The FCA penalty regime, which came into force on 6 March 2010, has been applied for the first time for breaches of the Client Asset Sourcebook (the "CASS" rules), in particular CASS 6 and 7. Failings by Xcap Securities plc to ensure adequate protection of client money and safe custody of assets have resulted in the FCA imposing a fine of £120,900. This was calculated using the five-step framework for determining the level of financial penalty appropriate for breaches committed after March 2010.


Xcap Securities plc ("Xcap") has been trading since 29 June 2010, receiving and administering money and assets from clients as part of its retail stock broking and asset management services. From June 2010 to August 2011 (the "Relevant Period") on any given day Xcap held an average of over £3 million of client money and over £34 million in safe custody assets.

Xcap notified the FCA in October 2010 and again in February 2011, following a CASS audit report, that it had identified issues relating to money transfers, trust letters and the segregation of client assets which constituted breaches of the CASS rules. There were numerous instances of client money being mingled with Xcap's own, and its internal records were insufficient to ensure that it could distinguish money held for one client from that held for another. Xcap's failings were exacerbated as the breaches had existed since it began trading. Xcap assured the FCA that improvements had been made to its systems and procedures to remedy these breaches. However, further serious deficiencies were identified in a Skilled Person's Report, conducted at the behest of the FCA and issued on 27 October 2011, and an audit report sent to the FCA on 20 December 2011. These identified failings in Xcap's custody procedures and internal and external reconciliation processes.

Financial Penalty

The FCA issued its Final Notice against Xcap on 31 May 2013. It considered Xcap's failings to be particularly serious because, had Xcap become insolvent at any point during the Relevant Period, its clients would have faced difficulty or delay in recovering their assets. Not only had the breaches existed from the outset of Xcap starting its business, but they had taken place at a time when there was a high level of industry awareness about the importance of properly protecting client money. Furthermore, these breaches were found throughout the firm's processes, suggesting that its client money arrangements were fundamentally flawed.

In calculating the financial penalty imposed on Xcap, the FCA applied the five-step framework set out in DEPP 6.5A, which came into force in March 2010. Previous fines for CASS breaches involving, by way of example, Towry Investment Management Limited (on 14 September 2011), had been calculated using the old rules as the majority of the relevant breaches occurred prior to 6 March 2010.

The FCA determined that the revenue generated by Xcap was not indicative of the harm caused by its breaches and, in calculating the level of financial penalty to be imposed, focused instead on the daily averages of Xcap's custody assets balance and client money balance. The FCA found that the severity of Xcap's breaches warranted a level 3 calculation in respect of client money; that is, 2% of Xcap's average client money balance. In respect of client assets, the FCA considered level 2 appropriate; that is, 0.2% of the average client asset balance. These figures were then increased to take account of certain aggravating factors, including the extent of the period during which Xcap had failed to remedy the breaches.


This case is the first in which the FCA has applied its current approach to the calculation of financial penalties for breaches of the CASS rules committed after March 2010. It has emphasised, in a press release commenting on the Final Notice issued against Xcap, that the new levels of penalty are expected to result in larger fines and, although the Xcap fine is by no means the heaviest imposed to date, it is clear that the new method provides scope for far greater fines than were historically imposed by the FSA. This demonstrates the gravity of failings relating to client assets and makes clear that firms must take seriously their CASS responsibilities to thoroughly investigate failings through internal review, and their reporting obligations to the FCA. Otherwise, they risk considerable financial penalties from the new regulator.