Process of breach remediation for insurance intermediaries (CASS)

The FCA released communication in March 2023 (Dear CEO letter issued on 16 March 2023), to reiterate that the firms must have adequate arrangements in place to ensure customers’ money is safe. Firms with permission to hold or control client money should establish and maintain arrangements to ensure client money is adequately protected. Firms are required to design effective client money controls to reduce customer harm on an ongoing basis and in the event of firm failure

Whilst firms performing insurance intermediary broking activities should design and maintain internal controls to mitigate risks of CASS non-compliance, it is extremely difficult to prevent CASS breaches from ever occurring and as a result firms should have adequate governance and appropriate oversight over their CASS breach management process. As such, firms are expected to self-identify breaches, especially common breaches which occur within the client money process. How breaches are identified and remediated by the firm can give insight into the effectiveness of a firm’s controls and governance process.

Reliance must not be placed on the annual external CASS Assurance report to identify breaches as this does not form part of a firm’s internal controls. Where breaches are identified by the CASS auditor, or by any other third party, the firm is responsible for both investigating why it was not identified through the systems and controls it had in place at that time, and for monitoring the breach through to remediation.