Client Money Used to Meet Payroll
Bramble Securities Ltd is a small FCA-authorised investment firm with 12 staff and permission to hold client money. On 28 March its bank delays a £250,000 loan facility. The finance director transfers £150,000 from the firm's designated client money account to the firm's operating account to pay March salaries and rent, intending to repay it on 3 April when the loan arrives. The firm's records describe the £150,000 as 'firm's own cash'. The loan arrives on 4 April and the money is repaid the same day. The firm's annual CASS audit is due in June. No client has complained or is yet aware of the transfer. The finance director says: 'No harm done - it was only six days.' The compliance officer is unsure whether the transfer was a breach, given that the money was repaid and no client lost out.
1. What client money obligations were breached, and does the repayment cure the breach?
Read the worked answer
The transfer breached CASS 7. Client money must be segregated in a designated client bank account and held on trust for clients; the firm must not use it for its own purposes. Paying salaries and rent from the client money account is a use of client money, and recording the £150,000 as 'firm's own cash' is a further record-keeping and reconciliation failure. The firm also failed to maintain the required daily client money reconciliation and to identify the shortfall.
The repayment does not cure the breach. CASS breaches are strict; what matters is that client money was put at risk and the firm failed to protect it. The conduct also breaches Principle 10 (clients' assets) and Principle 11 (openness with the regulator). Because the transfer was deliberate, the FCA is likely to treat it as serious: it could impose a financial penalty, restrict the firm's client money permission, require a skilled person review, or take action against the finance director personally. 'No harm done' is not a defence.
2. What notifications and records should the firm make, and when?
Read the worked answer
The firm must notify the FCA promptly. SUP 15.3.1R requires notification of a breach of a rule that is significant or relevant to supervision; the applicable CASS client-money shortfall/notification rule also applies. The notification should explain what happened, the amount, the dates, the repayment, the affected clients (if any), and the remedial steps. The firm must not wait for the CASS audit.
It should record the breach in its breach log, update the client money records, and ensure the auditor is given accurate information for the annual CASS audit report. The board and the relevant senior manager should be informed, and the firm should consider whether any client is owed a remedy. If the firm cannot demonstrate that client money is protected, it may need to stop holding client money until controls are fixed. The compliance officer should also consider whether the finance director's conduct needs to be escalated under the SM&CR fitness and propriety process.
3. How should the FCA view the finance director's argument, and what governance and personal accountability issues arise?
Read the worked answer
The FCA would reject the 'no harm' argument. It looks at the firm's systems and controls, the intentional nature of the transfer, and the risk of loss, not just the outcome. The finance director's decision suggests a weak control culture and a failure to understand the client money regime. If the finance director is an approved senior manager (for example, the CFO function, SMF2), the FCA can consider fitness and propriety and may investigate; if not, the individual conduct rules still apply.
The board should review the finance director's role and whether he should remain in a controlled function. The firm should also check whether anyone pressured or directed staff to make the transfer, and whether the compliance officer's concerns were overridden. This is a conduct and culture issue: Principle 3 requires appropriate management and controls, and Principle 11 requires full and frank disclosure. A cover-up or delay would aggravate the breach. The firm should document all decisions and consider independent review.