A £1.9m Client Money Shortfall Before the Weekend
On Friday 28 June at 16:10, the operations team at Kestrel Securities identifies a £1.9m shortfall in the firm's client money bank account. The reconciliation had not been completed for four business days because of a system migration. The shortfall appears to result from £1.7m of client proceeds being paid into the firm's own account on 24 June and a £0.2m timing difference. A similar £140,000 shortfall occurred in April and was corrected within two days but not logged. Kestrel holds £310m of client money and is FCA-authorised. The CFO says the issue can be fixed on Monday when the bank opens and asks the compliance officer to 'keep it internal until we understand it'. The CEO is travelling. The firm's breach policy says material breaches must be escalated to the board and notified to the FCA 'as soon as practicable'. The compliance officer must act before the weekend.
1. Assess whether the shortfall is a reportable breach and what immediate steps are required, including treatment of the client money.
Read the worked answer
The shortfall is likely a reportable breach. Client money rules require the firm to identify and remedy shortfalls promptly, and a £1.9m shortfall in a £310m client money pool is material by any reasonable measure. The fact that a prior £140,000 shortfall was not logged makes the control failure more serious. Immediate steps are to stop further client money movements from the affected account; calculate the exact shortfall and identify affected clients; fund the shortfall from the firm's own resources immediately, without waiting for the bank to open, if the firm can do so; preserve records and the reconciliation; escalate to the CEO, board and MLRO or compliance; notify the FCA as soon as practicable, since the weekend does not justify delay where a notification obligation exists; and consider whether the firm can continue to hold client money safely. The CFO's instruction to 'keep it internal' should be rejected. The compliance officer should document the decision and escalate to the chair if necessary.
2. Explain the governance and escalation failures revealed and how the compliance officer should respond to the CFO's request.
Read the worked answer
The governance failures are the absence of daily reconciliation for four days during a system migration, the failure to log the April shortfall, a CFO proposing to delay remediation and notification, and a breach policy that appears not to have been followed. The compliance officer should tell the CFO that the shortfall cannot be kept internal, explain the regulatory obligation and put the advice in writing. If the CFO persists, the compliance officer should escalate to the CEO and chair and consider making a notification to the FCA independently if the firm is not doing so. The board should be convened urgently. The compliance officer should also check whether the firm's client money permission and procedures remain adequate and whether the auditor or the FCA needs to be informed. Personal accountability matters: the SMF for client money and the CFO should be clear about their responsibilities.
3. Recommend the root-cause analysis and remediation plan, including how to prevent recurrence and what to report to the board.
Read the worked answer
Root-cause analysis should cover the system migration and its controls, reconciliation ownership and segregation of duties, the failure to log the April shortfall, the escalation culture and the CFO's response. Remediation should include daily reconciliation restored and independently reviewed; a shortfall log with root causes and ageing; a formal client money policy and training; a system change control process; and a board report with key indicators such as reconciliation breaks, shortfall amounts and ageing. The firm should consider an independent review of client money processes and report the outcome to the FCA. The board should receive a written report within days, not weeks, and should track actions to completion. The firm should also consider whether the April shortfall should be notified retrospectively. Prevention depends on culture and incentives as much as on controls: reconciliation staff must be able to escalate without fear.