For years, the CASS regime stayed fairly stable. That is changing quickly. The FCA’s rulebook is catching up with new business models and new technology. At the same time, firms are automating more of their client asset operations and further developing their use of AI.
At our recent breakfast briefing at Microsoft’s London offices, hosted with Grant Thornton UK, we discussed what this means in practice.
A Regime That Keeps Expanding
The biggest recent change has been the introduction of CASS 15 for payment institutions and e-money firms. Many of these firms are less mature in their control environments than traditional CASS investment firms. As a result, those firms will likely experience a similar journey to the one investment firms went through after PS14/9, and that will keep the FCA, auditors and advisers busy for some time.
Further ahead, cryptoassets are entering the UK regulatory perimeter, and CASS 16 and CASS 17 will bring the concepts of client asset protection to a new sector of the market. This affects both newly regulated cryptoasset firms and traditional financial services firms that move into areas such as stablecoin issuance and digital asset custody.
CASS 6 and CASS 7 firms have seen smaller but still notable changes to the rules. Recent amendments aimed to remove some long-standing frustrations, including recurring breaches around initial due diligence and the frequency of reconciliation performance. However, the growing use of payment service providers (PSPs) by CASS 7 firms remains unaddressed. Some see that as a missed opportunity.
Behind all of this is a regulator that is engaging with industry more than ever. The FCA is systematically reviewing where customer funds and assets currently sit outside of traditional CASS protection, with the aim of bringing them in scope. Once such example is the development of the Pension Scheme Money and Assets (PSM&A) regime which follows many of the successful principles in CASS.
The expansion of CASS across sectors and products can be viewed as a vote of confidence in the control environments that CASS 6 and 7 firms have built. The expectations of CASS have been embedded across the industry over a number of years now, and the FCA’s principle of “same risk, same regulation” means its core ideas are being adapted for new business models and product types. What is clear is CASS isn’t going anywhere and it remains central to the FCA’s consumer protection strategy.
Automating CASS: Plan for the Pitfalls
Automation brings efficiency and greater control, however projects succeed or fail on the right preparation. Running a “pre-mortem” to spot challenges before they happen is time well spent. Three important areas of focus stand out:
Process: If you can’t clearly describe your current process, you’ll struggle to turn it into requirements for a new one. Manual handoffs and workarounds that change from day to day are hard to automate. In such cases it’s often better to redesign the process end to end before automating it, rather than automating something that’s already broken.
Data: Firms need to know exactly where their data comes from and whether they can get it at the most granular level from source systems. Finding a missing data source 60% of the way through a project leads to costly rework. Collecting data samples up front puts the project on a much firmer footing.
People: Operations teams are focused on day-to-day process and rarely have spare capacity. Their early input is essential, both to cover the edge cases as well as the standard flow and to make sure the team feels ownership of the new process. CASS teams, and ideally auditors, should be involved from the start so that questions get answered quickly and decisions don’t have to be revisited later.
Know Your Controls, and be Able to Explain Them
The question auditors ask has moved on. It’s no longer “do you have automation?” but “what exactly are your automated controls, systems and interfaces?” Firms need to describe these clearly in their policies, procedures and risk and control matrices. If they haven’t, an auditor can’t assess them properly.
This matters most where change happens quickly. Firms that are growing fast, launching new products and reorganising at the same time are most likely to find their change management falling short.
The FCA’s recent focus on high-growth firms has used CASS as a way into wider conversations about whether controls can scale and stay resilient. Firms that explain to their auditors and advisers how their control environment has changed, before being asked, are in a much stronger position.
The Hidden Risks of Automation
Automation does exactly what it’s told to do, and that’s both its strength and its risk. For example, if a data feed is incomplete or wrong, the error will likely be repeated across executions, and a one-off issue can quickly become a systemic breach. Automation alone therefore does not guarantee compliance.
The quality of data inputs matters just as much. A reconciliation can balance and still be wrong – a client money requirement and resource calculation built from the wrong components may still balance despite not adhering to the CASS rules.
Good design at the outset is critical, along with clear documentation of how data moves through the process and how the logic is applied.
Reliance on third parties is a further key risk with technology. After recent high-profile IT outages, the regulator has made clear it won’t accept “the system went down” as an answer. Firms need to show what they did in response, including their recovery plans and manual workarounds.
AI: Targeted, Controlled and Accountable
AI could deliver the next generation of automated reconciliation, but only if it’s aimed at specific gaps. The key to success is being focused and targeted in where use cases for AI are pointed. However, the potential risk also has to be recognised and accounted for. Promising early uses include:
- Reading unstructured data, such as PDF statements from fund managers or the inconsistent data common in private credit
- Improving exception management by predicting how breaks should be categorised and learning from past manual matches
- Embedded assistants that act like a junior team member, helping users with configuration and troubleshooting while specialists add the context and judgement
Beyond operations, there are use cases for AI in governance and compliance too: producing governance packs, analysing breach trends and root causes, and reviewing acknowledgement letters or custodian agreements against the CASS rules all offer areas where the capabilities of AI can be harnessed to support CASS professionals.
While AI is significantly on the rise across financial services, firms shouldn’t expect AI-specific CASS rules as a result. The FCA remains technology-neutral and focused on outcomes, so AI adoption has to fit within the existing regulatory framework, with accountability remaining with appropriate senior managers.
The Bottom Line
CASS is expanding into new sectors of financial services. This brings new firms into the CASS perimeter and increases expectations of existing CASS firms. Automation and AI can strengthen control and resilience, but only when firms understand their processes, data and controls and can explain them clearly. The firms that do this will be best placed with their auditor and the regulator.