CASS Guide

What is the Client Assets Sourcebook (CASS), why does it sit at the centre of every FCA-regulated firm that holds client money or safeguards client assets, and what does effective CASS compliance actually require in practice — given the statutory trust framework, the daily reconciliation discipline, the CASS resolution pack obligations, the SMF18 oversight requirement, and the annual CASS audit that sit behind every firm operating under CASS rules?

The Client Assets Sourcebook — universally known as CASS — is the chapter of the FCA Handbook that governs how regulated firms hold, protect, control, and account for the money and assets they hold on behalf of their clients. It is one of the most operationally demanding areas of UK financial services regulation, and one of the most consequential. CASS is the framework that ensures that when clients place money or assets with a regulated firm, those assets are protected from the firm’s own creditors, are properly segregated, are reconciled daily, are controlled by individuals with explicit senior management responsibility, are audited annually by independent professionals to specific standards, and are returned promptly to clients in the event the firm fails. CASS is the answer to the question “what happens to my money or my shares if my broker, my wealth manager, my fund administrator, or my custodian goes bust” — and the answer is that, properly applied, CASS ensures clients get their assets back.

The stakes around CASS are extraordinarily high. A firm that holds client money or safeguards client assets and fails to comply with CASS exposes its clients to potentially total loss in the event of firm failure, and exposes itself to the most severe regulatory sanctions the FCA has available — including substantial fines, individual sanctions against senior managers responsible for CASS oversight, and ultimately the withdrawal of authorisation. The history of UK financial services regulation includes multiple cases where CASS failures have driven major enforcement outcomes, individual prohibitions, and firm closures. This is not a regulatory area where the consequences of getting compliance wrong can be tucked away as ordinary business risk.

The operational requirements that flow from CASS are substantial. Firms must establish and maintain a statutory trust over client money. They must perform internal client money reconciliations at least daily. They must perform external client money reconciliations against bank statements daily. They must perform internal and external custody reconciliations on appropriate frequencies. They must maintain a CASS resolution pack capable of supporting orderly distribution of client assets in the event of firm failure. They must appoint an SMF18 — the CASS operational oversight function under the Senior Managers and Certification Regime — with personal responsibility for CASS compliance. They must submit the quarterly Client Money and Assets Return (CMAR) to the FCA. They must commission an annual CASS audit by an independent auditor to standards published by the Financial Reporting Council, and the auditor must opine on the firm’s CASS compliance against detailed assertion-based or direct examinations. And they must demonstrate, year after year, that all of this is operating effectively rather than merely existing on paper.

This guide sets out what CASS is, what the rules require, how the framework operates in practice, what the senior management oversight obligations involve, what the annual audit examines, and what the recruitment implications are for firms building or strengthening their CASS function. It is written for senior finance leaders, Chief Operating Officers, Heads of Operations, CASS Managers, Heads of Client Assets, SMF18 holders, and the Compliance Officers and Internal Auditors who work alongside them in firms operating under CASS rules.

It is written from the perspective of FD Capital’s team — a specialist finance recruitment firm placing senior finance and compliance leaders into UK FCA-regulated firms since 2018, including substantive engagement with CASS Manager, Head of Client Assets, and SMF18 recruitment for firms across the regulated population.

Call 020 3287 9501 or email recruitment@fdcapital.co.uk to discuss CASS-related senior recruitment, including CASS Managers, Heads of Client Assets, SMF18 holders, and CASS Operational Oversight appointments.

What CASS Is and Why It Exists

CASS is the chapter of the FCA Handbook — Sourcebook 9, formally called the “Client Assets Sourcebook” — that sets out the detailed rules governing how regulated firms must hold, protect and control client money and client assets. The framework has its origins in the Financial Services Act 1986 and has been substantively developed through successive regimes, most recently the Markets in Financial Instruments Directive II (MiFID II) and the FCA’s own ongoing rulebook development. CASS is one of the most detailed and prescriptive areas of the FCA Handbook, reflecting both the operational complexity of holding client assets and the severe consequences of getting protection wrong.

The fundamental purpose of CASS is investor protection in the event of firm failure. When a client places money or assets with a regulated firm — buying shares through a broker, depositing cash with a wealth manager pending investment, holding a position with a CFD provider, or any of countless other scenarios — the client’s expectation is that those assets remain the client’s property and will be returned in the event the firm fails. CASS operationalises this expectation through a framework of legal protections (the statutory trust), operational requirements (segregation, reconciliation, controls), governance arrangements (senior management responsibility), and supervisory mechanisms (the CMAR, the annual audit, supervisory engagement).

The framework applies to firms that hold client money or safeguard client assets in the course of their MiFID or similar regulated activities. The application is broad and captures investment firms, wealth managers, stockbrokers, fund administrators, custodians, prime brokers, foreign exchange firms, contracts for difference providers, spread betting firms, and many other categories. The application also varies by activity — a firm may be subject to CASS in respect of some activities and not others, depending on the specific regulatory permissions it holds and the way it operates each line of business.

CASS sits within the wider FCA Handbook architecture alongside other client-facing protective frameworks: the Conduct of Business Sourcebook (COBS), the Insurance Conduct of Business Sourcebook (ICOBS), the Mortgage Conduct of Business Sourcebook (MCOB), and the Banking Conduct of Business Sourcebook (BCOBS). CASS is distinct from these in being principally about the legal and operational handling of client property rather than about how firms communicate with or treat clients. A firm can have entirely satisfactory client communications and treatment while having materially defective CASS arrangements, and vice versa.

The CASS Handbook Structure

The CASS Handbook is organised into a series of chapters, each addressing a specific aspect of client money or client asset protection. Understanding the structure helps senior CASS professionals navigate the rules efficiently.

CASS 1 — Application and General Provisions. The opening chapter sets out the scope of CASS, defines key terms, and addresses general application questions. CASS 1 also includes the firm classification framework — CASS large firms, CASS medium firms, and CASS small firms — which determines the intensity of certain obligations.

CASS 1A — Application and General Provisions (amendments). Subsequent amendment provisions affecting application.

CASS 5 — Client Money: Insurance Mediation Activity. A specialised chapter applying to firms engaged in insurance mediation, with rules tailored to the specific operational realities of insurance broking and intermediation.

CASS 6 — Custody Rules. The chapter governing the safe custody of client assets — typically securities such as shares, bonds, and other financial instruments held on behalf of clients. CASS 6 establishes the obligation to hold assets in a manner that distinguishes them from the firm’s own assets, prescribes acceptable custodian arrangements, and sets out reconciliation and record-keeping requirements.

CASS 7 — Client Money Rules. The chapter governing the holding of client money — typically cash held on behalf of clients pending investment, awaiting return, or held as collateral. CASS 7 establishes the statutory trust over client money, the segregation requirements, the rules on permitted depository arrangements, the reconciliation discipline, and the daily client money calculation.

CASS 7A — Client Money Distribution and Transfer. The chapter governing what happens to client money when a firm enters insolvency or a primary pooling event occurs. CASS 7A sets out the distribution rules — how client money is pooled, how shortfalls are addressed, and how distributions are calculated and made to entitled clients.

CASS 8 — Mandates. The chapter governing situations where a firm has authority to operate a client’s bank or custody account without itself holding the money or assets. The mandate framework addresses the specific risks that arise where a firm has access to client assets it does not hold.

CASS 9 — Prime Brokerage. A specialised chapter for prime brokerage activities with the particular operational characteristics of that business, including provisions on the use of client assets in stock lending and similar activities.

CASS 10 — CASS Resolution Pack. The chapter requiring firms to maintain a CASS resolution pack — a comprehensive documented set of information and processes that would enable an insolvency practitioner to take rapid control of client assets and effect orderly distribution in the event of firm failure.

CASS 11 — Debt Management Firms. Specialised provisions for client money in debt management activities.

CASS 13 — Insurance Distribution: Pre-application Forms. Specific application provisions.

CASS 14 — Claims Management Firms. Provisions for claims management businesses.

CASS 15 — Small Payment Institutions. Provisions for the safeguarding obligations of small payment institutions under the Payment Services Regulations 2017, complementing the broader payment services framework.

Most large firms are subject primarily to CASS 6 (custody) and CASS 7 (client money), with CASS 7A engaged in insolvency scenarios, CASS 8 engaged where mandate arrangements exist, and CASS 10 always engaged for resolution planning. The specialised chapters (5, 9, 11, 13, 14, 15) apply to firms with the relevant regulated activities.

The Statutory Trust and the Segregation Principle

The legal foundation of CASS is the statutory trust. CASS 7 imposes a trust over client money — meaning that as a matter of English trust law, the firm holds client money on trust for its clients rather than as the firm’s own property. The legal effect is profound. Client money that is properly held under the CASS statutory trust is not part of the firm’s assets in insolvency. The firm’s general creditors have no claim against client money. Clients have a beneficial interest in the trust property and are entitled to recovery of their proportionate share of pooled trust assets.

The statutory trust framework is reinforced operationally by strict segregation requirements. Client money must be held in client bank accounts at approved depositary institutions, designated as such, and kept separate from the firm’s own money at all times. Acceptable depositaries are specified in CASS 7 — typically central banks, credit institutions authorised in the UK or other equivalent jurisdictions, qualifying money market funds, and similar arrangements. Firms must perform appropriate due diligence on their depositaries and must consider the diversification of client money holdings to reduce concentration risk to any single depositary.

The segregation principle applies similarly to client custody assets under CASS 6. Custody assets must be held in a manner that distinguishes them from the firm’s proprietary assets — typically through designated custody accounts, designated nominee arrangements, or equivalent structures that prevent commingling with the firm’s own holdings. The legal effect is that custody assets, properly held, remain the property of the client and can be recovered by the client in the event of firm failure.

The statutory trust and segregation framework can be defeated by operational failures. A firm that fails to designate accounts properly as client accounts, fails to segregate adequately, fails to perform reconciliations that would identify segregation failures, or otherwise breaches CASS 6 or 7 may find that its client money or custody assets are not properly protected by the trust. In those scenarios, clients become unsecured creditors of the firm rather than beneficiaries of trust property — a materially worse position. The operational disciplines of CASS exist precisely to prevent these scenarios.

CASS 6 — Custody Assets in Practice

CASS 6 governs the safe custody of client assets — typically securities and other financial instruments held on behalf of clients. The rules cover the registration and recording of custody assets, the depositary arrangements through which custody is maintained, the use of nominee structures, the rules on registration of legal title, and the reconciliation discipline that ensures accurate records throughout.

The fundamental obligation is to hold custody assets in a manner that distinguishes them from the firm’s own assets and from those of other clients (where required) sufficient to enable identification, recovery, and return. This is typically achieved through: registration of assets in nominee names that identify them as held for clients; use of segregated custody accounts at depositaries; clear records linking each individual client’s beneficial interest to specific assets or pooled positions; and periodic reconciliation of internal records against external custodian statements.

The specific operational requirements include daily reconciliation of internal custody records against external depositary records (or, for some firms, less frequent reconciliations subject to specific arrangements), maintenance of asset records that identify each client’s beneficial interest, controls over the movement of assets in and out of custody, and the documentation of custody arrangements with each external depositary including specific contractual provisions required by CASS 6.

The use of foreign depositaries and sub-custodians introduces additional complexity. CASS 6 contains specific provisions addressing the due diligence requirements when appointing sub-custodians, the contractual provisions that must be in place, and the circumstances under which different jurisdictional protections apply. Firms with international custody arrangements must navigate these provisions carefully and document the rationale for their custody chain decisions.

CASS 7 — Client Money Rules in Practice

CASS 7 governs client money — cash held by the firm on behalf of clients. The rules establish the statutory trust, prescribe the segregation arrangements, set out the depositary requirements, mandate the reconciliation discipline, and address the specific operational scenarios that arise across different lines of business.

The core operational requirement under CASS 7 is the daily client money calculation. Firms must determine, on each business day, the amount of client money for which they are responsible — taking into account all client money receipts, payments, transfers, and adjustments from the previous business day. The firm must then ensure that the amount held in client bank accounts is at least equal to the amount of client money for which the firm is responsible. Where there is a shortfall, the firm must immediately top up the client bank accounts from its own resources. Where there is an excess, the firm may withdraw the excess.

The internal client money reconciliation supports the daily calculation. The reconciliation compares the firm’s internal records of client money owed to clients (typically derived from the firm’s books and ledgers) against the amount the firm believes it is holding in segregated accounts. Discrepancies identified through internal reconciliation must be investigated and resolved.

The external client money reconciliation compares the firm’s internal records against external bank statements from the client money depositary banks. Daily comparison of internal balances against external bank statements is the discipline that catches operational errors, mis-postings, system errors, and external bank errors before they become more serious problems. The external reconciliation is one of the most operationally consequential controls in CASS.

The specific rules around acceptable client money depositaries, the percentage of client money that may be held with any single depositary (the diversification rules), the rules on permitted use of client money (including for limited purposes such as receipt of interest), and the rules on permitted withdrawals (including for fees and charges where properly authorised) are all detailed in CASS 7. The CASS Manager and the SMF18 holder need substantive working knowledge of these provisions and the way they apply to the firm’s specific business model.

The CASS Resolution Pack (CASS 10)

The CASS Resolution Pack — established under CASS 10 — is one of the most operationally demanding aspects of the CASS framework. The pack is a comprehensive collection of documentation, procedures, contact information, system access details, and operational instructions that an insolvency practitioner could use to take immediate control of the firm’s client assets and effect orderly distribution to entitled clients in the event of firm failure.

The required contents of the CASS Resolution Pack include: details of all client bank accounts and depositary arrangements; details of all custody arrangements and sub-custodians; the firm’s client money calculation methodology and the most recent calculations; the firm’s reconciliation procedures and records; details of all client mandates; the firm’s client records sufficient to identify each client and the client’s interest in firm-held assets; details of how the firm’s IT systems support client asset records; access information to the relevant systems and data; and operational procedures that would support an insolvency practitioner taking control.

The pack must be maintained on a current basis — not as a static document prepared once and forgotten, but as a living set of documentation reflecting the firm’s current arrangements. Many firms have found that maintaining the pack effectively requires dedicated process owners, regular review cycles, and integration with the firm’s broader change management and incident response processes. Material changes to the firm’s client money or custody arrangements must trigger updates to the resolution pack.

The discipline of maintaining a usable resolution pack is itself a substantial operational benefit, beyond its specific resolution purpose. Firms that maintain genuine, current, accurate resolution packs typically also maintain the underlying processes and records to a higher standard than firms whose resolution packs exist only on paper. Supervisors have generally welcomed firms’ progress in this area while continuing to challenge firms whose pack maintenance is inadequate.

SMF18 — The CASS Operational Oversight Function

Under the Senior Managers and Certification Regime (SMCR), CASS firms are required to allocate the CASS operational oversight function — formally Senior Management Function 18 (SMF18) — to a specific senior individual. The SMF18 holder bears personal regulatory responsibility for the firm’s CASS compliance.

The scope of SMF18 responsibility encompasses the firm’s overall CASS framework: the systems and controls supporting client money and custody operations, the reconciliation processes, the client money calculation, the resolution pack maintenance, the CMAR submission, the CASS audit relationship, the management of CASS-related incidents and breaches, and the ongoing engagement with the FCA on CASS supervisory matters. The SMF18 holder is the individual whom the FCA looks to first when CASS questions arise about the firm.

The CASS firm classification framework determines the specific SMF18 requirements. CASS large firms — typically those holding more than £1 billion in client money or more than £100 billion in safe custody assets — must allocate SMF18 to a dedicated senior manager with substantive CASS expertise. CASS medium firms — generally those between the small and large thresholds — must also allocate SMF18, but with more flexibility on the specific allocation. CASS small firms operate with simpler arrangements proportionate to their scale.

The SMF18 holder must be approved by the FCA before taking up the role and is subject to the broader SMCR framework: the Statement of Responsibilities documenting the specific responsibilities held, the Duty of Responsibility under FSMA s66A meaning the individual can be held personally responsible for failures in their area, the Conduct Rules applying to their conduct in role, and the Regulatory References regime requiring extensive due diligence at appointment.

Recruiting an SMF18 — particularly for a CASS large firm — is therefore a substantial undertaking. The candidate must have the technical CASS expertise to discharge the role substantively, must have the seniority and authority within the firm to drive compliance, must be capable of credible engagement with the FCA, must satisfy the FCA’s “fit and proper” test, and must be willing to accept the personal regulatory responsibility the role entails. Candidates with these attributes are scarce and command premium compensation in the recruitment market.

The CMAR — Client Money and Assets Return

The Client Money and Assets Return (CMAR) is the quarterly regulatory return that every CASS firm submits to the FCA. The CMAR captures detailed information about the firm’s client money and custody asset balances, the CASS firm classification, the firm’s compliance with key CASS requirements, any breaches identified during the period, the firm’s reconciliation status, and other supervisory information.

The CMAR is submitted through the FCA’s RegData regulatory reporting system on a quarterly basis. The submission deadlines and the specific data points required are set out in the FCA’s reporting rules. Accurate CMAR submission requires close coordination between the CASS Manager, the firm’s regulatory reporting team, and the SMF18 holder who ultimately attests to the accuracy of the return.

The CMAR functions as both a supervisory monitoring tool — enabling the FCA to track the CASS estate quarter by quarter — and as a self-assessment mechanism for firms, requiring them to articulate their CASS compliance status formally and consistently. Misstatements in the CMAR — whether through error or through optimistic interpretation of a borderline issue — can themselves become regulatory matters if subsequently identified through audit or supervisory review.

The CASS Audit

The CASS audit is the annual independent examination of the firm’s compliance with CASS rules, conducted by an external auditor to standards published by the Financial Reporting Council (FRC). The audit results in an auditor’s report addressed to the firm’s directors and to the FCA, and the report’s content can have significant supervisory consequences.

The applicable standards have evolved over time. The current framework operates under the FRC’s Standards for Investment Reporting (SIR), with specific application guidance issued by the ICAEW (notably AAF 01/20 — “Assurance on master trust schemes; CASS audit”) and by the FRC. The audit examines the firm’s CASS compliance against detailed assertion-based or direct examinations, depending on the specific CASS chapter and rule under examination. The audit is significantly more substantive than a financial statement audit and typically involves examination of the firm’s CASS systems, reconciliation records, client money calculations, custody records, breach logs, resolution pack contents, and other compliance evidence.

Two principal forms of CASS audit report exist: “reasonable assurance” reports (the higher level of assurance) and “limited assurance” reports (the lower level). The applicable form depends on the specific rules and the firm’s circumstances. The auditor’s report identifies any breaches identified during the audit and any matters where compliance could not be substantively confirmed.

For firms, the CASS audit is one of the most operationally consequential events of the regulatory year. Substantial preparation is required, audit findings need to be addressed, and material breaches identified through audit can trigger supervisory engagement, individual sanctions, and remediation programmes. Firms that maintain strong internal CASS controls typically experience the audit as a substantive but manageable event; firms with weak controls often experience material findings that require extensive subsequent remediation.

The relationship with the CASS auditor is itself a substantive matter. CASS audit work is concentrated among a relatively small number of audit firms with the specialist expertise required, and the relationship between the firm’s CASS function and the audit firm — covering scope, fee, timing, and ongoing engagement — is one of the SMF18’s continuing responsibilities.

Common CASS Breaches and Issues

Specific patterns of CASS breach recur across the regulated population. Recognising these patterns supports both prevention and remediation when issues do arise.

Reconciliation discrepancies left unresolved. Reconciliation processes that identify discrepancies but do not drive timely resolution create accumulating issues that eventually become material. Firms with strong CASS controls treat reconciliation discrepancies as urgent matters requiring same-day or next-day resolution; firms with weaker controls allow them to accumulate.

Inadequate segregation discipline. Failures to segregate client money or custody assets properly — through mis-categorisation of accounts, system errors that route receipts to wrong accounts, or operational shortcuts that commingle client and firm assets — represent some of the most serious CASS breaches because they go directly to the protective purpose of the framework.

CMAR misstatement. Inaccurate CMAR submissions — through error, system issues, or optimistic interpretation — can themselves trigger supervisory engagement. Firms must invest in CMAR quality assurance to prevent this.

Resolution pack staleness. Resolution packs that exist only as historical documents rather than living current sets of documentation can fail to support the orderly distribution they are intended to enable. Firms whose resolution pack maintenance has lapsed face material remediation work.

SMF18 capability gaps. SMF18 holders without substantive CASS expertise — through promotion of generalist senior managers without specific CASS background — represent a vulnerability. The SMF18 must be capable of substantive engagement with CASS issues, not merely formal accountability.

Inadequate breach reporting. CASS breaches must be properly identified, classified, recorded, and where required reported to the FCA. Firms whose breach identification and reporting processes are weak find that breaches accumulate without proper response.

Sub-custodian arrangements without due diligence. CASS 6’s provisions on sub-custodian appointment require substantive due diligence and contractual provisions. Firms that have used sub-custodians without applying these provisions properly face remediation challenges.

Mandate framework gaps. CASS 8’s mandate provisions can be missed where firms operate authority over client accounts without explicit recognition of the mandate framework. The risks of unrecorded mandates can be substantial.

Recruitment Implications — CASS Roles UK Firms Need

The CASS framework drives demand for several distinct senior roles across UK firms operating under CASS rules.

Head of Client Assets / Head of CASS. The senior leader of the firm’s client assets function. The role typically owns the firm’s overall CASS framework, leads the day-to-day operations team, manages the reconciliation discipline, oversees the CMAR submission, manages the CASS audit relationship, and supports the SMF18 holder. For larger firms, this is a substantial senior role with material team management responsibility.

SMF18 — CASS Operational Oversight Function holder. The senior manager with personal regulatory responsibility for CASS compliance. For CASS large firms, this is typically a dedicated senior appointment; for smaller firms it may be combined with other senior responsibilities. Recruitment is intensive given the personal regulatory liability the role entails.

CASS Manager. The day-to-day operational leader responsible for the CASS function. Manages the operational team, supervises reconciliations and the daily client money calculation, leads the CMAR preparation, supports the audit, and escalates issues appropriately. This is typically the central role in mid-sized CASS operations.

Client Money Reconciliation Manager / Custody Operations Manager. Operational team leadership roles within the CASS function, responsible for specific aspects of the day-to-day operations.

CASS Compliance Officer. Senior compliance professional with specific CASS expertise, typically working alongside the operational CASS team and providing the second-line oversight of CASS compliance.

Internal Audit — CASS Specialist. Internal audit functions in larger firms typically include a CASS specialist or senior auditor with substantive CASS expertise capable of conducting independent assurance over the CASS function.

The CASS recruitment market is competitive. Experienced CASS professionals are scarce relative to demand, particularly for SMF18 candidates and senior CASS Managers in CASS large firms. Compensation for senior CASS roles has risen materially over recent years as firms compete for the limited pool of substantively qualified candidates.

How FD Capital Works on CASS Recruitment

FD Capital places senior finance and compliance leaders into UK FCA-regulated firms, including substantive engagement with CASS recruitment across the regulated population. Our network includes senior CASS professionals with substantive UK regulatory experience — across CASS 6 custody, CASS 7 client money, CASS 7A distribution, CASS 8 mandates, and the broader CASS framework — and across the principal CASS-affected sectors (investment firms, wealth managers, brokers, fund administrators, custodians, prime brokers, foreign exchange firms, contracts for difference providers).

Adrian personally screens candidates for senior CASS placements given the technical complexity of the framework and the consequences of getting senior CASS hires wrong. Initial introduction is typically within 48 hours for urgent requirements, with full shortlist within five working days for specific assignments.

Initial consultation is confidential and at no charge. Call 020 3287 9501 for an immediate CASS-related senior recruitment requirement, or email recruitment@fdcapital.co.uk.

Related Reading

• SMCR: The Senior Managers and Certification Regime Explained — UK senior management framework including SMF18 context
• Regulatory Reporting: A Complete UK Guide — UK regulatory reporting framework including CMAR context
• Operational Resilience: A Complete UK Guide — UK operational resilience framework
• COBS: The Conduct of Business Sourcebook Explained — adjacent FCA Handbook framework
• Section 166 Skilled Person Reviews: A Complete UK Guide — supervisory tool sometimes used in CASS contexts
• Recruitment for FCA Regulated Firms — specialist recruitment for FCA-regulated firms

FD Capital Recruitment Services

• FCA-Regulated Firms Recruitment — specialist FCA-regulated firms practice
• Compliance Recruitment — compliance professional recruitment
• Risk and Compliance Recruitment — broader risk and compliance recruitment
• Chief Compliance Officer Recruitment — CCO and Compliance Director recruitment
• Operational Resilience Recruitment — operational resilience leadership roles adjacent to CASS
• Regulatory Reporting Recruitment — Head of Regulatory Reporting and adjacent roles

External References

• FCA Handbook — CASS — the official Client Assets Sourcebook
• FCA — Client Assets — FCA guidance and information on client assets
• FCA — Senior Managers and Certification Regime — SMCR framework including SMF18
• Financial Reporting Council (FRC) — publishers of the auditing standards relevant to CASS audit
• ICAEW Audit and Assurance Faculty — including AAF 01/20 and related CASS audit guidance
• ICAEW — professional body for Chartered Accountants
• Payment Services Regulations 2017 — relevant to CASS 15 and payment institution safeguarding