The inception of COVID-19 saw a flurry of CASS associated Dear CEO Letters which link strongly to the FCA’s objectives of protecting consumers and the financial markets. The most recent of these letters addressed four principal areas of harm in the ‘Custody and fund services industry’ – one of these being the sub-standard oversight and control of client money and assets. The potential impact of this can be understood as:
Financial losses to investors; and
The undue delay or inability to recover client money and assets, should the regulated firm become insolvent.
The FCA identified four key thematic weaknesses which were prevalent in contributing to this sub-standard oversight and control of client money and assets.
1. CASS knowledge & expertise
Possessing sufficient CASS knowledge & expertise is the enabler for firms to create an adequate CASS ecosystem. Even with the greatest systems, governance & oversight, the lack of knowledge & expertise substantially reduces the efficacy of this.
From our view of the market, outside of the CASS large firms, there is an obvious lack of expertise across the three lines of defence – most notably in the third line, Internal Audit. As a function which reports into the board (or audit committee) and is independent to senior management, their role in providing independent scrutiny is fundamental to creating a robust CASS ecosystem.
However, the third line isn’t alone in this regard, there are many firms who lack CASS knowledge & expertise across all three lines creating a chronically ineffective CASS environment and higher likelihood of supervisory interest.
2. CASS governance & oversight
Once resourcing is satisfactory, developing robust governance & oversight through a comprehensive CASS framework and infrastructure creates the firm-wide safety net. The governance & oversight framework embeds sensors across your business – ensuring the early detection of potential issues before it cascades into a significant breach or control failure.
From our experience in CASS s166 reviews, poor governance & oversight is a recurring failing and one that CASS firms are yet to tackle effectively. The underlying infrastructure composing the framework includes the following (non-exhaustive):
Adequate reporting lines through strong corporate governance arrangements.
Pertinent CASS training to staff with CASS exposure.
An experienced CASS senior manager who can influence the business.
A comprehensive suite of CASS policies, procedures, and framework documentation.
Relevant and timely review of management information.
Mature CASS processes with a foundation of strong controls.
3. CASS systems & controls
The books & records are the pathway to conducting reconciliations which is at the heart of the CASS sourcebook. Having the IT infrastructure to ensuring accurate and complete books & records is consequently critical to the effectiveness of the reconciliation output. In our experience, legacy or end-of-life IT systems lack the agility to change to the business and regulatory needs, often resulting in manual work-arounds without strong controls to support them. Another common pitfall is ledger systems not having adequate controls around double-sided accounting entries manifesting in an error-prone environment.
4. CASS change management
Identifying and assessing CASS impacts to change is a challenge for almost all firms, especially in fast growing and complex businesses. Creating the correct governance & oversight is therefore essential in mitigating the risk of changes being implemented without CASS impacts being considered. If you have a change committee, integrating a CASS touchpoint is an easy way of providing a CASS lens to change. As mentioned at the top of this paper, the right CASS knowledge & expertise is required to perform the impact assessment.
Solution to your challenges
For ease, we’ve compiled a five-step process to help find a solution to your challenges:
1. Determine if you have the required level of CASS knowledge & expertise.
2. If you’re stuck at #1 - seek external expertise for support.
3. Undertake a deep-dive review of your CASS ecosystem to ascertain where the gaps are.
4. Develop a remediation project (or perhaps a programme!).
5. Implement and embed the actions.
If you’d like to discuss any of the points above or how we can support your firm, you can contact our CASS lead Zakir Karim.
Comments