation, reconciliation and records, and the obligation cannot be outsourced.

Business model change not assessed for CASS impact

Charles Schwab (2020) is the textbook case: sweeping client assets to a US affiliate without assessing the UK CASS and permissions implications generated three simultaneous breaches. Towergate (2016) is the insurance equivalent: business model changes that altered the CASS chapter applicable to the firm's activities, not reassessed. The FCA expects a mandatory CASS impact assessment for every material business model change.

CASS resolution pack absent or untested

BNY Mellon, Charles Schwab and Aviva were all cited for resolution pack failures alongside their primary CASS breaches. The FCA treats the RP as a standalone obligation, not merely evidence of underlying CASS failings. An adequate RP must be maintained, updated after every business model change, and tested at least annually to confirm it can enable a timely insolvency distribution.

6. Control failure taxonomy

The FCA's Final Notices identify six categories of control failure across the 14 enforcement actions, in order of frequency:

• Segregation failure. Client assets not separated from firm assets; group or global commingling; proprietary accounts mixed with client accounts. BNY Mellon (13 proprietary accounts commingled), Barclays, Aberdeen, Xcap (client money mixed with firm money).
• Reconciliation failure. No daily internal record checks; no external reconciliation with custodians or banks; entity-specific reconciliation absent where group systems were used. BNY Mellon and Charles Schwab both cited; Barclays had no documentation trail.
• Resolution pack absent or deficient. Not maintained, not updated after business model changes, not tested annually, or without enough information to enable insolvency distribution. BNY Mellon, Charles Schwab, Aviva.
• CMAR inaccuracy / PRIN 11 breach. Inaccurate CMARs submitted; false statements about auditor confirmation; failure to notify the FCA of CASS concerns promptly. BNY Mellon (inaccurate CMARs over six years); Charles Schwab (a false statement that generated a separate PRIN 11 breach).
• Governance and CASS oversight. No dedicated CASS function; CASS not treated as a board or senior management priority; CF10a function not performing; audit findings not escalated. Barclays, BNY Mellon, Aviva.
• Incorrect CASS chapter applied. The wrong chapter applied, or no reassessment after a business model or regulatory change. Towergate (CASS 5 failures); Charles Schwab (also generating an s20 FSMA breach).

Why “no client loss” is not a defence

A defining feature of multiple CASS cases is the FCA's explicit statement that no clients suffered actual loss (BNY Mellon, Charles Schwab, Barclays). The FCA's consistent response: CASS obligations exist to protect against potential loss in an insolvency, and by the time actual loss occurs it is too late. This has a direct ICARA implication. CASS enforcement risk cannot be dismissed on the basis that the firm has not lost client money: the FCA will fine a firm for structural non-compliance even where all client assets are intact.

7. Mitigations and control framework

CASS mitigations are more prescriptive than most other FCA regulatory areas: the sourcebook itself specifies many required controls in rule form. The controls below map directly to the FCA's rules and to the failure modes in the enforcement dataset.

• Daily segregation. Daily segregation of client money and safe custody assets from firm assets; automated sweeps with daily confirmation; unallocated client money procedures (10 business day limit under CASS 7.13); no use of client assets to settle firm liabilities. Every institutional CASS case involves segregation failure, and all other CASS obligations depend on it.
• Reconciliation programme. Daily internal CASS record checks (CASS 6.6.11R / 7.15.29R); monthly external reconciliations with custodians, banks and ARMs; entity-specific reconciliations where group systems are used; a documented methodology; prompt investigation and resolution of breaks. Reconciliation is the FCA's benchmark for whether adequate CASS systems exist.
• CASS resolution pack. Maintained, updated and tested at least annually; client lists with assets, account details, counterparty and sub-custodian information and access instructions; updated promptly after business model changes. The RP is what protects clients in an insolvency.
• CASS governance (CF10a). A dedicated CASS Operational Oversight function; CASS as a standing agenda item at ExCo and the Board risk committee; an annual CASS risk assessment; independent CASS audit; a compliance monitoring plan with defined testing frequency. Without adequate CF10a oversight, the board has no early warning mechanism.
• Group and outsourcing due diligence. A written assessment of whether non-UK group entities' systems meet UK CASS requirements before reliance; contractual CASS obligations and right-to-audit on third-party custodians; UK CASS records held independently of group systems; annual review. Outsourcing CASS does not outsource the regulatory obligation.
• CMAR accuracy and annual audit. Accurate, timely CMARs with pre-submission review; an annual CASS audit by a qualified auditor, separate from the statutory audit; findings actioned with documented remediation and reviewed by the CASS Officer and Board. The FCA uses CMAR data analytically, and CMAR errors are a standalone aggravating factor.
• Business model change assessment. A mandatory CASS impact assessment for every material change: which CASS chapter applies afterwards, whether FCA permissions are adequate, and an updated CASS framework before the change goes live. Business model change is the most common trigger for failures at previously compliant firms.

8. ICARA / ICAAP scenario parameters

Empirical impact distribution

The CASS impact distribution is the most extreme in the scenario series: the BNY Mellon case (£126m net, £180m gross) defines a P99.5 that dwarfs the P95 case (Barclays at £37.7m). The distribution is driven primarily by the scale of assets at risk, which the FCA's DEPP penalty calculation explicitly reflects. For most investment firms, custody assets are far below BNY Mellon's £1.3 trillion, which compresses the relevant ICARA range significantly.

Calibrating for your firm's asset base

The FCA's CASS fine scale roughly tracks the value of assets at risk: BNY Mellon (£1.3tr → £126m, about 0.01% of assets), Barclays (£16.5bn → £37.7m, about 0.23%), Charles Schwab (retail assets → £9m). For firms with AUM or custody assets in the £1bn–£50bn range, the relevant calibration point is the Charles Schwab-to-Barclays range (£9m–£38m), not the BNY Mellon extreme.

Adjust the ICARA percentile upward for firms with: group arrangements for CASS; recent business model changes affecting CASS scope; prior FCA CASS engagement or supervisory visit findings; or CASS audit findings not fully remediated.

Key variables in fine quantum

• Value of assets at risk. Under £1bn at the lower end; £10bn+ of custody assets at the higher end. BNY Mellon (£1.3tr → £126m) vs Xcap (small → £0.12m).
• Duration of breach. Under a year and self-identified, versus multi-year (5–8 years) and identified by the FCA. All large fines involve breach periods of five years or more.
• Systemic vs isolated. A single CASS obligation breached, versus several at once. BNY Mellon breached six simultaneously through one platform failure.
• Disclosure and transparency. Proactive disclosure, accurate CMARs and open cooperation, versus inaccurate CMARs or a false statement to the FCA. Schwab's PRIN 11 breach increased the penalty materially.
• Business model change. A stable model with unchanged CASS scope, versus a change not assessed and new activities unlicensed. Schwab: s20 FSMA, CASS and PRIN 11 from one change.
• Settlement timing. All 10 institutional cases settled at Stage 1 (30% discount). Without settlement, the gross penalty applies: BNY Mellon went from £180m gross to £126m net.

CASS in wind-down

CASS takes on particular significance in wind-down. The resolution pack is the primary mechanism for returning client assets in an insolvency, and its absence is simultaneously a CASS breach and a failure in the firm's wind-down planning (WDPG). For ICARA capital modelling in wind-down:

• The RP must be updated and tested as part of wind-down planning. An inadequate RP discovered during wind-down is an enforcement risk at the worst possible moment, when the FCA's attention is highest.
• Client asset return during wind-down must follow CASS rules. Any delay or error creates a new CASS breach, even if the firm was previously compliant.
• The FCA expects firms in wind-down to notify it of any CASS concerns promptly; PRIN 11 applies throughout.
• The wind-down capital assessment should include a CASS compliance cost line: final CASS audit, RP testing, and a contingent enforcement provision calibrated to the firm's CASS risk profile.

9. Regulatory framework and FCA guidance

FCA rules and principles most cited

• PRIN 10, Clients' assets. A firm must arrange adequate protection for clients' assets when it is responsible for them. Cited in every institutional CASS enforcement case.
• PRIN 11, Relations with regulators. A firm must deal with its regulators in an open and cooperative way. Cited in Charles Schwab (2020).
• CASS 6.5.2R. Records and accounts must be accurate and correspond to custody assets held: the foundational entity-specific record-keeping obligation.
• CASS 6.6.11R / 7.15.29R. Internal custody record checks and client money reconciliation requirements.
• FSMA s20. Carrying on a regulated activity without permission. Cited in Charles Schwab (2020).

FCA supervisory direction (2025–2027)

• CASS remains a named FCA priority, cited in every major CASS action since 2013 and in multiple Dear CEO letters. The 2021–2025 enforcement gap reflects supervisory engagement ahead of enforcement, not a loss of focus.
• The annual CASS audit regime provides ongoing visibility. The FCA uses CASS audit reports and CMAR data analytically to select firms for supervisory review.
• Individual accountability is growing. Four individual actions in the dataset and the CF10a function show the FCA treats CASS as a personal accountability matter.
• Cross-border and group arrangements are under increased scrutiny. Charles Schwab and BNY Mellon both involve group platforms used for UK CASS without adequate UK-specific controls. Post-Brexit divergence from EU rules makes this more, not less, complex.
• Consumer Duty reinforces CASS from a consumer protection angle. Retail-facing firms must consider CASS adequacy as part of their Consumer Duty obligations.

10. Scenario summary card

Concise parameters for ICARA and ICAAP board packs, risk committee reports and scenario documentation.

Sources: FCA Final Notices (2013–2025), FCA CASS sourcebook, FCA Dear CEO letters on CASS, ERM+ enforcement dataset (307 cases, 2013–2025). For information only; not legal or regulatory advice.