CASS and Safeguarding

At Johnston Carmichael, we recognise that the Client Assets Sourcebook (CASS) remains one of the most complex areas of compliance for financial services firms.

Whether you are entering the market, scaling an existing proposition or diversifying your operating model, CASS obligations can give rise to significant regulatory, operational and governance considerations that require specialist insight and careful execution.

The Financial Conduct Authority (FCA) continues to place client asset protection high on its supervisory agenda. Firms must therefore be able not only to operate effective governance, controls and assurance processes, but also to evidence their effectiveness in a clear and timely manner.

What is CASS?

CASS is not simply an audit requirement. It is a core regulatory requirement designed to protect customers and evidence the strength of a firm's governance, oversight and control environment in relation to client money and custody assets.

CASS commonly affects investment firms, wealth managers, platforms, brokers and asset managers. Payment and e-money firms may also be subject to safeguarding obligations in respect of relevant customer funds, requiring a similarly disciplined approach to governance, record keeping and reconciliation.

CASS audit approach

The application of the CASS rules is shaped by a firm’s FCA permissions, business model, governance framework, and operational processes and controls.

At Johnston Carmichael, we develop a detailed understanding of each client's business model, control environment and rule application, while recognising the value of long-term relationships in a highly specialised area of regulation.

We continually monitor FCA regulatory developments and assess their implications for our clients, our risk assessment and our audit approach.

Effective CASS audits require more than procedural testing. They demand informed judgement, sector knowledge and an understanding of how regulatory requirements operate within complex, real-world business models. We apply consistent technical standards across both reasonable and limited assurance engagements.

While maintaining our independence, we support clients through the audit process by providing clarity on the information requested, the nature of our testing and the regulatory purpose behind it. This is particularly valuable for firms whose CASS or safeguarding control environments are still developing.

Common misunderstandings include:

• Assuming CASS only applies to large investment firms
• Overlooking client money held temporarily or through third parties
• Assuming an exemption applies without documenting the rationale
• Treating CASS as a finance-only process rather than a firm-wide operational and control framework requirement

Firms can also underestimate the level, quality, and consistency of operational evidence required to demonstrate compliance in practice.

CASS Audit Team

At Johnston Carmichael, we have invested in building a dedicated CASS audit team with a combination of real-world CASS experience and extensive audit experience. This means that your specialist audit team will also bring a depth of knowledge and practical insight.

Our team has extensive experience delivering CASS audit engagements across the financial services sector and understands the regulatory, operational and conduct risks firms may face. Senior members of the audit team remain closely involved throughout the engagement, supporting consistency, quality and informed decision-making.

We bring effective challenge, professional scepticism and sector insight to every engagement, helping ensure our audits remain technically rigorous and aligned with current and emerging regulatory expectations.

How do we add value?

Our approach is grounded in constructive challenge, clear communication and long-term client relationships. To support ongoing compliance, we provide practical, risk-focused observations and recommendations informed by our work with regulated firms across the financial services sector.

We support firms across a range of CASS and safeguarding requirements, including:

CASS and safeguarding audits

Providing specialist audit services across CASS 6 (custody assets), CASS 7 (client money) and safeguarding requirements for payment and e-money firms (CASS 15).

Readiness, controls and governance reviews

Working with firms to assess preparedness, strengthen control frameworks and address areas requiring remediation or improvement.

IT and data controls

Bringing together CASS and IT audit specialists to assess systems, applications and data flows that support client money, custody asset and safeguarding processes.

Risk Assurance and Internal Audit support

Providing practical implementation support, controls reviews and governance enhancements where assistance is required beyond the audit, subject to applicable independence considerations.

CASS 15 safeguarding webinar

The FCA's new rules under CASS 15 materially raise expectations for safeguarding arrangements within payment and e-money firms. Enhanced reconciliations, strengthened governance, more robust safeguarding arrangements and increased regulatory oversight mean firms should assess their current frameworks and take timely action where enhancements are required.

Watch our webinar to learn what these requirements mean in practice.

Get in touch

To find out more about our CASS and safeguarding audit services, or to discuss how the requirements apply to your firm, please get in touch with Gillian Boston.