Where the rules and the operating reality diverge

Client money is the part of the UK insurance distribution stack where the operating realities of digital-first distribution have outrun the supervisory assumptions baked into the rule set. CASS 5 governs insurance distribution activity and CASS 7 governs investment business, and both were written for transaction volumes, settlement speeds, and intermediary chains that no longer describe how premium actually moves.

Today that means embedded insurance, API-bound MGAs, aggregator-fed personal lines, real-time premium flows, multi-bank PSP-mediated settlement, and intermediary chains of three, four, or five hops before money reaches the carrier. The rules have not changed at the same pace. Supervisory expectation has.

The supervisory posture has hardened as the rule book thinned

The FCA retired more than 90 Dear CEO and portfolio letters in April 2025, and over 100 multi-firm and thematic reports in August 2025, replacing them with a thinner and more direct supervisory communications stack. Less published guidance is not less scrutiny — it moves the burden of interpretation onto the firm.

The first sector-specific Regulatory Priorities report, published in February 2026 and addressed directly to insurance intermediaries, confirmed that the FCA expects boards and chief executives to take prompt action against any compliance gap. Delegated authority models, claims handling, and remuneration arrangements were all named explicitly as 2026 supervisory focus areas. Within that posture, CASS is one of the tests where the regulator has shown the least patience for firms making the same mistake twice.

What the audit data actually shows

The FCA receives roughly 3,000 CASS audit reports a year across its regulated population. Inside the insurance-intermediary subset, the published experience of the major CASS auditors is unsparing.

The causes are predictable and repeat across firms: weak reconciliation processes, gaps in books and records, defective Terms of Business Agreements, manual processing at volumes the manual process cannot sustain, and credit write-back practices the regulator no longer accepts.

The FCA’s 2024 portfolio letter to insurance intermediaries named the operating pattern that worries it most in three phrases: "weak books and records, end-of-life IT, and heavy manual processing". That is a description of an operating model, not of a control failure. It is also a fair description of a large part of the market.

Why manual reconciliation stops working

Volume-led distribution produces transaction-level reconciliation requirements that manual and partly-manual processes were never designed to deliver. The failure is not that people make more mistakes at volume — it is that the detection interval stays fixed while the transaction count rises, so the number of undetected items between cycles grows with the book.

Three specific pressures show up first:

  • Chain length. Sub-broking, MGA, premium finance, and PSP hops each introduce a holding point with its own timing, its own record, and its own opportunity for a break. Reconciling the ends of the chain tells you nothing about where in the middle it diverged.
  • Settlement timing. Premium that used to move in monthly bordereaux now moves continuously, but the client money calculation still runs on a periodic cadence. The gap between money movement and money evidence widens.
  • Multi-bank structures. Firms operating several trust accounts across several banks for concentration reasons multiply the external reconciliation load without adding any staff to carry it.

Firms that have invested in real-time reconciliation architecture, segregation-of-duties controls, and integrated CMAR reporting are demonstrably better positioned for the 2026 supervisory cycle than those that have not.

Payment providers and the timing problem

This is the practical consequence of the payments perimeter moving. When premium passes through a payment service provider or e-money institution before reaching a client money account, the question of when the firm "received" client money — and therefore when the trust obligation attached — becomes a live control question rather than a theoretical one.

The FCA has been explicit here. At the PKF–FCA bi-annual meeting in June 2025, it confirmed that firms must review their relationships with payment service providers to determine whether the PSP qualifies as an Other Agent under CASS 5, and how the PSP sits within the firm’s existing reconciliation requirements. Firms are expected to assess whether the PSP introduces a delay in the receipt of client money, and to put arrangements in place to manage that delay consistently with the trust obligation.

Since 7 May 2026 those same PSPs and e-money institutions have themselves been operating under the CASS 15 safeguarding regime created by FCA Policy Statement PS25/12 — daily reconciliation, monthly FCA returns, an annual safeguarding audit, 48-hour resolution pack readiness, and a bank acknowledgement letter with no right of set-off. CASS 15 does not apply to insurance intermediaries, who remain under CASS 5. It does apply to a growing share of the infrastructure they settle through. We set out that distinction in full in CASS 15 and Insurance Intermediaries.

The 48-hour test

The clearest single benchmark to come out of the new regime is the resolution pack standard: records assembled and current enough that an insolvency practitioner could act within 48 hours. It is not a CASS 5 obligation. It is a useful test regardless, because it measures something no dashboard does — whether your evidence exists as a live product of the system or as a document somebody builds on request.

Run it honestly. Take the current date, and ask how long it would take to produce per-client balances current to the latest reconciliation, a complete list of trust accounts with signatories and bank acknowledgements, the most recent internal and external reconciliations, and the open breach record with owners and ageing. If the answer involves anyone opening a spreadsheet to assemble it, the pack is a project, not a control.

What scaled reconciliation actually requires

  • One record of the money movement. Premium, return premium, claims money, and commission extraction posted against a single transaction spine, so internal and external reconciliation reconcile the same object rather than two representations of it.
  • Prior-day discipline by construction. Calculations built on prior-day balances because the data model enforces it, not because a procedure says so.
  • Break workflow, not break reports. Each difference raised as an owned item with ageing and escalation, rather than a line on a report somebody triages.
  • Third-party balances on a known cadence. Appointed representative and delegated operator holdings pulled in on schedule, with escalation when they are late — the most common reason a correctly-executed calculation is still wrong.
  • Contemporaneous evidence. Every entry, movement, and sign-off stamped with user, time, and authority at the moment it happens.
  • Segregation of duties in the system. The person who produces the reconciliation cannot be the person who signs it off.

What to do next

  1. Run the 48-hour test on your resolution pack and time it honestly.
  2. Map every holding point in your premium chain — sub-brokers, MGAs, premium finance, PSPs — and record the timing at each.
  3. Classify your payment providers against the Other Agent question under CASS 5 and document how each sits in your reconciliation.
  4. Measure your detection interval, not your rule compliance. The 25-business-day maximum is an outer limit, not a target.
  5. Read your last CASS audit findings against the sector pattern — weak books and records, end-of-life IT, heavy manual processing. If any of the three describe you, that is the programme.