1. Managing change – keeping CASS arrangements effective
Firms continue to evolve and business models are getting more complex. Nonetheless, CASS requires firms to maintain adequate organisational arrangements designed to minimise the risk of client money being lost or diminished through misuse, fraud, poor administration, inadequate record-keeping or negligence. That requirement is not static. Firms must remain CASS compliant during and following changes to systems, business models, products, outsourcing arrangements or organisational structures, as well as regulation. Firms should consider CASS at the start of and throughout a change programme, with strong governance at its heart. Even small product or process changes should be subject to appropriate CASS impact assessment, approval, testing and oversight.
Firms that can incorporate and evidence the following as part of their change management are better placed to remain/be CASS compliant:
- Governance and CASS culture: establish clear senior ownership and involve the CASS oversight, operations, compliance and assurance functions early.
- Impact assessment: understand which CASS rules, records, reconciliations, calculations, bank accounts, systems and client communications will be affected.
- Data migration: confirm the completeness and accuracy of data transferred between systems. Retain reconciliations performed as part of this for any third party reviews.
- Parallel operation: where two systems operate during a transition, define which records are authoritative and how differences will be investigated.
- Testing: test both successful transactions and exceptions, including failed trades, unmatched items, stale balances and timing differences. Insufficient user acceptance testing (UAT) has been found to be a key source of larger issues and breaches.
- Contingency planning: retain a credible fallback if the new process does not meet intended objectives and is not CASS compliant.
- Post-implementation monitoring: increase oversight after implementation and respond promptly to unexpected exceptions.
Change is not limited to what happens within the firm. Regulatory developments should be treated in the same way. This is particularly relevant given the pace of recent regulatory change. Following CP25/37, Handbook Notice 142 introduced targeted CASS changes intended to reduce unnecessary friction, administrative burden and recurring technical breaches, while maintaining client asset protection. These include changes affecting record retention, reconciliations, the interaction with Consumer Duty and the timing and treatment of interest. Even where changes are intended to simplify the regime, firms still need to assess their impact and update processes, controls and system configuration where necessary.
CASS is no longer a niche rulebook. Its scope is expanding across sectors, asset types and products, driven by the FCA's wider focus on protecting money and assets where existing regulatory structures have left gaps.
Recent developments illustrate that direction of travel: the introduction of CASS 15 for payment and e-money firms, the development of CASS 16 and CASS 17 for stablecoin issuers and cryptoasset custodians, and proposals for a new regime covering pension scheme money and assets.
The common theme is that the FCA is progressively addressing areas where consumers' money or assets may sit outside traditional CASS protections. For firms, regulatory change therefore needs to form part of the same change-management framework as system implementations, new products, outsourcing or business-model change.Firms should engage CASS auditors early in the change process to agree expectations around audit trails and documentation, reducing challenges during audit testing. Clear records of changes and management’s rationale for key decisions should also be maintained.
2. AI and automation – risks should be understood and managed
Financial Services businesses are increasingly using AI across operational, reconciliation, surveillance and control functions that directly support CASS compliance. AI and automation may improve the speed and consistency of processes, but firms must understand what the technology is doing and retain accountable human oversight.
The FCA has made clear that the use of AI does not remove a firm's regulatory responsibilities. Existing governance, systems and controls, operational resilience and SM&CR requirements continue to apply. Firms should therefore understand where and how AI is used within their processes and assess the potential impact on CASS compliance. For example, an AI agent that can initiate payments, update client records or investigate reconciliation differences could directly affect client money records and controls. Firms need appropriate assurance that AI models and agents are configured correctly, operate within defined parameters and remain subject to sufficient human oversight, including review and challenge of outputs where appropriate.
Some of the key risks Firms should consider include:
- Inputs and data quality: incomplete, inaccurate or poorly mapped data can lead to incorrect outputs or CASS records.
- Logic and configuration: poorly designed rules or parameters can cause automated processes to consistently produce incorrect outcomes.
- Scale of error: automation can amplify errors, potentially affecting large populations before an issue is identified.
- Autonomous actions: AI agents may initiate payments or amend records, making clear permissions and operating limits essential.
- Human oversight: controls should not become a ‘black box’. Appropriate review, challenge and escalation should remain, particularly for exceptions and higher-risk activities.
Firms therefore need appropriate assurance that AI models, agents and automated controls are set up correctly, operate within their defined parameters and continue to produce reliable outcomes.
AI should be looked at with the lens of automation and underlying technology. It doesn't change the fundamentals of CASS compliance, and therefore segregation, safeguarding and reconciliation rules stay exactly as they are.
From an audit perspective, AI implementation can be assessed in a similar manner to other forms of change management, where auditors assess how change management is governed and overseen, whether CASS implications are being suitably assessed and how this impacts a firm's systems and controls for CASS compliance.
