CASS 8 Mandates Explained for Smaller Firms

Where CASS 8 Sits in the Client Assets Rules

The Client Assets sourcebook (CASS) protects client money and assets when a firm holds or controls them. CASS 5 covers client money at insurance intermediaries, CASS 6 covers custody assets and CASS 7 covers client money at investment firms. CASS 8 is different: it deals with the situation where a firm does not hold the client’s money or assets itself but has the ability to control them, or to commit the client to a liability, through an authority the client has given. For the wider picture, see our guide to CASS client money oversight. The rest of this post stays on mandates.

The FCA states the purpose of the chapter plainly: the mandate rules require firms to establish and maintain records and internal controls to prevent the misuse of a mandate. You can read the chapter in full in the FCA Handbook, CASS 8.

What Counts as a Mandate

CASS 8.2.1R defines a mandate as any means that give a firm the ability to control a client’s assets or liabilities, where five conditions are met:

1. Obtained from the client with consent. The firm got the means from the client, and the client agreed.
2. Written form, for insurance business. Where the means are obtained in connection with insurance distribution activity, they must be in written form when obtained. For other business, the FCA’s guidance in CASS 8.2.2 confirms that a mandate can take any form, including an authority given orally.
3. Retained by the firm. The firm keeps the means rather than using them once and destroying them.
4. Able to give instructions to someone else. The means let the firm instruct another person about the client’s money held in an account, money the client is entitled to, an asset that other person holds for the client, or so that the client incurs a debt or liability to someone other than the firm.
5. No further client involvement needed. The firm’s instructions can take effect without the client having to do anything more.

The guidance gives examples. A direct debit over a client’s bank account in the firm’s favour can be a mandate, even if set up as a paperless direct debit, and so can written information setting out a client’s credit card details. A mandate need not be labelled as one: it can be a standalone document, a clause in a wider agreement or a combination of provisions across several documents.

Retention matters. Card details taken to process a payment there and then, and not kept, are unlikely to be a mandate; details kept on a file, in a CRM note or in a call recording may well be. The instructions must also go to a third party with its own relationship with the client, such as the client’s bank, custodian or card provider. A value limit on use does not take an authority outside the definition, but if the third party needs the client’s own signature before acting, the fifth condition is not met.

Which Firms CASS 8 Applies To

Under CASS 8.1.1R, the mandate rules apply when a firm has a mandate in the course of, or in connection with, three types of business:

• Designated investment business, including MiFID business. This brings in wealth managers, discretionary managers and advisers that hold authorities over client accounts held elsewhere.
• Insurance distribution activity, except where it relates to a reinsurance contract. This covers brokers and other insurance intermediaries, including where they collect payment details for premiums or arrange instalment payments.
• Debt management activity, where firms often hold authorities connected with client repayments.

CASS 8.1.2AR switches the mandate rules off for money and assets the firm already holds under other CASS chapters, such as client money under CASS 5 or CASS 7 and custody assets under CASS 6. The guidance stresses this is not an absolute exemption: a broker holding client money under CASS 5 does not apply CASS 8 to that money, but if it can also draw money from the client’s own bank account, the mandate rules apply to that authority. For the CASS 5 side, see CASS 5 for insurance intermediaries and client money at a new brokerage.

Situations worth checking

• Brokers taking card details by phone, especially where recordings are retained.
• Premium finance and instalment arrangements, where the broker keeps the client’s bank details.
• Discretionary managers that can instruct a platform or custodian without the client’s sign-off.
• Introducer models, where a firm “only introduces” but keeps payment details or signed authorities on file.

The Record-Keeping and Control Requirements

CASS 8.3.1R requires a firm that has mandates to establish and maintain adequate records and internal controls in respect of its use of them. CASS 8.3.2R sets out what those must include:

• An up-to-date list of each mandate, including any conditions placed on its use by the client or by the firm’s management.
• A record of each transaction entered into under each mandate.
• Internal controls to make sure each transaction is in line with those conditions.
• Details of the procedures and internal controls around the giving of instructions under the mandates.
• Safeguarding controls for passbooks or similar documents belonging to the client, covering loss, unauthorised destruction, theft, fraud and misuse.

The list must be kept in a medium the FCA or an auditor can retrieve, with changes traceable to earlier contents. For mandates not in writing, it must also record the nature and purpose of the mandate, how it was obtained, the client’s name and the date. The guidance says a mandate created by retaining a call recording belongs on the list whether or not the firm means to use it, that firms should avoid copying mandate details into extra records, and that each place the information is held should be recorded. After a mandate ends, records must be kept for at least one year, or five years where it was held in connection with MiFID business.

CASS 8.3.3 separates conditions on use of the mandate itself, such as a value limit or which staff may give instructions, from criteria that apply to the client’s transactions, such as investment restrictions. Only the first type must be captured and controlled under the mandate rules.

Audit, Oversight and Accountability

Where a firm must obtain a client assets report from its auditor, the FCA’s reporting template includes the mandate rules alongside the custody, client money and collateral rules, so mandate records and controls are tested in the same exercise. The FCA explains who needs a report and when it must be submitted on its client asset reports page, and its client money and assets hub collects its wider CASS material.

On accountability, under the SMCR a Senior Manager should clearly own the firm’s CASS compliance, and where the prescribed responsibility for CASS applies to your firm, mandates fall inside that remit. See SMCR prescribed responsibilities explained. In a small firm this is often the compliance officer (SMF16) or an executive director, with day-to-day operation delegated to an operations or finance lead. Mandates should also feature in the firm’s compliance monitoring and, for firms that hold client money too, should be considered alongside the CASS resolution pack where one is required.

Common Weaknesses in Smaller Firms

The issues below come up repeatedly when small firms review their mandate arrangements. They are typical patterns, not FCA statistics.

• No mandate register at all, because the firm assumed CASS only applies to firms that hold client money.
• Stale card details left on files, in emails or in CRM notes long after the payment they were taken for.
• Call recordings containing card numbers that are retained but not treated as mandates.
• Access not removed when staff leave, so former employees remain authorised users on client or platform accounts.
• No transaction log linking each payment back to the authority it relied on.
• Signed blank or open-ended forms held “for convenience” with no record of conditions or use.

Who Should Own Mandate Controls in a Small Firm

There are three layers. The Senior Manager accountable for CASS sets policy and reports to the board. An operations or finance lead runs the register, access controls and the link between transactions and authorities. Compliance monitoring tests that the controls work. In a small firm two layers may sit with one person, provided the independence of monitoring is thought through; see compliance officer independence.

When you need specialist help

A generalist compliance officer can usually run mandate controls once designed. Specialist CASS experience matters when the firm adds a new payment model or premium finance, combines mandates with client money, or faces a first client assets audit or audit findings. As we explain in why client money experience has to be specific, CASS knowledge does not transfer automatically from general finance or compliance roles. For many small firms a part-time compliance officer with CASS experience, or a short fractional engagement to build the framework, is proportionate. Brokers can also see our page on compliance officers for insurance brokers.

Interview Questions on CASS 8

If mandate controls will fall to the person you are hiring, test it directly. Our wider guide to interviewing SMF candidates covers the rest of the interview.

• Talk me through how you would decide whether a particular authority we hold is a mandate under CASS 8.
• Where would you expect to find unrecorded mandates in a business like ours?
• How would you handle card details captured in call recordings?
• How do the mandate rules interact with the client money rules when we hold both?
• What would you report to the board on mandates each quarter?

Be cautious of a candidate who says CASS 8 only matters to large investment firms, or who proposes a framework a small firm could not run.

The Bottom Line

CASS 8 turns on what a firm can do with a client’s authority, not on whether it holds client money. Find every authority, keep only what you need, record it properly and control who can use it. Give one Senior Manager clear ownership and have someone with real CASS experience design the framework.

Frequently Asked Questions

Does CASS 8 apply if we never hold client money?

It can. CASS 8 applies where a firm holds a mandate in connection with designated investment business, insurance distribution activity or debt management activity, whether or not it holds client money.

Are a client’s card details a mandate?

They can be, if the firm obtained them from the client, retains them and can use them without further client involvement. Details taken for an immediate payment and not kept are unlikely to be.

Does a mandate have to be in writing?

For insurance distribution activity, yes, at the time it is obtained. For other business, FCA guidance says a mandate can take any form, including an oral authority, and retained call recordings can create one.

How long must we keep mandate records?

At least one year after the mandate ends, or five years where it was held in connection with MiFID business.