CASS Oversight vs CASS Operations: Structuring the Function

Most conversations about CASS hiring focus on experience — which regime, how much of it, what the reconciliation looked like. Fewer address the question that determines whether the arrangement actually works: who does the client money work, and who checks it? In larger firms that separation is obvious and staffed. In smaller ones the same person frequently prepares the reconciliation, reviews it, reports the breaches and is the person everyone treats as responsible for CASS — which is a control weakness the firm may not have articulated to itself. This guide sets out how the function divides, how it maps onto the three lines of defence, what each side does day to day, how it reports to the board, how to structure it at different scales, and how to hire for each side.

The rules themselves sit in the FCA Handbook’s CASS sourcebook, and our guide to CASS and client money covers the framework. This page is about the organisational design and the hiring that follows from it.

The two halves

CASS operations is the doing. Preparing the internal and external client money reconciliations, calculating the client money requirement and resource, identifying and clearing differences, processing the transfers that keep segregation correct, maintaining the acknowledgement letters and records, and producing the data for the Client Money and Asset Return (CMAR). It is daily, detailed and deadline-driven: under CASS 7 the internal reconciliation is performed each business day and the external reconciliation as regularly as necessary and at least monthly.

CASS oversight is the assurance. Reviewing and challenging the reconciliation rather than preparing it, owning the breach register and the escalation, maintaining the CASS resolution pack, managing the CASS audit relationship, and reporting to senior management and the board on the firm’s client money position. Under the Senior Managers and Certification Regime, responsibility for CASS compliance is a prescribed responsibility at the firms where it applies — broadly CASS medium and large firms — and must be allocated to an existing approved senior manager, typically the finance director, chief operating officer or head of compliance. There is no dedicated CASS senior manager function. The FCA’s SM&CR pages set out how prescribed responsibilities are assigned, and it is that allocation which makes oversight personal in a way operations is not. Smaller CASS firms still need clear, named accountability; compliance should confirm exactly how the rules apply given the firm’s SMCR category and CASS classification.

The distinction matters because they demand different people. Qualification — ICAEW, ACCA or CIMA — is the baseline for both. Operations rewards precision, process discipline and stamina. Oversight rewards scepticism, the confidence to challenge, and the willingness to escalate something inconvenient.

Three lines of defence for CASS

Most regulated firms describe their control framework in terms of three lines of defence, and CASS maps onto it neatly — provided the firm is honest about who sits in which line.

First line: the people who run the process. CASS operations sits here — the client money accountants, the Financial Controller or Finance Manager who prepares the reconciliation, and the operations staff who allocate receipts and process payments. The first line owns the controls: the daily reconciliation, the funding of shortfalls, the account register, the first review of each break.

Second line: oversight and challenge. CASS oversight sits here, usually alongside compliance. Its job is to monitor whether first-line controls work, own the breach register and challenge the first line when something looks wrong. Our guide to compliance monitoring and the finance function covers how second-line testing typically reaches into finance.

Third line: independent assurance. Internal audit, where the firm has one, tests both the operation and the oversight against the rules and the firm’s own procedures. The external CASS auditor sits outside the three lines entirely, reporting to the FCA on whether the firm’s systems were adequate and whether it complied — the process is set out in our guide to the CASS audit and beyond.

In a small firm the three lines compress into one or two people. The failure mode is a firm that describes itself in three-lines language while one person occupies all three.

What the CASS oversight function does

Under the old approved persons regime, CASS medium and large firms had a specific controlled function for this, the CASS operational oversight function. That role no longer exists as a separate function under the SMCR, but the work it described has not gone away. In practice the oversight function supports the accountable senior manager and typically covers:

• Review and challenge of reconciliations — testing a sample and the ageing of breaks rather than re-performing them.
• The breach register — logging every breach and deciding with compliance what must be notified to the FCA.
• The resolution pack — keeping the CASS 10 pack current and confirming its components can be retrieved within 48 hours of a request.
• Policies and procedures — including assessing the CASS impact of new products, accounts and systems.
• The CASS audit relationship — evidence, management responses and remediation.
• Management information — producing regular CASS MI for the senior manager and the board.

What the CASS operations team does

The operations team — which in many firms is one or two client money accountants within finance — runs the controls themselves. Its core outputs are the daily internal reconciliation comparing the client money requirement with the client money resource, the funding or withdrawal of any shortfall or excess within the required timescale, the external reconciliations against bank and custodian statements, the clearing of unallocated receipts and stale balances, the account and acknowledgement letter register, and the data for the CMAR, which CASS medium and large firms submit monthly through RegData. The mechanics are covered step by step in our guide to the CASS reconciliation in practice.

Operations is also the team that sees problems first, and an operations team discouraged from raising them is a common route to a qualified client assets report.

Why separation matters

Three reasons, and the first is the one firms most often under-weight.

Self-review is not review. Someone checking their own reconciliation will not find the error they made, because the mistake is in their understanding rather than their arithmetic. This is the standard segregation argument and it applies with particular force where the consequence is a client money shortfall.

Escalation is harder when it is your own work. A breach discovered by the person who caused it creates an incentive that does not exist when someone else finds it. Nobody designs a function assuming bad faith — the point is that even conscientious people delay uncomfortable conversations about their own errors.

And key-person concentration becomes regulatory exposure. Where one person prepares, reviews and reports, their absence stops the control rather than slowing it. The CASS audit will ask what happens when that person is on leave, and “we catch up afterwards” is not a satisfying answer.

How the function divides at different scales

One point first: a firm’s headcount and its CASS classification are different things. Under CASS 1A every firm holding client money or custody assets classifies itself as CASS small, medium or large by reference to the highest amounts it has held, against thresholds set out in CASS 1A (check them there rather than from memory). A firm with one finance person can still be CASS medium — in which case the prescribed responsibility and monthly CMAR apply regardless of how small the team is.

Small firm — modest client money balances, one or two finance staff. Realistically the Financial Controller or Finance Manager prepares, and the oversight function sits with the FD, a Head of Compliance or an external consultant. The reviewer does not need to be a CASS specialist to add value: someone competent who asks how each difference was cleared and looks at the ageing will catch a great deal. What does not work is nominal oversight — a signature from someone who has not looked.

Mid-sized firm — a dedicated CASS or client money role. A CASS accountant prepares, the Financial Controller or Head of Finance reviews, and the oversight responsibility sits with a senior manager. This is the point at which most firms formalise the split, and it is usually triggered by an audit finding rather than by design.

Larger firm. A client money operations team, a separate CASS oversight or assurance function often reporting to compliance rather than finance, and internal audit above both. Here the tension reverses: oversight can become so distant from the operation that the challenge is theoretical.

Reporting to the board

The board or governing body is ultimately accountable for the firm’s compliance with CASS, and the senior manager holding the CASS responsibility needs evidence to stand behind it. Oversight is the function that turns daily operational work into something the board can read. Good CASS MI is short, regular (monthly is common) and typically covers:

• Reconciliation timeliness — how many were performed on time, and any that were late or missed.
• Open breaks by age and value, with explanations for anything older than the firm’s tolerance.
• Shortfalls funded and excesses withdrawn during the period.
• Breaches logged, root causes, remediation status and any FCA notifications.
• CMAR submission status and confirmation that it agrees with the underlying reconciliations.
• Progress against open CASS audit findings.

The useful test is whether a non-specialist board member could tell from the pack whether client money is safe this month. Our guide to what the board actually reads applies as much to CASS MI as to the management accounts, and SMCR explained for finance teams covers how senior managers rely on finance evidence.

Where firms most often go wrong

Nominal oversight. A named individual who signs the pack without the time or knowledge to challenge it. Common, understandable, and the arrangement most likely to be exposed by an audit.

Oversight without access. A compliance-based reviewer who cannot interrogate the underlying data and therefore reviews a summary. The reconciliation is where the truth is; a reviewer who never sees it is reviewing a description.

Operations without seniority. A capable but junior person preparing the reconciliation with no authority to insist that operations or the bank resolve something. Differences age, and ageing differences are how shortfalls form.

And documentation living in one head. The reconciliation methodology, the treatment of edge cases, the reason a particular difference recurs — if none of it is written down, the firm has a person rather than a process.

Hiring for each side

For operations, test the mechanics directly. Walk me through your reconciliation step by step; which differences recur and why; how do you clear an unallocated receipt; what would you check first in a new firm. Look for someone who describes the awkward parts without prompting — that is the marker of ownership rather than review. Our CASS accountant job description covers the specification and the interview questions guide the assessment.

For oversight, test judgement and independence. Tell me about a breach you escalated and what happened; describe a time you disagreed with the preparer; how do you satisfy yourself the reconciliation is right without redoing it; what do you report upward and how often. The critical quality is willingness to be unpopular, and it is genuinely testable — candidates who have never disagreed with anyone about client money have either not been looking or have not been listened to.

And be clear which you are advertising. A specification that describes preparation but expects oversight will attract operations people and disappoint everyone six months later — and vice versa. Naming the regime matters too, as our comparison of CASS 7 versus CASS 15 sets out.

What each side typically pays

Typical London base salaries for permanent roles, consistent with our regulated-firm finance salary guide; regional salaries are usually somewhat lower.

The senior manager who holds the CASS prescribed responsibility is a different appointment again: a senior manager function holder approved by the FCA. Those searches are handled by our sister firm SMF Capital, and finance director or CFO searches by FD Capital. Accountancy Capital recruits the operational and oversight layer beneath them, through our FCA-regulated finance recruitment practice.

The practical minimum for a small firm

If you cannot staff both sides properly, four things get you most of the way. Someone other than the preparer looks at the reconciliation monthly, with the working, and asks about the ageing. The methodology is documented to the point where a competent outsider could follow it. Breaches are logged and reported regardless of size, because the register is what demonstrates the control operates. And there is a named deputy who has actually done it, not merely been named. None of that requires headcount; all of it will be asked about at audit.

Where the firm genuinely cannot separate the roles internally, buying oversight in — a consultant or an interim reviewing quarterly — is a reasonable and proportionate answer, and considerably better than a nominal internal signature. Our guide to fractional and interim finance in FCA-regulated firms explains when each model fits, and the FCA’s client money and assets pages are the regulator’s own starting point.

CASS oversight vs operations: FAQs

Is there a CASS senior manager function?

No. At the firms where it applies, broadly CASS medium and large firms, responsibility for CASS compliance is a prescribed responsibility allocated to an existing approved senior manager, such as the finance director, chief operating officer or head of compliance. The old CASS operational oversight controlled function no longer exists as a separate role.

Does a CASS small firm need oversight at all?

Yes. Classification changes reporting frequency and the formality of senior oversight, not the core protections. A CASS small firm still segregates, reconciles, maintains a resolution pack, has an annual CASS audit and needs clear, named accountability.