CASS audits – what are they and what do you need to know?

What if I do not hold client money or custody assets?

DIFs that do not hold client money and/or custody assets in relation to their regulated activities still require a CASS audit if they have a statutory audit. A CASS audit report must be submitted to the FCA by the CASS auditor, which includes a “limited assurance” opinion, as described above. 

Do other FCA-regulated firms fall within the CASS regime?

CASS also applies to several other types of firms where they hold client money. Buzzacott can provide CASS audit services to the following:

• Firms operating a peer-to-peer lending platform (CASS 7)
• Mortgage and General Insurance firms (CASS 5)
• Debt management firms (CASS 11)
• Claims management firms (CASS 13)

What is the deadline?

The CASS auditor must deliver their report to the FCA within four months of the end of the period covered (this can be up to 53 weeks but, most commonly, the period covered is the calendar year ending when the firm’s accounting year ends). The CASS audit is often completed at the same time as the financial statements audit, but it is a separate exercise from that audit, and there is no requirement for the CASS auditor and the financial statements auditor to be the same.

What are the applicable standards?

The UK’s Financial Reporting Council has issued an Assurance Standard which outlines the work CASS auditors need to perform in order to provide the assurance opinions above, and which emphasises the need for the CASS auditor to apply an insolvency mindset when completing these procedures. It also makes it clear that CASS auditors cannot apply a level of materiality to their work, unlike with financial statements audits. Therefore, any rule breach identified that relates to the period (whether identified by the firm or the CASS auditor), no matter how small, must be included in a Breaches Schedule which is appended to the report that is submitted to the FCA. In advance of the report being submitted to the FCA, the CASS auditor must deliver a draft copy to the firm so that the firm can provide its comments on the rule breaches included in the Breaches Schedule. The CASS auditor has no responsibility in respect of the firm’s comments.

What about payment services firms and EMIs?

These firms are not caught by the CASS regime, but the FCA  does expect firms to have an annual audit of compliance with the requirements relating to safeguarding of customer funds. Please see more information on this here.