The Break That Grew
On the last business day of the quarter, the operations analyst reconciling the firm's pooled client money bank account finds the cleared balance is £1,186,000 lower than the sum of the individual client ledger balances. The break first appears three weeks ago and has grown steadily since; there is no single day on which it started. The firm commingles client money with its own in the same internal client money account. A large client settled £1.2m of sale proceeds on the day the break first appeared. The analyst's supervisor says the difference is 'probably the unallocated receipt from that settlement' and suggests waiting until month-end to see if it clears. The firm's own cash is £300,000, and client redemptions of £900,000 fall due next week. The analyst asks whether to escalate today.
1. Is the supervisor's explanation plausible, and what must happen today?
Read the worked answer
Partly plausible, but it does not survive the growth pattern. A single unallocated £1.2m receipt would produce a step change, not a steady widening over three weeks. Steady growth points to a recurring cause: fees or expenses taken from the client account without a matching ledger debit, a client payment made from the account without the ledger being reduced, an FX or interest posting applied to the bank but not the ledger, or a client debit posted to the ledger but not paid out.
What must happen today:
- Recompute the reconciliation properly - per-client ledgers against the bank, not just the aggregate. The aggregate hides the allocation of the shortfall.
- Trace the £1.2m receipt to the ledger. If it was never allocated, allocate it and see what remains of the break.
- Establish the first date the break appeared and why the reconciliation did not flag it three weeks ago. A control that reports a growing break only at quarter-end has already failed.
- Escalate to the head of operations, compliance and the money laundering reporting officer's counterpart on the financial side - the MLRO is not the right escalation; the board and the regulator are.
- Freeze discretionary payments out of the client account until the position is understood, while ensuring no individual client is left unpaid in a way that breaches the firm's obligations to them.
'Wait until month-end' is the wrong answer because a client money shortfall is made good regardless of cause, and delay makes both the shortfall and the breach worse.
2. What are the firm's obligations on remediation and notification, and where does the money come from?
Read the worked answer
Remediation comes first, investigation second. A client money shortfall must be made good from the firm's own funds as soon as practicable, without waiting to identify the cause. Clients must not be exposed to the risk while the firm investigates.
The funding problem is real. The firm holds £300,000 of its own cash against a £1,186,000 shortfall, and £900,000 of redemptions are due next week. The firm cannot cover the shortfall from its own resources. That means:
- Immediate board escalation, with a funding plan - group support, a capital injection, or a facility.
- No payment of one client's redemption out of money that belongs to another. If the shortfall is not made good, paying redemptions from the pooled account deepens the breach.
- A candid assessment of whether the firm still meets its threshold conditions and whether it should stop taking on new client money.
Notification: the regulator must be told promptly, in writing, with the amount, the date the break arose, the likely cause, the remediation plan, the source of the funds and the timeline. Auditors and, where relevant, the firm's bankers should be brought in. Silence while the firm tries to trade its way out is the worst option.
A shortfall that is quietly netted off at month-end is not a reconciliation difference - it is a reportable event.
3. What records and evidence must be preserved, and what should the breach log look like?
Read the worked answer
Preserve the full evidential chain, because the regulator's first question will be who knew what and when:
- Every daily reconciliation for the period, including the ones that did not flag the break, plus the reconciliation policy and the sign-off records.
- Bank statements and ledger extracts for the whole period, and the audit trail for the £1.2m settlement.
- The transfer(s) used to make good the shortfall - date, amount, authoriser, and a clear record that firm money moved into the client account.
- Correspondence, including the supervisor's 'wait until month-end' email and the analyst's escalation.
- The breach register entry: date identified, date the shortfall first arose, amount over time, affected clients, root cause, remediation, regulatory notification date and reference, and the control changes made.
Two things should be explicit in the record: that the shortfall was made good from firm money and not from other clients' money, and that no client suffered a loss as a result. If either cannot be stated, the entry is not finished.