FCA CASS Classification and Operational Oversight: One Named Individual, and No Prescribed Qualification

A firm holding client money or safe custody assets has to put oversight of its CASS compliance on one named person. The FCA's standard for that person is that they be "a single director or senior manager of sufficient skill and authority". There is no prescribed qualification, no required examination and no continuing professional development cycle written into the rule — for a role that in the largest firms sits above more than £100 billion of custody assets.

That is the shape of the obligation, and it is worth understanding properly, because the classification that determines how heavy it is turns on a calculation most firms do once a year and then forget.

How the FCA classifies a CASS firm

CASS 1A.2.7R sets the thresholds, and there are two separate tables depending on what the firm holds.

Client money, measured on the highest total held in the last calendar year, or projected for the current year:

• CASS large — more than £1 billion
• CASS medium — £1 million to £1 billion, inclusive
• CASS small — less than £1 million

Safe custody assets, measured on the highest value held over the same periods:

• CASS large — more than £100 billion
• CASS medium — £10 million to £100 billion, inclusive
• CASS small — less than £10 million

Notice how wide the medium band is. A firm holding £12 million of custody assets and a firm holding £90 billion are both CASS medium, and carry the same oversight allocation obligation. The classification is a trigger, not a measure of scale.

The higher-of rule, and the dates

Under CASS 1A.2.2R the determination is made once a year, and the firm takes the higher of its highest client money total and its highest safe custody asset value for the previous calendar year ending 31 December. A firm that held neither but projects holding them uses the projected figures instead.

Notification follows under CASS 1A.2.9R. Once each calendar year the firm must notify the FCA in writing of those amounts and of its CASS firm type. Where it held assets in the previous year, or projects holding them at any point up to the fifteenth business day of January, the deadline is the fifteenth business day of January. A firm that begins holding client money or custody assets without having projected it must notify on the business day before it begins.

Under CASS 1A.2.12R, a classification notified by the January deadline takes effect on 1 February following notification. So there is a defined window between knowing your classification and having to operate under it, and it is measured in days rather than months.

One asymmetry worth knowing: medium and large firms do not report balances in the January notification, because they are already submitting Client Money and Asset Returns through the year. The FCA confirms their classification in January instead.

What the oversight allocation actually requires

The requirement differs by classification, and the difference is not cosmetic.

Small firms, under CASS 1A.3.1R, must allocate to a single director or senior manager of sufficient skill and authority the responsibility for oversight of the firm's operational compliance with CASS, and for reporting to the governing body.

Medium and large firms, under CASS 1A.3.1AR, must allocate to a single director or senior manager of sufficient skill and authority three things: oversight of the operational effectiveness of the firm's CASS systems and controls, reporting to the governing body, and completing and submitting a Client Money and Asset Return under SUP 16.14.

Read the two side by side. The small firm standard is compliance; the medium and large standard is effectiveness, which is a materially harder thing to attest to. Operational compliance can be evidenced by showing the controls were followed. Operational effectiveness requires a judgement that the controls work, which is the same distinction that quality regimes elsewhere have been moving towards — the risk-proportionate effectiveness check now embedded in the FDA's Quality Management System Regulation asks precisely this of training systems.

The threshold cliff

The expensive moment is crossing from small to medium, and for a client money firm that happens at £1 million.

Two obligations arrive together. The firm becomes subject to the CMAR regime, and the oversight allocation changes from compliance to effectiveness. The FCA's own guidance is that firms expecting a change should prepare in advance, particularly where they will become medium or large, and that a firm aware of a coming change should contact the FCA.

The practical failure here is a growing firm that treats the January notification as a reporting formality rather than a forecast. The classification is based on the highest amount held at any point in the year, not a year-end or average figure, so a single large settlement can reclassify a firm that spent most of the year well below the threshold.

"Sufficient skill and authority"

This is the whole of the competence standard, and both words are doing work.

Skill is capability — understanding the client money and custody rules well enough to oversee operations under them. Authority is seniority sufficient to be heard by the governing body, which is the point of the reporting line in the rule. A technically expert person without standing cannot discharge the function, and nor can a senior person without the technical grasp.

What CASS 1A does not do is tell a firm how to establish either, or require it to re-establish them. There is no named qualification, no examination and no CPD cycle in the rule. Where the individual holds a function within the Senior Managers and Certification Regime, the annual fit and proper assessment under SYSC 27 applies to them in that capacity, and the broader accountability framework applies too — including the reasonable steps standard and the obligations around regulatory references under SYSC 22. But that competence assessment comes from SM&CR, not from CASS, and a firm relying on it should be able to say so deliberately rather than by accident. Our overview of the Senior Managers and Certification Regime sets out how the two interlock.

The pattern this fits

CASS oversight belongs to a family of regulatory roles built the same way: name one individual, specify their duties precisely, and leave their continuing competence to the firm.

The clearest parallel is the Qualified Person for batch release, where European law specifies the degree, the subjects and the years of experience on entry and then prescribes nothing ongoing at all. CASS inverts it — nothing specified on entry beyond skill and authority, nothing specified ongoing either — but the consequence is the same: the firm's own systems are the only thing standing between a named accountable individual and a competence gap nobody is obliged to look for.

Firms in this space are also now carrying the operational resilience obligations under the Digital Operational Resilience Act, which does specify testing and reporting in detail. The contrast in drafting style between the two is instructive.

Our suggestions

Forecast the classification rather than reporting it. Because the test is the highest amount held at any point, model your expected peak before January and look specifically for the £1 million and £10 million lines.

Write down what "sufficient skill and authority" means in your firm, for the person you have allocated it to, and review it when either the person or the classification changes. The rule does not require this. It is the only way to evidence the judgement if it is ever questioned.

And if you are moving from small to medium, treat the CMAR obligation and the shift from compliance to effectiveness as one project rather than two. They land on the same person, on 1 February, and that person has to be ready to attest to something harder than they attested to the year before.

Firms also holding client money under a separate professional regime should keep the two frameworks distinct — the SRA Accounts Rules operate on different principles and a control that satisfies one will not automatically satisfy the other.